Windows Analysis Report
Movavi Slideshow Maker 4.exe

Overview

General Information

Sample name: Movavi Slideshow Maker 4.exe
Analysis ID: 1541901
MD5: 0cd8f9edc5183f8729598f19cf2da06b
SHA1: 300049e800fe66c3ea872abf9ac9599b351ba9a6
SHA256: 9a6d2d6ca21a6b83a31aa5a5f855d653d66096ffe0b25dcdf04f4943e3d3892d
Infos:

Detection

Score: 72
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Hides threads from debuggers
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Tries to evade debugger and weak emulator (self modifying code)
Writes to foreign memory regions
Allocates memory with a write watch (potentially for evading sandboxes)
Checks for debuggers (devices)
Checks for kernel debuggers (NtQuerySystemInformation(SystemKernelDebuggerInformation))
Checks if the current process is being debugged
Contains capabilities to detect virtual machines
Creates a process in suspended mode (likely to inject code)
Drops PE files
Found dropped PE file which has not been started or loaded
JA3 SSL client fingerprint seen in connection with other malware
PE file contains an invalid checksum
PE file contains sections with non-standard names
Queries disk information (often used to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses a known web browser user agent for HTTP communication

Classification

Source: SlideshowMaker.exe, 00000009.00000003.1372843707.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: -----BEGIN PUBLIC KEY----- memstr_e5e67c1d-4
Uses 32bit PE files
Source: Movavi Slideshow Maker 4.exe Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
Source: unknown HTTPS traffic detected: 104.26.14.179:443 -> 192.168.2.7:49699 version: TLS 1.2
Source: unknown HTTPS traffic detected: 84.16.252.107:443 -> 192.168.2.7:49731 version: TLS 1.2
Source: unknown HTTPS traffic detected: 84.16.252.107:443 -> 192.168.2.7:49732 version: TLS 1.2
Source: unknown HTTPS traffic detected: 84.16.252.107:443 -> 192.168.2.7:49738 version: TLS 1.2
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\CoreApp.pdb**! source: SlideshowMaker.exe, 00000009.00000003.1374251372.0000000003C80000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374563655.0000000003CEE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1373423805.0000000003B81000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\ParserFactory.pdb source: SlideshowMaker.exe, 00000009.00000003.1391903450.000000000495D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\ComputingResourceManager.pdb source: SlideshowMaker.exe, 00000009.00000003.1390323142.0000000004986000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\EditingScene.pdb)) source: SlideshowMaker.exe, 00000009.00000003.1390884817.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1392867696.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1395381060.0000000004CFE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1393289704.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1397208342.0000000004D85000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394983389.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394274414.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\Policies.pdb""! source: SlideshowMaker.exe, 00000009.00000003.1390323142.0000000004986000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\BeatDetection.pdb source: SlideshowMaker.exe, 00000009.00000003.1390884817.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1392867696.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1395381060.0000000004CFE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1393289704.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394983389.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394274414.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\CodecPolicyController.pdb source: SlideshowMaker.exe, 00000009.00000003.1374251372.0000000003C80000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1373423805.0000000003B81000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\PatentActivator.pdb source: SlideshowMaker.exe, 00000009.00000003.1374251372.0000000003C80000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1373423805.0000000003B81000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\OverlayEngine.pdb'' source: SlideshowMaker.exe, 00000009.00000003.1390884817.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1392867696.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1395381060.0000000004CFE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1393289704.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1397208342.0000000004D85000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394983389.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394274414.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\CoreTime.pdb source: SlideshowMaker.exe, 00000009.00000003.1374251372.0000000003F41000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1375620924.0000000003F41000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1375871241.0000000003F41000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\MQtDownloadManager.pdb source: SlideshowMaker.exe, 00000009.00000003.1373157037.0000000000A8C000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1373772577.0000000000AEA000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1373077353.0000000000A24000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000002.2520766407.00000000013D9000.00000002.10000000.00040000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\Resize.pdb source: SlideshowMaker.exe, 00000009.00000002.2521524914.0000000001526000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\MovaviAudIO.pdb source: SlideshowMaker.exe, 00000009.00000003.1391365609.0000000004A6E000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1391932278.0000000004AB7000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1390323142.0000000004986000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\Settings.pdb!! source: SlideshowMaker.exe, 00000009.00000003.1373022188.0000000001082000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\AccelerationTracker.pdb!! source: SlideshowMaker.exe, 00000009.00000003.1391365609.0000000004A6E000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1391932278.0000000004AB7000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394983389.0000000004CC9000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1390323142.0000000004986000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\DesktopNotification.pdb source: SlideshowMaker.exe, 00000009.00000003.1374821434.0000000000B03000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1373157037.0000000000A8C000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1373772577.0000000000AEA000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1373077353.0000000000A24000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\CoreApp.pdb source: SlideshowMaker.exe, 00000009.00000003.1374251372.0000000003C80000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374563655.0000000003CEE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1373423805.0000000003B81000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\EditorSerialization.pdb source: SlideshowMaker.exe, 00000009.00000003.1390884817.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1392867696.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1395381060.0000000004CFE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1393289704.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394983389.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394274414.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\SlideshowMaker.pdb<<* source: SlideshowMaker.exe, 00000009.00000002.2504217955.0000000000479000.00000002.00000001.01000000.00000008.sdmp
Source: Binary string: D:\work\SDK\glog\0.3.4\lib\Win\msvc-14.0\x86\libglog-msvc-14.pdb source: SlideshowMaker.exe, 00000009.00000002.2510216302.00000000007EE000.00000002.10000000.00040000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\PlayerControl.pdb## source: SlideshowMaker.exe, 00000009.00000003.1393289704.0000000004B80000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1391365609.0000000004A6E000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1391932278.0000000004AB7000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1390323142.0000000004986000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\Settings.pdb source: SlideshowMaker.exe, 00000009.00000003.1373022188.0000000001082000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: vcruntime140.i386.pdbGCTL source: SlideshowMaker.exe, 00000009.00000002.2511227658.0000000000891000.00000020.10000000.00040000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\ClientAPI.pdb source: SlideshowMaker.exe, 00000009.00000003.1375528089.0000000004419000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\MovaviTracker.pdb(( source: SlideshowMaker.exe, 00000009.00000002.2505976219.0000000000500000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\GraphicsSvg.pdb source: SlideshowMaker.exe, 00000009.00000003.1390884817.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1392867696.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1395381060.0000000004CFE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1393289704.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1397208342.0000000004D85000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394983389.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394274414.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\EditorTransitions.pdb!! source: SlideshowMaker.exe, 00000009.00000003.1390884817.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1392867696.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1395381060.0000000004CFE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1393289704.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1397208342.0000000004D85000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394983389.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394274414.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\MQtUtil.pdb source: SlideshowMaker.exe, 00000009.00000003.1373423805.0000000003B81000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\Presets.pdb source: SlideshowMaker.exe, 00000009.00000003.1391365609.0000000004A6E000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1391932278.0000000004AB7000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1390323142.0000000004986000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\AudioRendererSDL.pdb$$! source: SlideshowMaker.exe, 00000009.00000003.1391365609.0000000004A6E000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1391932278.0000000004AB7000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1390323142.0000000004986000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\work\SDK\glog\0.3.4\lib\Win\msvc-14.0\x86\libglog-msvc-14.pdb"" source: SlideshowMaker.exe, 00000009.00000002.2510216302.00000000007EE000.00000002.10000000.00040000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\OpenglSwitcherAPI.pdb## source: SlideshowMaker.exe, 00000009.00000002.2516496387.0000000000C5A000.00000002.10000000.00040000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1373215076.00000000009D0000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\EditorTransitions.pdb source: SlideshowMaker.exe, 00000009.00000003.1390884817.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1392867696.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1395381060.0000000004CFE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1393289704.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1397208342.0000000004D85000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394983389.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394274414.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\ASSWrapper.pdb source: SlideshowMaker.exe, 00000009.00000003.1391365609.0000000004A6E000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1390323142.0000000004986000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\MovaviIO.pdb66 source: SlideshowMaker.exe, 00000009.00000003.1373423805.0000000003B81000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\EffectsSpecial.pdb source: SlideshowMaker.exe, 00000009.00000003.1390884817.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1392867696.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1398975329.0000000004EEC000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1395381060.0000000004CFE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1393289704.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1397208342.0000000004D85000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394983389.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\MQtDownloadManager.pdb$$ source: SlideshowMaker.exe, 00000009.00000003.1373157037.0000000000A8C000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1373772577.0000000000AEA000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1373077353.0000000000A24000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000002.2520766407.00000000013D9000.00000002.10000000.00040000.00000000.sdmp
Source: Binary string: C:\bamboo-home\xml-data\build-dir\SPOONVM-VM-JOB1\vm\Build\Output\x86\VmX.pdb source: Movavi Slideshow Maker 4.exe, 00000000.00000002.2506359177.000000000076B000.00000004.00000020.00020000.00000000.sdmp, Movavi Slideshow Maker 4.exe, 00000000.00000002.2515205517.000000001003C000.00000002.10000000.00040000.00000000.sdmp, Movavi Slideshow Maker 4.exe, 00000000.00000003.1262219785.0000000000799000.00000004.00000020.00020000.00000000.sdmp, Movavi Slideshow Maker 4.exe, 00000000.00000003.1262165775.000000000078C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\bamboo-home\xml-data\build-dir\SPOONVM-VM-JOB1\vm\Build\Output\x86\StubExe.pdb source: Movavi Slideshow Maker 4.exe, 00000000.00000002.2508095933.0000000000920000.00000004.00001000.00020000.00000000.sdmp, Movavi Slideshow Maker 4.exe, 00000000.00000002.2509935348.0000000000C70000.00000040.00001000.00020000.00000000.sdmp, Movavi Slideshow Maker 4.exe, 00000000.00000000.1260047165.0000000000401000.00000020.00000001.01000000.00000003.sdmp
Source: Binary string: C:\bamboo-home\xml-data\build-dir\SPOONVM-VM-JOB1\vm\Build\Output\x64\StubExe.pdb source: Movavi Slideshow Maker 4.exe, 00000000.00000002.2508095933.0000000000920000.00000004.00001000.00020000.00000000.sdmp, Movavi Slideshow Maker 4.exe, 00000000.00000002.2509935348.0000000000C70000.00000040.00001000.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\DataHelpers.pdb source: SlideshowMaker.exe, 00000009.00000003.1375748412.000000000469E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\ResourceUtil.pdb source: SlideshowMaker.exe, 00000009.00000003.1374878662.0000000003D47000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1375161890.0000000003D86000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374251372.0000000003C80000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374563655.0000000003CEE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1373423805.0000000003B81000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000002.2515646507.0000000000C18000.00000002.10000000.00040000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\GraphicsSvg.pdb## source: SlideshowMaker.exe, 00000009.00000003.1390884817.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1392867696.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1395381060.0000000004CFE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1393289704.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1397208342.0000000004D85000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394983389.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394274414.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\MQtMediaUi.pdb source: SlideshowMaker.exe, 00000009.00000003.1390884817.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1392867696.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1395381060.0000000004CFE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1393289704.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1397208342.0000000004D85000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394983389.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394274414.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\EffectFactory.pdb source: SlideshowMaker.exe, 00000009.00000003.1390323142.0000000004986000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\SlideshowMaker.pdb source: SlideshowMaker.exe, 00000009.00000002.2504217955.0000000000479000.00000002.00000001.01000000.00000008.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\MQtUi.pdb source: SlideshowMaker.exe, 00000009.00000003.1396666711.0000000005DD1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\MovaviAudIO.pdb33" source: SlideshowMaker.exe, 00000009.00000003.1391365609.0000000004A6E000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1391932278.0000000004AB7000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1390323142.0000000004986000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\CodecFactory.pdb source: SlideshowMaker.exe, 00000009.00000003.1374878662.0000000003D47000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1375161890.0000000003D86000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1375620924.0000000003E42000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374251372.0000000003C80000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374563655.0000000003CEE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1373423805.0000000003B81000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\BeatDetection.pdb&&" source: SlideshowMaker.exe, 00000009.00000003.1390884817.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1392867696.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1395381060.0000000004CFE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1393289704.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394983389.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394274414.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\CoreTime.pdb source: SlideshowMaker.exe, 00000009.00000003.1374251372.0000000003F41000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1375620924.0000000003F41000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1375871241.0000000003F41000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\PlayerControl.pdb source: SlideshowMaker.exe, 00000009.00000003.1393289704.0000000004B80000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1391365609.0000000004A6E000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1391932278.0000000004AB7000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1390323142.0000000004986000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\OpenglSwitcherAPI.pdb source: SlideshowMaker.exe, 00000009.00000002.2516496387.0000000000C5A000.00000002.10000000.00040000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1373215076.00000000009D0000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\ComputingResourceManager.pdb"" source: SlideshowMaker.exe, 00000009.00000003.1390323142.0000000004986000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\GraphicsFramework.pdb source: SlideshowMaker.exe, 00000009.00000003.1390884817.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1392867696.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1395381060.0000000004CFE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1393289704.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1397208342.0000000004D85000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394983389.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394274414.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\CrashHandler.pdb source: SlideshowMaker.exe, 00000009.00000003.1374878662.0000000003D47000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1375161890.0000000003D86000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374251372.0000000003C80000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374563655.0000000003CEE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1373423805.0000000003B81000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\NagScreen.pdb source: SlideshowMaker.exe, 00000009.00000003.1374878662.0000000003D47000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374251372.0000000003C80000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374563655.0000000003CEE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1373423805.0000000003B81000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\UpdateChecker.pdb source: SlideshowMaker.exe, 00000009.00000003.1390884817.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1392867696.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1398975329.0000000004EEC000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1395381060.0000000004CFE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1393289704.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1397208342.0000000004D85000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394983389.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\AccelerationTracker.pdb source: SlideshowMaker.exe, 00000009.00000003.1391365609.0000000004A6E000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1391932278.0000000004AB7000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394983389.0000000004CC9000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1390323142.0000000004986000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\CoreInt.pdbJJ$ source: SlideshowMaker.exe, 00000009.00000002.2508176517.00000000006CA000.00000002.10000000.00040000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1355258737.0000000000716000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\PatentActivator.pdb$$ source: SlideshowMaker.exe, 00000009.00000003.1374251372.0000000003C80000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1373423805.0000000003B81000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\EditorSerialization.pdb&& source: SlideshowMaker.exe, 00000009.00000003.1390884817.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1392867696.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1395381060.0000000004CFE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1393289704.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394983389.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394274414.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\PackageInstaller.pdb source: SlideshowMaker.exe, 00000009.00000003.1390884817.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1392867696.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1398975329.0000000004EEC000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1395381060.0000000004CFE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1393289704.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1397208342.0000000004D85000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394983389.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394274414.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\PlayerEngine.pdb)) source: SlideshowMaker.exe, 00000009.00000003.1391365609.0000000004A6E000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1391932278.0000000004AB7000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1390323142.0000000004986000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\MQtMediaUtil.pdb source: SlideshowMaker.exe, 00000009.00000003.1391365609.0000000004A6E000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1391932278.0000000004AB7000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1390323142.0000000004986000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: concrt140.i386.pdb source: SlideshowMaker.exe, 00000009.00000003.1391365609.0000000004A6E000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1391932278.0000000004AB7000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1390323142.0000000004986000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\OglManager.pdb source: SlideshowMaker.exe, 00000009.00000003.1373077353.0000000000A24000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\CoreLocalization.pdb!! source: SlideshowMaker.exe, 00000009.00000002.2507314676.0000000000627000.00000002.10000000.00040000.00000000.sdmp
Source: Binary string: C:\bamboo-home\xml-data\build-dir\SPOONVM-VM-JOB1\vm\Build\Output\x86\Vm.pdb source: Movavi Slideshow Maker 4.exe, 00000000.00000002.2508095933.0000000000920000.00000004.00001000.00020000.00000000.sdmp, Movavi Slideshow Maker 4.exe, 00000000.00000002.2509935348.0000000000C70000.00000040.00001000.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\DesktopNotification.pdb%% source: SlideshowMaker.exe, 00000009.00000003.1374821434.0000000000B03000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1373157037.0000000000A8C000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1373772577.0000000000AEA000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1373077353.0000000000A24000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\EditorImports.pdb source: SlideshowMaker.exe, 00000009.00000002.2509730262.00000000007A7000.00000002.10000000.00040000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\GraphicsDecoration.pdb++ source: SlideshowMaker.exe, 00000009.00000003.1390884817.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1392867696.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1395381060.0000000004CFE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1393289704.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1397208342.0000000004D85000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394983389.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394274414.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\MediaTypes.pdb source: SlideshowMaker.exe, 00000009.00000003.1391365609.0000000004A6E000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1390323142.0000000004986000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\MuxerFactory.pdb source: SlideshowMaker.exe, 00000009.00000003.1374878662.0000000003D47000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1375161890.0000000003D86000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1375620924.0000000003E42000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374251372.0000000003C80000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374563655.0000000003CEE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1373423805.0000000003B81000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\GraphicsFramework.pdb%% source: SlideshowMaker.exe, 00000009.00000003.1390884817.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1392867696.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1395381060.0000000004CFE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1393289704.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1397208342.0000000004D85000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394983389.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394274414.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\OverlayEngine.pdb source: SlideshowMaker.exe, 00000009.00000003.1390884817.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1392867696.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1395381060.0000000004CFE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1393289704.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1397208342.0000000004D85000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394983389.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394274414.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: concrt140.i386.pdbGCTL source: SlideshowMaker.exe, 00000009.00000003.1391365609.0000000004A6E000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1391932278.0000000004AB7000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1390323142.0000000004986000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\ProcInt.pdb@@! source: SlideshowMaker.exe, 00000009.00000002.2517703919.0000000000EAC000.00000002.10000000.00040000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1372954438.0000000000F0A000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\MQtMediaUi.pdb"" source: SlideshowMaker.exe, 00000009.00000003.1390884817.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1392867696.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1395381060.0000000004CFE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1393289704.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1397208342.0000000004D85000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394983389.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394274414.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\OglManager.pdb88! source: SlideshowMaker.exe, 00000009.00000003.1373077353.0000000000A24000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\Converters.pdb!! source: SlideshowMaker.exe, 00000009.00000003.1391365609.0000000004A6E000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1391932278.0000000004AB7000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1390323142.0000000004986000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\PlayerEngine.pdb source: SlideshowMaker.exe, 00000009.00000003.1391365609.0000000004A6E000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1391932278.0000000004AB7000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1390323142.0000000004986000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\Resize.pdb source: SlideshowMaker.exe, 00000009.00000002.2521524914.0000000001526000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\SocialProtocol.pdb77 source: SlideshowMaker.exe, 00000009.00000003.1390884817.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1392867696.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1398975329.0000000004EEC000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1395381060.0000000004CFE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1393289704.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1397208342.0000000004D85000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394983389.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\AppUtil.pdb00 source: SlideshowMaker.exe, 00000009.00000003.1374878662.0000000003D47000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1375161890.0000000003D86000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374251372.0000000003C80000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374563655.0000000003CEE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1373423805.0000000003B81000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\ClientAPI.pdb55! source: SlideshowMaker.exe, 00000009.00000003.1375528089.0000000004419000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\FFWrapper.pdb source: SlideshowMaker.exe, 00000009.00000003.1374878662.0000000003D47000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1375161890.0000000003D86000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1375620924.0000000003E42000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374251372.0000000003C80000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374563655.0000000003CEE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1373423805.0000000003B81000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\EditorOverlays.pdb source: SlideshowMaker.exe, 00000009.00000002.2508762188.000000000073D000.00000002.10000000.00040000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\FilterFactory.pdb source: SlideshowMaker.exe, 00000009.00000003.1390323142.0000000004986000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\PackageInstaller.pdb,, source: SlideshowMaker.exe, 00000009.00000003.1390884817.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1392867696.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1398975329.0000000004EEC000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1395381060.0000000004CFE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1393289704.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1397208342.0000000004D85000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394983389.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394274414.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\CrashSenderWrapper.pdb source: SlideshowMaker.exe, 00000009.00000003.1374821434.0000000000B03000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1375492747.0000000000B1A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1373157037.0000000000A8C000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1373772577.0000000000AEA000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1373077353.0000000000A24000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\Tracker.pdb source: SlideshowMaker.exe, 00000009.00000002.2512404317.00000000008D5000.00000002.10000000.00040000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\EditingScene.pdb source: SlideshowMaker.exe, 00000009.00000003.1390884817.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1392867696.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1395381060.0000000004CFE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1393289704.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1397208342.0000000004D85000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394983389.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394274414.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\Policies.pdb source: SlideshowMaker.exe, 00000009.00000003.1390323142.0000000004986000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\SDLManager.pdb source: SlideshowMaker.exe, 00000009.00000003.1391365609.0000000004A6E000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1391932278.0000000004AB7000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1390323142.0000000004986000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\Demuxers.pdb source: SlideshowMaker.exe, 00000009.00000003.1391365609.0000000004A6E000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1391932278.0000000004AB7000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1390323142.0000000004986000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\MagnetizeTools.pdb source: SlideshowMaker.exe, 00000009.00000003.1390884817.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1392867696.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1395381060.0000000004CFE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1393289704.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1397208342.0000000004D85000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394983389.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394274414.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\CoreLocalization.pdb source: SlideshowMaker.exe, 00000009.00000002.2507314676.0000000000627000.00000002.10000000.00040000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\Threading.pdb source: SlideshowMaker.exe, 00000009.00000003.1390323142.0000000004986000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\GraphicsDecoration.pdb source: SlideshowMaker.exe, 00000009.00000003.1390884817.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1392867696.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1395381060.0000000004CFE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1393289704.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1397208342.0000000004D85000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394983389.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394274414.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\VideoRendererOGLQt.pdb source: SlideshowMaker.exe, 00000009.00000003.1391365609.0000000004A6E000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1391932278.0000000004AB7000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1390323142.0000000004986000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\WebBrowser.pdb33' source: SlideshowMaker.exe, 00000009.00000003.1374878662.0000000003D47000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1375161890.0000000003D86000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374251372.0000000003C80000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374563655.0000000003CEE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1373423805.0000000003B81000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\MQtUtil.pdbKK! source: SlideshowMaker.exe, 00000009.00000003.1373423805.0000000003B81000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\ProcInt.pdb source: SlideshowMaker.exe, 00000009.00000002.2517703919.0000000000EAC000.00000002.10000000.00040000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1372954438.0000000000F0A000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\StreamReader.pdb source: SlideshowMaker.exe, 00000009.00000003.1391365609.0000000004A6E000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1391932278.0000000004AB7000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1390323142.0000000004986000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\CoreManager.pdb source: SlideshowMaker.exe, 00000009.00000003.1374878662.0000000003D47000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1375161890.0000000003D86000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1375620924.0000000003E42000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374251372.0000000003C80000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374563655.0000000003CEE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1373423805.0000000003B81000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\NagScreen.pdb,, source: SlideshowMaker.exe, 00000009.00000003.1374878662.0000000003D47000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374251372.0000000003C80000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374563655.0000000003CEE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1373423805.0000000003B81000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\TrackerFactory.pdb source: SlideshowMaker.exe, 00000009.00000002.2514748268.0000000000BD1000.00000002.10000000.00040000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\GeneralMovaviTrackerWrapper.pdb source: SlideshowMaker.exe, 00000009.00000003.1391365609.0000000004A6E000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1391932278.0000000004AB7000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1390323142.0000000004986000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\Threading.pdb!! source: SlideshowMaker.exe, 00000009.00000003.1390323142.0000000004986000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\AudioRendererSDL.pdb source: SlideshowMaker.exe, 00000009.00000003.1391365609.0000000004A6E000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1391932278.0000000004AB7000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1390323142.0000000004986000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\MQtUi.pdbHH source: SlideshowMaker.exe, 00000009.00000003.1396666711.0000000005DD1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\Converters.pdb source: SlideshowMaker.exe, 00000009.00000003.1391365609.0000000004A6E000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1391932278.0000000004AB7000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1390323142.0000000004986000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\PackageInstallerModule.pdb source: SlideshowMaker.exe, 00000009.00000003.1374878662.0000000003D47000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1375161890.0000000003D86000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374251372.0000000003C80000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374563655.0000000003CEE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1373423805.0000000003B81000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\SocialProtocol.pdb source: SlideshowMaker.exe, 00000009.00000003.1390884817.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1392867696.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1398975329.0000000004EEC000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1395381060.0000000004CFE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1393289704.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1397208342.0000000004D85000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394983389.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\WebBrowser.pdb source: SlideshowMaker.exe, 00000009.00000003.1374878662.0000000003D47000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1375161890.0000000003D86000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374251372.0000000003C80000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374563655.0000000003CEE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1373423805.0000000003B81000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\PubSub.pdb!! source: SlideshowMaker.exe, 00000009.00000003.1390884817.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1392867696.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1395381060.0000000004CFE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1393289704.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394983389.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394274414.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\ASSWrapper.pdb!! source: SlideshowMaker.exe, 00000009.00000003.1391365609.0000000004A6E000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1390323142.0000000004986000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\VideoRendererOGLQt.pdb## source: SlideshowMaker.exe, 00000009.00000003.1391365609.0000000004A6E000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1391932278.0000000004AB7000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1390323142.0000000004986000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: vcruntime140.i386.pdb source: SlideshowMaker.exe, 00000009.00000002.2511227658.0000000000891000.00000020.10000000.00040000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\MovaviIO.pdb source: SlideshowMaker.exe, 00000009.00000003.1373423805.0000000003B81000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\CoreInt.pdb source: SlideshowMaker.exe, 00000009.00000002.2508176517.00000000006CA000.00000002.10000000.00040000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1355258737.0000000000716000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\MediaTypes.pdb&& source: SlideshowMaker.exe, 00000009.00000003.1391365609.0000000004A6E000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1390323142.0000000004986000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\GeneralMovaviTrackerWrapper.pdb## source: SlideshowMaker.exe, 00000009.00000003.1391365609.0000000004A6E000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1391932278.0000000004AB7000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1390323142.0000000004986000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\MovaviTracker.pdb source: SlideshowMaker.exe, 00000009.00000002.2505976219.0000000000500000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\PubSub.pdb source: SlideshowMaker.exe, 00000009.00000003.1390884817.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1392867696.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1395381060.0000000004CFE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1393289704.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394983389.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394274414.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\Presets.pdb!! source: SlideshowMaker.exe, 00000009.00000003.1391365609.0000000004A6E000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1391932278.0000000004AB7000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1390323142.0000000004986000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\FFWrapper.pdb,,! source: SlideshowMaker.exe, 00000009.00000003.1374878662.0000000003D47000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1375161890.0000000003D86000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1375620924.0000000003E42000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374251372.0000000003C80000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374563655.0000000003CEE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1373423805.0000000003B81000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\MagnetizeTools.pdb%% source: SlideshowMaker.exe, 00000009.00000003.1390884817.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1392867696.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1395381060.0000000004CFE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1393289704.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1397208342.0000000004D85000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394983389.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394274414.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\AppUtil.pdb source: SlideshowMaker.exe, 00000009.00000003.1374878662.0000000003D47000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1375161890.0000000003D86000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374251372.0000000003C80000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374563655.0000000003CEE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1373423805.0000000003B81000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\UpdateChecker.pdb&& source: SlideshowMaker.exe, 00000009.00000003.1390884817.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1392867696.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1398975329.0000000004EEC000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1395381060.0000000004CFE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1393289704.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1397208342.0000000004D85000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394983389.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File opened: C:\Users\user\Desktop\Data\local\modified\@APPDATA@\Movavi Slideshow Maker 4\ Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File opened: C:\Users\user\AppData\Local\Temp\SPOON\CACHE\0x082C556205010103\ Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File opened: C:\Users\user\AppData\Local\Temp\ Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File opened: C:\Users\user\AppData\Local\Temp\SPOON\CACHE\ Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File opened: C:\Users\user\Desktop\Data\roaming\modified\@APPDATA@\Movavi Slideshow Maker 4\ Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File opened: C:\Users\user\AppData\Local\Temp\SPOON\ Jump to behavior
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: a795593605a13211941d44505b4d1e39
Source: Joe Sandbox View JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /get_nag.php?app=slideshowcreator&module=slideshowcreator&app_ver=4-1-0&partner=&app_mode=activated&lang=it&app_action=app_close&huid=4ced03854cc6a95a6624cd0f09793cbc54da0a95&protocol=1&rnd=29789&os=win&act_key= HTTP/1.1Accept: */*Accept-Language: en-CHAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: mip2.movavi.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /get_nag.php?app=slideshowcreator&module=slideshowcreator&app_ver=4-1-0&partner=&app_mode=activated&lang=it&app_action=app_start&huid=4ced03854cc6a95a6624cd0f09793cbc54da0a95&protocol=1&rnd=29792&os=win&act_key= HTTP/1.1Accept: */*Accept-Language: en-CHAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: mip2.movavi.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /api/v1/codec/all/?akey=&huid=4ced03854cc6a95a6624cd0f09793cbc54da0a95 HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: codec-activate.movavi.com
Source: global traffic HTTP traffic detected: GET /get_nag.php?app=slideshowcreator&module=slideshowcreator&app_ver=4-1-0&partner=&app_mode=activated&lang=it&app_action=capture_screencast&huid=4ced03854cc6a95a6624cd0f09793cbc54da0a95&protocol=1&rnd=29792&os=win&act_key= HTTP/1.1Accept: */*Accept-Language: en-CHAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: mip2.movavi.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /get_nag.php?app=slideshowcreator&module=slideshowcreator&app_ver=4-1-0&partner=&app_mode=activated&lang=it&app_action=major_update&huid=4ced03854cc6a95a6624cd0f09793cbc54da0a95&protocol=1&rnd=29792&os=win&act_key= HTTP/1.1Accept: */*Accept-Language: en-CHAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: mip2.movavi.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /webnagscreens/crossale_suite/style.css HTTP/1.1Accept: */*Accept-Language: en-CHAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: img.movavi.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /webnagscreens/crossale_suite/it.png HTTP/1.1Accept: */*Accept-Language: en-CHAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: img.movavi.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /webnagscreens/crossale_suite/btn_close_it.png HTTP/1.1Accept: */*Accept-Language: en-CHAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: img.movavi.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /webnagscreens/crossale_suite/btn_buy_it.png HTTP/1.1Accept: */*Accept-Language: en-CHAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: img.movavi.comConnection: Keep-Alive
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic HTTP traffic detected: GET /get_nag.php?app=slideshowcreator&module=slideshowcreator&app_ver=4-1-0&partner=&app_mode=activated&lang=it&app_action=app_close&huid=4ced03854cc6a95a6624cd0f09793cbc54da0a95&protocol=1&rnd=29789&os=win&act_key= HTTP/1.1Accept: */*Accept-Language: en-CHAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: mip2.movavi.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /get_nag.php?app=slideshowcreator&module=slideshowcreator&app_ver=4-1-0&partner=&app_mode=activated&lang=it&app_action=app_start&huid=4ced03854cc6a95a6624cd0f09793cbc54da0a95&protocol=1&rnd=29792&os=win&act_key= HTTP/1.1Accept: */*Accept-Language: en-CHAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: mip2.movavi.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /api/v1/codec/all/?akey=&huid=4ced03854cc6a95a6624cd0f09793cbc54da0a95 HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: codec-activate.movavi.com
Source: global traffic HTTP traffic detected: GET /get_nag.php?app=slideshowcreator&module=slideshowcreator&app_ver=4-1-0&partner=&app_mode=activated&lang=it&app_action=capture_screencast&huid=4ced03854cc6a95a6624cd0f09793cbc54da0a95&protocol=1&rnd=29792&os=win&act_key= HTTP/1.1Accept: */*Accept-Language: en-CHAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: mip2.movavi.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /get_nag.php?app=slideshowcreator&module=slideshowcreator&app_ver=4-1-0&partner=&app_mode=activated&lang=it&app_action=major_update&huid=4ced03854cc6a95a6624cd0f09793cbc54da0a95&protocol=1&rnd=29792&os=win&act_key= HTTP/1.1Accept: */*Accept-Language: en-CHAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: mip2.movavi.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /webnagscreens/crossale_suite/style.css HTTP/1.1Accept: */*Accept-Language: en-CHAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: img.movavi.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /webnagscreens/crossale_suite/it.png HTTP/1.1Accept: */*Accept-Language: en-CHAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: img.movavi.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /webnagscreens/crossale_suite/btn_close_it.png HTTP/1.1Accept: */*Accept-Language: en-CHAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: img.movavi.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /webnagscreens/crossale_suite/btn_buy_it.png HTTP/1.1Accept: */*Accept-Language: en-CHAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: img.movavi.comConnection: Keep-Alive
Source: SlideshowMaker.exe, 00000009.00000003.1372843707.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: d04:7e:cb:e9:fc:a5:5f:7b:d0:9e:ae:36:e1:0c:ae:1email.google.comf5:c8:6a:f3:61:62:f1:3a:64:f5:4f:6d:c9:58:7c:06www.google.comd7:55:8f:da:f5:f1:10:5b:b2:13:28:2b:70:77:29:a3login.yahoo.com39:2a:43:4f:0e:07:df:1f:8a:a3:05:de:34:e0:c2:293e:75:ce:d4:6b:69:30:21:21:88:30:ae:86:a8:2a:71e9:02:8b:95:78:e4:15:dc:1a:71:0a:2b:88:15:44:47login.skype.com92:39:d5:34:8f:40:d1:69:5a:74:54:70:e1:f2:3f:43addons.mozilla.orgb0:b7:13:3e:d0:96:f9:b5:6f:ae:91:c8:74:bd:3a:c0login.live.comd8:f3:5f:4e:b7:87:2b:2d:ab:06:92:e3:15:38:2f:b0global trustee05:e2:e6:a4:cd:09:ea:54:d6:65:b0:75:fe:22:a2:56*.google.com0c:76:da:9c:91:0c:4e:2c:9e:fe:15:d0:58:93:3c:4cDigiNotar Root CAf1:4a:13:f4:87:2b:56:dc:39:df:84:ca:7a:a1:06:49DigiNotar Services CA36:16:71:55:43:42:1b:9d:e6:cb:a3:64:41:df:24:38DigiNotar Services 1024 CA0a:82:bd:1e:14:4e:88:14:d7:5b:1a:55:27:be:bf:3eDigiNotar Root CA G2a4:b6:ce:e3:2e:d3:35:46:26:3c:b3:55:3a:a8:92:21CertiID Enterprise Certificate Authority5b:d5:60:9c:64:17:68:cf:21:0e:35:fd:fb:05:ad:41DigiNotar Qualified CA46:9c:2c:b007:27:10:0dDigiNotar Cyber CA07:27:0f:f907:27:10:0301:31:69:b0DigiNotar PKIoverheid CA Overheid en Bedrijven01:31:34:bfDigiNotar PKIoverheid CA Organisatie - G2d6:d0:29:77:f1:49:fd:1a:83:f2:b9:ea:94:8c:5c:b4DigiNotar Extended Validation CA1e:7d:7a:53:3d:45:30:41:96:40:0f:71:48:1f:45:04DigiNotar Public CA 202546:9c:2c:af46:9c:3c:c907:27:14:a9Digisign Server ID (Enrich)4c:0e:63:6aDigisign Server ID - (Enrich)72:03:21:05:c5:0c:08:57:3d:8e:a5:30:4e:fe:e8:b0UTN-USERFirst-Hardware41MD5 Collisions Inc. (http://www.phreedom.org/md5)08:27*.EGO.GOV.TR08:64e-islem.kktcmerkezbankasi.org03:1d:a7AC DG Tr equals www.yahoo.com (Yahoo)
Source: SlideshowMaker.exe, 00000009.00000003.1394983389.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: YoutubeYouTubechannels?part=id&mine=truesnippet,statusE:\J\WS\VE124\ext\appcore\src\Movavi\Social\Protocol\YoutubeProtocol.cppitems/0/idhttps://www.youtube.com/channel/%1pictureFailed to retrieve upload URLhttps://www.youtube.com/watch?v=%1H equals www.youtube.com (Youtube)
Source: SlideshowMaker.exe, 00000009.00000003.1394983389.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: auth_type=rerequest&albumcaptiontitledescriptioncontent_categoryattached_mediamessagenameprivacypublishedmepublic_profilepublish_actionsuser_photoshttps://www.facebook.com/v2.9/dialog/oauth?Facebookme?fields=nameme?fields=idme?fields=pictureme/albums?fields=name,can_uploadme/albumsapplication/jsonimage/jpeg"form-data; name="source"; filename="/%1/photosstartform-data; name="upload_phase"text/plainform-data; name="file_size"media_fbid/me/feedme/permissions?fields=permission,statusCan not parse as JSON: E:\J\WS\VE124\ext\appcore\src\Movavi\Social\Protocol\FacebookProtocol.cpphttp://facebook.com/%1picture/data/urljpgdatacan_uploadstatuspermissionhttp://www.facebook.com/photo.php?fbid=successhttp://www.facebook.com/me/videos/%1upload_session_idvideo_idFailed to retrieve upload session ID failed, chunk size = Upload task with ticket of Trying again, retry Retry limit exceeded cancelled failedend_offsetstart_offset from - Uploading file: transferform-data; name="upload_session_id"form-data; name="start_offset"form-data; name="video_file_chunk"; filename="video/*finisht equals www.facebook.com (Facebook)
Source: SlideshowMaker.exe, 00000009.00000003.1390884817.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1392867696.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1398975329.0000000004EEC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.facebook.com/me/videos/%1 equals www.facebook.com (Facebook)
Source: SlideshowMaker.exe, 00000009.00000003.1390884817.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1392867696.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1398975329.0000000004EEC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.facebook.com/photo.php?fbid= equals www.facebook.com (Facebook)
Source: SlideshowMaker.exe, 00000009.00000003.1390884817.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1392867696.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1398975329.0000000004EEC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: SlideshowMaker.exe, 00000009.00000003.1390884817.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1392867696.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1398975329.0000000004EEC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.facebook.com/v2.9/dialog/oauth? equals www.facebook.com (Facebook)
Source: SlideshowMaker.exe, 00000009.00000003.1410095421.000000000506D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/auth/youtube.upload https://www.googleapis.com/auth/youtube https://www.googleapis.com/auth/userinfo.profile equals www.youtube.com (Youtube)
Source: SlideshowMaker.exe, 00000009.00000003.1394983389.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/oauth2/v1/userinfo?alt=jsonhttps://www.googleapis.com/youtube/v3/%1https://www.googleapis.com/upload/youtube/v3/videos?uploadType=resumable&part=%1tagscategoryIdprivacyStatusYoutube::FieldsResourceFilm & Animation1Autos & Vehicles210Pets & Animals1517Travel & Events19Gaming20People & Blogs222324News & Politics25Howto & Style26Education27Science & Technology28Nonprofits & Activism29Private privacy descriptionPrivateprivatePublic privacy descriptionPublicpublicUnlisted privacy descriptionUnlistedunlisted<>,snippet equals www.youtube.com (Youtube)
Source: SlideshowMaker.exe, 00000009.00000003.1390884817.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1392867696.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1398975329.0000000004EEC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/upload/youtube/v3/videos?uploadType=resumable&part=%1 equals www.youtube.com (Youtube)
Source: SlideshowMaker.exe, 00000009.00000002.2512997144.0000000000A83000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1373157037.0000000000A8C000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1373772577.0000000000AEA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/upload/youtube/v3/videos?uploadType=resumable&part=%1l equals www.youtube.com (Youtube)
Source: SlideshowMaker.exe, 00000009.00000003.1390884817.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1392867696.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1398975329.0000000004EEC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/youtube/v3/%1 equals www.youtube.com (Youtube)
Source: SlideshowMaker.exe, 00000009.00000002.2521155477.00000000014EC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/youtube/v3/%1lly equals www.youtube.com (Youtube)
Source: SlideshowMaker.exe, 00000009.00000003.1390884817.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1392867696.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1398975329.0000000004EEC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/channel/%1 equals www.youtube.com (Youtube)
Source: SlideshowMaker.exe, 00000009.00000003.1390884817.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1392867696.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1398975329.0000000004EEC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/watch?v=%1 equals www.youtube.com (Youtube)
Source: SlideshowMaker.exe, 00000009.00000003.1394983389.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: {'value':'EVERYONE'}{'value':'FRIENDS_OF_FRIENDS'}{'value':'ALL_FRIENDS'}{'value':'SELF'}https://graph.facebook.com/v2.9/%1https://graph-video.facebook.com/v2.9/%1/videosgranteddeclinedidpost_id/posts/_https://www.facebook.com/Facebook::FieldsResourcePrivacy All descriptionPrivacy AllPrivacy Friends descriptionPrivacy FriendsPrivacy Me descriptionPrivacy MeBeauty & fashionBEAUTY_FASHIONBusinessBUSINESSCars & trucksCARS_TRUCKSComedyCOMEDYCute animalsCUTE_ANIMALSEntertainmentENTERTAINMENTFamilyFAMILYFood & healthFOOD_HEALTHHomeHOMELifestyleLIFESTYLEMusicMUSICNewsNEWSPoliticsPOLITICSScienceSCIENCESportsSPORTSTechnologyTECHNOLOGYVideo gamingVIDEO_GAMINGOtherOTHER equals www.facebook.com (Facebook)
Source: global traffic DNS traffic detected: DNS query: start.turbo.net
Source: global traffic DNS traffic detected: DNS query: mip2.movavi.com
Source: global traffic DNS traffic detected: DNS query: codec-activate.movavi.com
Source: global traffic DNS traffic detected: DNS query: img.movavi.com
Source: unknown HTTP traffic detected: POST /services/1.0/activity/vm-18.4.1281.0/run HTTP/1.1Spoon-ConfigId: 9D0F48FB-5A85-4D60-82CD-6B9F784D932BSpoon-ConfigDigest: dd217e68ba4377edc484768b4f73528bSpoon-BuildId: CFFB171A-E983-4234-BD47-C5170F552F60Spoon-MacDigest: F2975D73EFCEDDB89CC9438A1FB4AF6C8F8B857BSpoon-DeviceIp: 192.168.2.7Spoon-TrialProduct: TrueSpoon-StartupFile: @APPDATA@\Movavi Slideshow Maker 4\SlideshowMaker.exeUser-Agent: SpoonVm/1.0Host: start.turbo.netContent-Length: 0Cache-Control: no-cache
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 25 Oct 2024 07:49:59 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingCache-Control: no-cache, privateX-Error-Ex: Not found nagscreens from DBX-XSS-Protection: 0X-Frame-Options: SAMEORIGINReferrer-Policy: strict-origin-when-cross-origin
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 25 Oct 2024 07:50:01 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingCache-Control: no-cache, privateX-Error-Ex: Not found nagscreens from DBX-XSS-Protection: 0X-Frame-Options: SAMEORIGINReferrer-Policy: strict-origin-when-cross-origin
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 25 Oct 2024 07:50:01 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingCache-Control: no-cache, privateX-Error-Ex: Not found nagscreens from DBX-XSS-Protection: 0X-Frame-Options: SAMEORIGINReferrer-Policy: strict-origin-when-cross-origin
Source: SlideshowMaker.exe, 00000009.00000002.2505976219.0000000000500000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://%1/get_settings.php?key=%2&version=%3&tracker=%4
Source: SlideshowMaker.exe, 00000009.00000002.2505976219.0000000000500000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://%1/index.php?key=%2&version=%3&tracker=%4
Source: SlideshowMaker.exe, 00000009.00000002.2505976219.0000000000500000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://%1/index.php?key=%2&version=%3&tracker=%4http://%1/get_settings.php?key=%2&version=%3&tracker
Source: SlideshowMaker.exe, 00000009.00000003.1390884817.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1392867696.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1398975329.0000000004EEC000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1395381060.0000000004CFE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1393289704.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1397208342.0000000004D85000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394983389.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://127.0.0.1:%1/
Source: SlideshowMaker.exe, 00000009.00000003.1390884817.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1392867696.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1398975329.0000000004EEC000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1395381060.0000000004CFE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1393289704.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1397208342.0000000004D85000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394983389.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://127.0.0.1:%1/application/x-www-form-urlencodedcode.%1expires.%1refreshtoken.%1response_typecl
Source: SlideshowMaker.exe, 00000009.00000002.2504217955.0000000000479000.00000002.00000001.01000000.00000008.sdmp String found in binary or memory: http://activate.movavi.com/activate3.php?pname=-APP_NAME-&hwid=-HARDWAREID-&akey=-APP_KEY-&version=-
Source: SlideshowMaker.exe, 00000009.00000002.2521524914.0000000001526000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://activate.movavi.com/activateapple.php?pname=-APP_NAME-&hwid=-HARDWAREID-&akey=-APP_KEY-&versi
Source: SlideshowMaker.exe, 00000009.00000003.1372843707.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://bugreports.qt.io/
Source: SlideshowMaker.exe, 00000009.00000003.1372843707.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://bugreports.qt.io/finishedServerMicrosoft-IIS/4.Microsoft-IIS/5.Netscape-Enterprise/3.WebLogic
Source: SlideshowMaker.exe, 00000009.00000003.1392867696.000000000506D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1391365609.000000000506D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1390323142.000000000506D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1397813930.000000000506D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1410095421.000000000506D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://codec-activate.movavi.com/api/v1/codec/activate/?akey=-LICENSE_KEY-&huid=-HASH_USER_ID-&codec
Source: SlideshowMaker.exe, 00000009.00000002.2505976219.0000000000589000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://creativecommons.org/licenses/by-nd/4.0/
Source: SlideshowMaker.exe, 00000009.00000002.2505976219.0000000000589000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://creativecommons.org/licenses/by-nd/4.0/Blogger
Source: Movavi Slideshow Maker 4.exe, 00000000.00000002.2508095933.0000000000920000.00000004.00001000.00020000.00000000.sdmp, Movavi Slideshow Maker 4.exe, 00000000.00000002.2509935348.0000000000C70000.00000040.00001000.00020000.00000000.sdmp, Movavi Slideshow Maker 4.exe, 00000000.00000003.1262165775.00000000007F9000.00000004.00000020.00020000.00000000.sdmp, Movavi Slideshow Maker 4.exe, 00000000.00000002.2506359177.00000000007F9000.00000004.00000020.00020000.00000000.sdmp, Movavi Slideshow Maker 4.exe, 00000000.00000002.2508095933.0000000000C62000.00000004.00001000.00020000.00000000.sdmp, Movavi Slideshow Maker 4.exe, 00000000.00000003.1262165775.000000000078C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
Source: Movavi Slideshow Maker 4.exe, 00000000.00000002.2508095933.0000000000920000.00000004.00001000.00020000.00000000.sdmp, Movavi Slideshow Maker 4.exe, 00000000.00000002.2509935348.0000000000C70000.00000040.00001000.00020000.00000000.sdmp, Movavi Slideshow Maker 4.exe, 00000000.00000003.1262165775.00000000007F9000.00000004.00000020.00020000.00000000.sdmp, Movavi Slideshow Maker 4.exe, 00000000.00000002.2506359177.00000000007F9000.00000004.00000020.00020000.00000000.sdmp, Movavi Slideshow Maker 4.exe, 00000000.00000002.2508095933.0000000000C62000.00000004.00001000.00020000.00000000.sdmp, Movavi Slideshow Maker 4.exe, 00000000.00000003.1262165775.000000000078C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/COMODORSACodeSigningCA.crl0t
Source: SlideshowMaker.exe, 00000009.00000002.2505976219.0000000000589000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://dharmatype.com)
Source: SlideshowMaker.exe, 00000009.00000002.2505976219.0000000000589000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://dharmatype.com_______________________________________________________________________________
Source: SlideshowMaker.exe, 00000009.00000002.2516496387.0000000000C5A000.00000002.10000000.00040000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1373215076.00000000009D0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://files.movavi.com/dl/support/DevicesList
Source: SlideshowMaker.exe, 00000009.00000002.2516496387.0000000000C5A000.00000002.10000000.00040000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1373215076.00000000009D0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://files.movavi.com/dl/support/DevicesListOglManager::GetOglVersion()
Source: SlideshowMaker.exe, 00000009.00000003.1392867696.000000000506D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1391365609.000000000506D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000002.2516496387.0000000000C5A000.00000002.10000000.00040000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1390323142.000000000506D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1397813930.000000000506D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1373215076.00000000009D0000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1410095421.000000000506D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://files.movavi.com/dl/support/opengl32software.zip
Source: SlideshowMaker.exe, 00000009.00000002.2516496387.0000000000C5A000.00000002.10000000.00040000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1373215076.00000000009D0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://files.movavi.com/dl/support/opengl32software.zipOpenglSwitcher.exedll.dllDownloading
Source: SlideshowMaker.exe, 00000009.00000002.2512997144.0000000000A00000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://fontfabric.com/
Source: SlideshowMaker.exe, 00000009.00000002.2512997144.0000000000A00000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://fontfabric.com/Copyright
Source: SlideshowMaker.exe, 00000009.00000002.2505976219.0000000000500000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://img.movavi.com/webnagscreens/crossale_suite/btn_close_it.png
Source: SlideshowMaker.exe, 00000009.00000003.1392867696.000000000506D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1391365609.000000000506D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1390323142.000000000506D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1397813930.000000000506D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1410095421.000000000506D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/-TAIL_WITH_ARGS-
Source: SlideshowMaker.exe, 00000009.00000003.1392867696.000000000506D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1391365609.000000000506D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1390323142.000000000506D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1397813930.000000000506D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1410095421.000000000506D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/-TAIL_WITH_ARGS-f0
Source: SlideshowMaker.exe, 00000009.00000002.2521524914.0000000001526000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/buy-suitefromslideshow/?asrc=crossnag_sc_vs&-TAIL_WITH_ARGS-
Source: SlideshowMaker.exe, 00000009.00000002.2521524914.0000000001526000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/buy-suitefromslideshow/?asrc=crossnag_sc_vs&-TAIL_WITH_ARGS-Y
Source: SlideshowMaker.exe, 00000009.00000003.1375871241.0000000003F41000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/support/activating_packages/?asrc=packageinstallationwizard&-TAIL_WITH_ARGS-
Source: SlideshowMaker.exe, 00000009.00000002.2521155477.00000000014EC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/support/activation_offline/?asrc=activationwizard&-TAIL_WITH_ARGS-
Source: SlideshowMaker.exe, 00000009.00000002.2521524914.0000000001526000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/support/activation_online/?asrc=activationwizard&-TAIL_WITH_ARGS-
Source: SlideshowMaker.exe, 00000009.00000002.2521524914.0000000001526000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/support/activation_online/?asrc=activationwizard&-TAIL_WITH_ARGS-ITH_A
Source: SlideshowMaker.exe, 00000009.00000003.1373077353.0000000000A24000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/thank_you_for_install/?app=-APP_NAME--AMP-module=-MODULE_NAME--AMP-version=-
Source: SlideshowMaker.exe, 00000009.00000003.1374251372.0000000003F41000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1375620924.0000000003F41000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1375871241.0000000003F41000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://mingw-w64.sourceforge.net/X
Source: SlideshowMaker.exe, 00000009.00000003.1392867696.000000000506D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1391365609.000000000506D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1390323142.000000000506D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1397813930.000000000506D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1410095421.000000000506D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://mip2.movavi.com/get_nag.php?app=-APP_NAME-&module=-MODULE_NAME-&app_ver=-APP_VERSION-&partner
Source: Movavi Slideshow Maker 4.exe, 00000000.00000002.2508095933.0000000000920000.00000004.00001000.00020000.00000000.sdmp, Movavi Slideshow Maker 4.exe, 00000000.00000002.2509935348.0000000000C70000.00000040.00001000.00020000.00000000.sdmp, Movavi Slideshow Maker 4.exe, 00000000.00000003.1262165775.00000000007F9000.00000004.00000020.00020000.00000000.sdmp, Movavi Slideshow Maker 4.exe, 00000000.00000002.2506359177.00000000007F9000.00000004.00000020.00020000.00000000.sdmp, Movavi Slideshow Maker 4.exe, 00000000.00000002.2508095933.0000000000C62000.00000004.00001000.00020000.00000000.sdmp, Movavi Slideshow Maker 4.exe, 00000000.00000003.1262165775.000000000078C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0
Source: SlideshowMaker.exe, 00000009.00000003.1374878662.0000000003D47000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1375161890.0000000003D86000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1375620924.0000000003E42000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374251372.0000000003C80000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374563655.0000000003CEE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1373423805.0000000003B81000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://qt-project.org/xml/features/report-start-end-entity
Source: SlideshowMaker.exe, 00000009.00000003.1374878662.0000000003D47000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1375161890.0000000003D86000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1375620924.0000000003E42000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374251372.0000000003C80000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374563655.0000000003CEE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1373423805.0000000003B81000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://qt-project.org/xml/features/report-whitespace-only-CharData
Source: Movavi Slideshow Maker 4.exe, 00000000.00000002.2503329866.0000000000199000.00000004.00000010.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1390884817.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1373259320.00000000005E5000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374251372.0000000003F41000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374878662.0000000003D47000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1393289704.0000000004B80000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1375748412.000000000474D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1392867696.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1396666711.0000000005DD1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1391365609.0000000004A6E000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1393717459.0000000005AC0000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1375161890.0000000003D86000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374821434.0000000000B03000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1375620924.0000000003E42000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1391903450.000000000495D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000002.2521524914.0000000001526000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1375492747.0000000000B1A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1398975329.0000000004EEC000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374251372.0000000003C80000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1395381060.0000000004CFE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1373157037.0000000000A8C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://rh.symcb.com/rh.crl0
Source: Movavi Slideshow Maker 4.exe, 00000000.00000002.2503329866.0000000000199000.00000004.00000010.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1390884817.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1373259320.00000000005E5000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374251372.0000000003F41000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374878662.0000000003D47000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1393289704.0000000004B80000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1375748412.000000000474D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1392867696.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1396666711.0000000005DD1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1391365609.0000000004A6E000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1393717459.0000000005AC0000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1375161890.0000000003D86000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000002.2512997144.0000000000A83000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374821434.0000000000B03000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1375620924.0000000003E42000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1391903450.000000000495D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000002.2521524914.0000000001526000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1375492747.0000000000B1A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1398975329.0000000004EEC000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374251372.0000000003C80000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1395381060.0000000004CFE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://rh.symcb.com/rh.crt0
Source: Movavi Slideshow Maker 4.exe, 00000000.00000002.2503329866.0000000000199000.00000004.00000010.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1390884817.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1373259320.00000000005E5000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374251372.0000000003F41000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374878662.0000000003D47000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1393289704.0000000004B80000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1375748412.000000000474D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1392867696.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1396666711.0000000005DD1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1391365609.0000000004A6E000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1393717459.0000000005AC0000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1375161890.0000000003D86000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000002.2512997144.0000000000A83000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374821434.0000000000B03000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1375620924.0000000003E42000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1391903450.000000000495D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000002.2521524914.0000000001526000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1375492747.0000000000B1A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1398975329.0000000004EEC000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374251372.0000000003C80000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1395381060.0000000004CFE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://rh.symcd.com0&
Source: SlideshowMaker.exe, 00000009.00000002.2505976219.0000000000589000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://s.s
Source: SlideshowMaker.exe, 00000009.00000003.1374251372.0000000003F41000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1375620924.0000000003F41000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1375871241.0000000003F41000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://s.symcb.com/
Source: Movavi Slideshow Maker 4.exe, 00000000.00000002.2503329866.0000000000199000.00000004.00000010.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1390884817.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1373259320.00000000005E5000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374251372.0000000003F41000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374878662.0000000003D47000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1393289704.0000000004B80000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1375748412.000000000474D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1392867696.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1396666711.0000000005DD1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1391365609.0000000004A6E000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1393717459.0000000005AC0000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1375161890.0000000003D86000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374821434.0000000000B03000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1375620924.0000000003E42000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1391903450.000000000495D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1410850215.0000000004B7D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000002.2521524914.0000000001526000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1375492747.0000000000B1A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1398975329.0000000004EEC000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374251372.0000000003C80000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1395381060.0000000004CFE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://s.symcb.com/universal-root.crl0
Source: SlideshowMaker.exe, 00000009.00000003.1390884817.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1373259320.00000000005E5000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374251372.0000000003F41000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374878662.0000000003D47000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1393289704.0000000004B80000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1375748412.000000000474D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1392867696.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1396666711.0000000005DD1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1391365609.0000000004A6E000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1393717459.0000000005AC0000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1375161890.0000000003D86000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374821434.0000000000B03000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1375620924.0000000003E42000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1391903450.000000000495D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000002.2521524914.0000000001526000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1375492747.0000000000B1A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1398975329.0000000004EEC000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374251372.0000000003C80000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1395381060.0000000004CFE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1373157037.0000000000A8C000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1388990833.00000000053E0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://s.symcd.com0
Source: Movavi Slideshow Maker 4.exe, 00000000.00000002.2503329866.0000000000199000.00000004.00000010.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1390884817.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1373259320.00000000005E5000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374251372.0000000003F41000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374878662.0000000003D47000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1393289704.0000000004B80000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1375748412.000000000474D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1392867696.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1396666711.0000000005DD1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1391365609.0000000004A6E000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1393717459.0000000005AC0000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1375161890.0000000003D86000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374821434.0000000000B03000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1375620924.0000000003E42000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1391903450.000000000495D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1410850215.0000000004B7D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000002.2521524914.0000000001526000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1375492747.0000000000B1A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1398975329.0000000004EEC000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374251372.0000000003C80000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1395381060.0000000004CFE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://s.symcd.com06
Source: SlideshowMaker.exe, 00000009.00000003.1374878662.0000000003D47000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1375161890.0000000003D86000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1375620924.0000000003E42000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374251372.0000000003C80000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374563655.0000000003CEE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1373423805.0000000003B81000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://trolltech.com/xml/features/report-start-end-entity
Source: SlideshowMaker.exe, 00000009.00000003.1374878662.0000000003D47000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1375161890.0000000003D86000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1375620924.0000000003E42000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374251372.0000000003C80000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374563655.0000000003CEE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1373423805.0000000003B81000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://trolltech.com/xml/features/report-whitespace-only-CharData
Source: SlideshowMaker.exe, 00000009.00000003.1390884817.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1373259320.00000000005E5000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374251372.0000000003F41000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374878662.0000000003D47000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1393289704.0000000004B80000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1375748412.000000000474D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1392867696.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1396666711.0000000005DD1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1391365609.0000000004A6E000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1393717459.0000000005AC0000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1375161890.0000000003D86000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374821434.0000000000B03000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1375620924.0000000003E42000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1391903450.000000000495D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1410850215.0000000004B7D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000002.2521524914.0000000001526000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1398975329.0000000004E9A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1375492747.0000000000B1A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1398975329.0000000004EEC000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374251372.0000000003C80000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1395381060.0000000004CFE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0(
Source: SlideshowMaker.exe, 00000009.00000003.1390884817.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1373259320.00000000005E5000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374251372.0000000003F41000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374878662.0000000003D47000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1393289704.0000000004B80000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1375748412.000000000474D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1392867696.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1396666711.0000000005DD1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1391365609.0000000004A6E000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1393717459.0000000005AC0000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1375161890.0000000003D86000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374821434.0000000000B03000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1375620924.0000000003E42000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1391903450.000000000495D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1410850215.0000000004B7D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000002.2521524914.0000000001526000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1398975329.0000000004E9A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1375492747.0000000000B1A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1398975329.0000000004EEC000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374251372.0000000003C80000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1395381060.0000000004CFE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
Source: SlideshowMaker.exe, 00000009.00000003.1390884817.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1373259320.00000000005E5000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374251372.0000000003F41000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374878662.0000000003D47000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1393289704.0000000004B80000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1375748412.000000000474D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1392867696.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1396666711.0000000005DD1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1391365609.0000000004A6E000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1393717459.0000000005AC0000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1375161890.0000000003D86000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374821434.0000000000B03000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1375620924.0000000003E42000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1391903450.000000000495D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1410850215.0000000004B7D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000002.2521524914.0000000001526000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1398975329.0000000004E9A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1375492747.0000000000B1A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1398975329.0000000004EEC000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374251372.0000000003C80000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1395381060.0000000004CFE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ts-ocsp.ws.symantec.com0;
Source: Movavi Slideshow Maker 4.exe, 00000000.00000002.2506359177.000000000076B000.00000004.00000020.00020000.00000000.sdmp, Movavi Slideshow Maker 4.exe, 00000000.00000002.2511470869.0000000001153000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://turbo.net/studio.
Source: SlideshowMaker.exe, 00000009.00000002.2512997144.00000000009DD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000002.2521524914.0000000001526000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000002.2505976219.0000000000589000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://webvisor.com
Source: SlideshowMaker.exe, 00000009.00000002.2505976219.0000000000589000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.FirstSiteGuide.comhttp://www.4thfebruary.com.uaCreative
Source: SlideshowMaker.exe, 00000009.00000002.2512997144.0000000000A83000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: SlideshowMaker.exe, 00000009.00000002.2512997144.0000000000A00000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000002.2512997144.0000000000A83000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0Digitized
Source: SlideshowMaker.exe, 00000009.00000002.2512997144.0000000000A83000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0http://www.apache.org/licenses/LICENSE-2.0Open
Source: SlideshowMaker.exe, 00000009.00000002.2512997144.0000000000A83000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.ascendercorp.com/
Source: SlideshowMaker.exe, 00000009.00000002.2512997144.0000000000A83000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.ascendercorp.com/http://www.ascendercorp.com/http://www.ascendercorp.com/typedesigners.ht
Source: SlideshowMaker.exe, 00000009.00000002.2512997144.0000000000A83000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.ascendercorp.com/http://www.ascendercorp.com/typedesigners.htmlLicensed
Source: SlideshowMaker.exe, 00000009.00000002.2512997144.0000000000A83000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.ascendercorp.com/typedesigners.html
Source: SlideshowMaker.exe, 00000009.00000002.2505976219.0000000000589000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.fontfabric.comhttp://www.doublezerocreatives.com
Source: SlideshowMaker.exe, 00000009.00000002.2505976219.0000000000589000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.fontfabric.comhttp://www.doublezerocreatives.comCopyright
Source: SlideshowMaker.exe, 00000009.00000003.1372843707.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.phreedom.org/md5)
Source: SlideshowMaker.exe, 00000009.00000003.1372843707.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.phreedom.org/md5)08:27
Source: Movavi Slideshow Maker 4.exe, 00000000.00000003.1270576405.0000000002C3C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.w3.or
Source: SlideshowMaker.exe, 00000009.00000002.2521882853.00000000016BE000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: http://www.winimage.com/zLibDll
Source: SlideshowMaker.exe, 00000009.00000003.1374251372.0000000003C80000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1373423805.0000000003B81000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000002.2521882853.00000000016BE000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: http://www.winimage.com/zLibDll-/qiodevice_seek_file_func()
Source: SlideshowMaker.exe, 00000009.00000003.1374251372.0000000003C80000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1373423805.0000000003B81000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000002.2521882853.00000000016BE000.00000002.10000000.00040000.00000000.sdmp String found in binary or memory: http://www.winimage.com/zLibDll1.2.8
Source: SlideshowMaker.exe, 00000009.00000003.1374878662.0000000003D47000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1375161890.0000000003D86000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1375620924.0000000003E42000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374251372.0000000003C80000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374563655.0000000003CEE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1373423805.0000000003B81000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://xml.org/sax/features/namespace-prefixes
Source: SlideshowMaker.exe, 00000009.00000003.1374878662.0000000003D47000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1375161890.0000000003D86000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1375620924.0000000003E42000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374251372.0000000003C80000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374563655.0000000003CEE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1373423805.0000000003B81000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://xml.org/sax/features/namespaces
Source: SlideshowMaker.exe, 00000009.00000003.1374878662.0000000003D47000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1375161890.0000000003D86000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1375620924.0000000003E42000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374251372.0000000003C80000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374563655.0000000003CEE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1373423805.0000000003B81000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://xml.org/sax/features/namespaceshttp://xml.org/sax/features/namespace-prefixeshttp://trolltech
Source: SlideshowMaker.exe, 00000009.00000003.1390884817.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1392867696.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1398975329.0000000004EEC000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1395381060.0000000004CFE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1393289704.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1397208342.0000000004D85000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394983389.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/o/oauth2/auth
Source: SlideshowMaker.exe, 00000009.00000003.1390884817.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1392867696.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1398975329.0000000004EEC000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1395381060.0000000004CFE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1393289704.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1397208342.0000000004D85000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394983389.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/o/oauth2/token
Source: SlideshowMaker.exe, 00000009.00000003.1457169383.000000000BD61000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ampcid.google.com/v1/publisher:getClientId
Source: SlideshowMaker.exe, 00000009.00000003.1390884817.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1392867696.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1398975329.0000000004EEC000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1395381060.0000000004CFE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1393289704.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1397208342.0000000004D85000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394983389.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://api.vimeo.com/%1
Source: SlideshowMaker.exe, 00000009.00000003.1390884817.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1392867696.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1398975329.0000000004EEC000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1395381060.0000000004CFE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1393289704.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1397208342.0000000004D85000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394983389.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://api.vimeo.com/%1VimeoE:
Source: SlideshowMaker.exe, 00000009.00000003.1390884817.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1392867696.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1398975329.0000000004EEC000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1395381060.0000000004CFE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1393289704.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1397208342.0000000004D85000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394983389.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://api.vimeo.com/oauth/access_token
Source: SlideshowMaker.exe, 00000009.00000003.1390884817.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1392867696.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1398975329.0000000004EEC000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1395381060.0000000004CFE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1393289704.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1397208342.0000000004D85000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394983389.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://api.vimeo.com/oauth/authorize
Source: SlideshowMaker.exe, 00000009.00000003.1390884817.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1392867696.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1398975329.0000000004EEC000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1395381060.0000000004CFE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1393289704.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1397208342.0000000004D85000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394983389.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://api.vimeo.com/oauth/authorizehttps://api.vimeo.com/oauth/access_tokenhttp://127.0.0.1:%1/app
Source: SlideshowMaker.exe, 00000009.00000003.1373423805.0000000003B81000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://curl.haxx.se/V
Source: SlideshowMaker.exe, 00000009.00000003.1373423805.0000000003B81000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://curl.haxx.se/docs/copyright.htmlD
Source: SlideshowMaker.exe, 00000009.00000003.1373423805.0000000003B81000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://curl.haxx.se/docs/http-cookies.html
Source: SlideshowMaker.exe, 00000009.00000002.2505976219.0000000000589000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://d.sy
Source: SlideshowMaker.exe, 00000009.00000002.2505976219.0000000000589000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://d.sym
Source: Movavi Slideshow Maker 4.exe, 00000000.00000002.2503329866.0000000000199000.00000004.00000010.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1390884817.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1373259320.00000000005E5000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374251372.0000000003F41000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374878662.0000000003D47000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1393289704.0000000004B80000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1375748412.000000000474D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1392867696.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1396666711.0000000005DD1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1391365609.0000000004A6E000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1393717459.0000000005AC0000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1375161890.0000000003D86000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000002.2512997144.0000000000A83000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374821434.0000000000B03000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1375620924.0000000003E42000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1391903450.000000000495D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1410850215.0000000004B7D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000002.2521524914.0000000001526000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1398975329.0000000004E9A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1375492747.0000000000B1A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1398975329.0000000004EEC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://d.symcb.com/cps0%
Source: SlideshowMaker.exe, 00000009.00000002.2512997144.0000000000A83000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1373157037.0000000000A8C000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1373772577.0000000000AEA000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1373077353.0000000000A24000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://d.symcb.com/r
Source: SlideshowMaker.exe, 00000009.00000003.1394274414.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://d.symcb.com/rpa0
Source: Movavi Slideshow Maker 4.exe, 00000000.00000002.2503329866.0000000000199000.00000004.00000010.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1390884817.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1373259320.00000000005E5000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374251372.0000000003F41000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374878662.0000000003D47000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1393289704.0000000004B80000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1375748412.000000000474D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1392867696.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1396666711.0000000005DD1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1391365609.0000000004A6E000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1393717459.0000000005AC0000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1375161890.0000000003D86000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000002.2512997144.0000000000A83000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374821434.0000000000B03000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1375620924.0000000003E42000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1391903450.000000000495D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1410850215.0000000004B7D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000002.2521524914.0000000001526000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1375492747.0000000000B1A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1398975329.0000000004EEC000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374251372.0000000003C80000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://d.symcb.com/rpa0.
Source: SlideshowMaker.exe, 00000009.00000003.1390884817.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1373259320.00000000005E5000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374251372.0000000003F41000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374878662.0000000003D47000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1393289704.0000000004B80000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1375748412.000000000474D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1392867696.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1396666711.0000000005DD1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1391365609.0000000004A6E000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1393717459.0000000005AC0000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1375161890.0000000003D86000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374821434.0000000000B03000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1375620924.0000000003E42000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1391903450.000000000495D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000002.2521524914.0000000001526000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1375492747.0000000000B1A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1398975329.0000000004EEC000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374251372.0000000003C80000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1395381060.0000000004CFE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1373157037.0000000000A8C000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1388990833.00000000053E0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://d.symcb.com/rpa06
Source: SlideshowMaker.exe, 00000009.00000003.1390884817.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1392867696.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000002.2521524914.0000000001526000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1398975329.0000000004EEC000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1395381060.0000000004CFE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1393289704.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1397208342.0000000004D85000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394983389.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://drive.google.com/?authuser=%1
Source: SlideshowMaker.exe, 00000009.00000003.1390884817.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1392867696.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1398975329.0000000004EEC000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1395381060.0000000004CFE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1393289704.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1397208342.0000000004D85000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394983389.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://drive.google.com/?authuser=%1https://www.googleapis.com/drive/v3/%1https://www.googleapis.co
Source: SlideshowMaker.exe, 00000009.00000003.1390884817.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1392867696.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1398975329.0000000004EEC000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1395381060.0000000004CFE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1393289704.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1397208342.0000000004D85000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394983389.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://drive.google.com/open?id=%1
Source: SlideshowMaker.exe, 00000009.00000003.1390884817.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1392867696.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1398975329.0000000004EEC000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1395381060.0000000004CFE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1393289704.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1397208342.0000000004D85000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394983389.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://i.vimeocdn.com/portrait/%1_300x300
Source: SlideshowMaker.exe, 00000009.00000003.1390884817.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1392867696.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1398975329.0000000004EEC000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1395381060.0000000004CFE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1393289704.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1397208342.0000000004D85000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394983389.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://i2.wp.com/i.vimeocdn.com/portrait/defaults-green_300x300.png?ssl=1
Source: SlideshowMaker.exe, 00000009.00000003.1390884817.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1392867696.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1398975329.0000000004EEC000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1395381060.0000000004CFE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1393289704.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1397208342.0000000004D85000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394983389.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://i2.wp.com/i.vimeocdn.com/portrait/defaults-green_300x300.png?ssl=1urihttps://i.vimeocdn.com/
Source: SlideshowMaker.exe, 00000009.00000003.1398102368.0000000004984000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://mip2.movavi.com
Source: SlideshowMaker.exe, 00000009.00000003.1410670335.0000000004DD7000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000002.2512997144.00000000009DD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000002.2505976219.0000000000589000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://mip2.movavi.com/get_nag.php?app=slideshowcreator&module=slideshowcreator&app_ver=4-1-0&partn
Source: SlideshowMaker.exe, 00000009.00000002.2512997144.0000000000A00000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://mip2.movavi.com/nagscreen/follow?cont_id=226&app=slideshowcreator&app_ver=4-1-0&lang=it&huid
Source: Movavi Slideshow Maker 4.exe, 00000000.00000002.2503329866.0000000000199000.00000004.00000010.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1390884817.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1373259320.00000000005E5000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374251372.0000000003F41000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374878662.0000000003D47000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1393289704.0000000004B80000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1375748412.000000000474D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1392867696.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1396666711.0000000005DD1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1391365609.0000000004A6E000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1393717459.0000000005AC0000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1375161890.0000000003D86000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374821434.0000000000B03000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1375620924.0000000003E42000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1391903450.000000000495D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000002.2521524914.0000000001526000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1375492747.0000000000B1A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1398975329.0000000004EEC000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374251372.0000000003C80000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1395381060.0000000004CFE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1373157037.0000000000A8C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://movavi.com0/
Source: SlideshowMaker.exe, 00000009.00000002.2505976219.0000000000589000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://o474997.ingest.sentry.io/api/5707278/security/?sentry_key=25e22998a8224d34a8ffbc4cae02fc48&s
Source: SlideshowMaker.exe, 00000009.00000002.2512997144.00000000009DD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000002.2521524914.0000000001526000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000002.2505976219.0000000000589000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://portal1.comm100.io;
Source: Movavi Slideshow Maker 4.exe, 00000000.00000002.2511937457.0000000002C19000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://start.turbo.net/
Source: Movavi Slideshow Maker 4.exe, 00000000.00000002.2514077868.0000000003557000.00000004.00000020.00020000.00000000.sdmp, Movavi Slideshow Maker 4.exe, 00000000.00000002.2511937457.0000000002C19000.00000004.00000020.00020000.00000000.sdmp, Movavi Slideshow Maker 4.exe, 00000000.00000003.1356807073.0000000003557000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://start.turbo.net/services/1.0/activity/vm-18.4.1281.0/run
Source: Movavi Slideshow Maker 4.exe, 00000000.00000002.2514077868.0000000003557000.00000004.00000020.00020000.00000000.sdmp, Movavi Slideshow Maker 4.exe, 00000000.00000003.1356807073.0000000003557000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://start.turbo.net/services/1.0/activity/vm-18.4.1281.0/run$Uu
Source: Movavi Slideshow Maker 4.exe, 00000000.00000002.2511937457.0000000002C19000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://start.turbo.net/services/1.0/activity/vm-18.4.1281.0/runF
Source: Movavi Slideshow Maker 4.exe, 00000000.00000002.2514077868.0000000003557000.00000004.00000020.00020000.00000000.sdmp, Movavi Slideshow Maker 4.exe, 00000000.00000003.1356807073.0000000003557000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://start.turbo.net/services/1.0/activity/vm-18.4.1281.0/runsvT#
Source: SlideshowMaker.exe, 00000009.00000003.1457169383.000000000BD61000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://stats.g.doubleclick.net/j/collecta.U
Source: SlideshowMaker.exe, 00000009.00000003.1457169383.000000000BD61000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://tagassistant.google.com/
Source: SlideshowMaker.exe, 00000009.00000003.1457169383.000000000BD61000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.google-analytics.com/debug/bootstrap?id=
Source: SlideshowMaker.exe, 00000009.00000003.1457169383.000000000BD61000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.google-analytics.com/gtm/js?id=
Source: SlideshowMaker.exe, 00000009.00000003.1457169383.000000000BD61000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.google.%/ads/ga-audiences
Source: SlideshowMaker.exe, 00000009.00000003.1457169383.000000000BD61000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/ads/ga-audiences
Source: SlideshowMaker.exe, 00000009.00000003.1392867696.000000000506D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1391365609.000000000506D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1390323142.000000000506D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1397813930.000000000506D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1410095421.000000000506D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/auth/drive
Source: SlideshowMaker.exe, 00000009.00000003.1392867696.000000000506D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1391365609.000000000506D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1390323142.000000000506D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1397813930.000000000506D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1410095421.000000000506D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/auth/drive.appdata
Source: SlideshowMaker.exe, 00000009.00000003.1392867696.000000000506D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1391365609.000000000506D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1390323142.000000000506D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1397813930.000000000506D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1410095421.000000000506D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/auth/drive.file
Source: SlideshowMaker.exe, 00000009.00000003.1390884817.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1392867696.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1398975329.0000000004EEC000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1395381060.0000000004CFE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1393289704.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1397208342.0000000004D85000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394983389.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/auth/plus.me
Source: SlideshowMaker.exe, 00000009.00000003.1390884817.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1392867696.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1398975329.0000000004EEC000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1395381060.0000000004CFE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1393289704.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1397208342.0000000004D85000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394983389.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/auth/plus.mehttps://accounts.google.com/o/oauth2/authhttps://accounts.goo
Source: SlideshowMaker.exe, 00000009.00000003.1410095421.000000000506D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/auth/userinfo.profile
Source: SlideshowMaker.exe, 00000009.00000003.1392867696.000000000506D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1391365609.000000000506D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1390323142.000000000506D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1397813930.000000000506D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1410095421.000000000506D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/auth/youtube
Source: SlideshowMaker.exe, 00000009.00000003.1392867696.000000000506D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1391365609.000000000506D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1390323142.000000000506D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1397813930.000000000506D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1410095421.000000000506D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/auth/youtube.upload
Source: SlideshowMaker.exe, 00000009.00000003.1390884817.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1392867696.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000002.2521524914.0000000001526000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1398975329.0000000004EEC000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1395381060.0000000004CFE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1393289704.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1397208342.0000000004D85000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394983389.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/drive/v3/%1
Source: SlideshowMaker.exe, 00000009.00000003.1390884817.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1392867696.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1398975329.0000000004EEC000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1395381060.0000000004CFE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1393289704.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1397208342.0000000004D85000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394983389.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/oauth2/v1/userinfo?alt=json
Source: SlideshowMaker.exe, 00000009.00000003.1390884817.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1392867696.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1398975329.0000000004EEC000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1395381060.0000000004CFE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1393289704.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1397208342.0000000004D85000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394983389.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/oauth2/v1/userinfo?alt=jsonhttps://www.googleapis.com/youtube/v3/%1https:
Source: SlideshowMaker.exe, 00000009.00000003.1390884817.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1392867696.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1398975329.0000000004EEC000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1395381060.0000000004CFE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1393289704.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1397208342.0000000004D85000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394983389.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/upload/drive/v3/files?uploadType=resumable
Source: SlideshowMaker.exe, 00000009.00000003.1392867696.000000000506D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1391365609.000000000506D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1390323142.000000000506D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1397813930.000000000506D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1410095421.000000000506D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/upload/drive/v3/files?uploadType=resumablew
Source: SlideshowMaker.exe, 00000009.00000003.1390884817.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1392867696.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1398975329.0000000004EEC000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1395381060.0000000004CFE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1393289704.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1397208342.0000000004D85000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394983389.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/upload/youtube/v3/videos?uploadType=resumable&part=%1
Source: SlideshowMaker.exe, 00000009.00000002.2512997144.0000000000A83000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1373157037.0000000000A8C000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1373772577.0000000000AEA000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1373077353.0000000000A24000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/upload/youtube/v3/videos?uploadType=resumable&part=%1l
Source: SlideshowMaker.exe, 00000009.00000003.1390884817.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1392867696.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1398975329.0000000004EEC000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1395381060.0000000004CFE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1393289704.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1397208342.0000000004D85000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394983389.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/youtube/v3/%1
Source: SlideshowMaker.exe, 00000009.00000002.2521155477.00000000014EC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/youtube/v3/%1lly
Source: SlideshowMaker.exe, 00000009.00000003.1457169383.000000000BD61000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.googletagmanager.com/gtag/js?id=
Source: SlideshowMaker.exe, 00000009.00000003.1390884817.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1392867696.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1398975329.0000000004EEC000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1395381060.0000000004CFE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1393289704.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1397208342.0000000004D85000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394983389.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/channel/%1
Source: SlideshowMaker.exe, 00000009.00000003.1390884817.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1392867696.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1398975329.0000000004EEC000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1395381060.0000000004CFE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1393289704.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1397208342.0000000004D85000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394983389.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/channel/%1pictureFailed
Source: SlideshowMaker.exe, 00000009.00000003.1390884817.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1392867696.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1398975329.0000000004EEC000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1395381060.0000000004CFE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1393289704.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1397208342.0000000004D85000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394983389.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/watch?v=%1
Source: SlideshowMaker.exe, 00000009.00000003.1390884817.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1392867696.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1398975329.0000000004EEC000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1395381060.0000000004CFE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1393289704.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1397208342.0000000004D85000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394983389.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/watch?v=%1H
Source: unknown Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown HTTPS traffic detected: 104.26.14.179:443 -> 192.168.2.7:49699 version: TLS 1.2
Source: unknown HTTPS traffic detected: 84.16.252.107:443 -> 192.168.2.7:49731 version: TLS 1.2
Source: unknown HTTPS traffic detected: 84.16.252.107:443 -> 192.168.2.7:49732 version: TLS 1.2
Source: unknown HTTPS traffic detected: 84.16.252.107:443 -> 192.168.2.7:49738 version: TLS 1.2
Sample file is different than original file name gathered from version info
Source: Movavi Slideshow Maker 4.exe, 00000000.00000002.2506359177.000000000076B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameX.VirtualizationRuntime.dllL vs Movavi Slideshow Maker 4.exe
Source: Movavi Slideshow Maker 4.exe, 00000000.00000002.2508095933.0000000000920000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameStubExe.exeL vs Movavi Slideshow Maker 4.exe
Source: Movavi Slideshow Maker 4.exe, 00000000.00000002.2508095933.0000000000920000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameVm.dllL vs Movavi Slideshow Maker 4.exe
Source: Movavi Slideshow Maker 4.exe, 00000000.00000002.2509935348.0000000000C70000.00000040.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameStubExe.exeL vs Movavi Slideshow Maker 4.exe
Source: Movavi Slideshow Maker 4.exe, 00000000.00000002.2513570655.00000000030A0000.00000002.00000001.00040000.000000A1.sdmp Binary or memory string: System.OriginalFileName vs Movavi Slideshow Maker 4.exe
Source: Movavi Slideshow Maker 4.exe, 00000000.00000003.1263598521.0000000002C4D000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: .System.OriginalFileName vs Movavi Slideshow Maker 4.exe
Source: Movavi Slideshow Maker 4.exe, 00000000.00000003.1262932734.0000000002C40000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: .System.OriginalFileName vs Movavi Slideshow Maker 4.exe
Source: Movavi Slideshow Maker 4.exe, 00000000.00000003.1268582387.0000000003501000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: System.OriginalFileName vs Movavi Slideshow Maker 4.exe
Source: Movavi Slideshow Maker 4.exe, 00000000.00000002.2515449806.000000001005C000.00000002.10000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameX.VirtualizationRuntime.dllL vs Movavi Slideshow Maker 4.exe
Source: Movavi Slideshow Maker 4.exe, 00000000.00000003.1263846130.0000000002C4F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: .System.OriginalFileName vs Movavi Slideshow Maker 4.exe
Source: Movavi Slideshow Maker 4.exe, 00000000.00000002.2509935348.0000000000F99000.00000040.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameVm.dllL vs Movavi Slideshow Maker 4.exe
Source: Movavi Slideshow Maker 4.exe, 00000000.00000000.1260065129.00000000004FA000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameSlideshowMaker.exe, vs Movavi Slideshow Maker 4.exe
Source: Movavi Slideshow Maker 4.exe, 00000000.00000003.1266629942.0000000003044000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: <propertyDescription name="System.OriginalFileName" formatID="{0CEF7D53-FA64-11D1-A203-0000F81FEDEE}" propID="6"> vs Movavi Slideshow Maker 4.exe
Source: Movavi Slideshow Maker 4.exe, 00000000.00000003.1262219785.0000000000799000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameX.VirtualizationRuntime.dllL vs Movavi Slideshow Maker 4.exe
Source: Movavi Slideshow Maker 4.exe, 00000000.00000003.1262165775.000000000078C000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameX.VirtualizationRuntime.dllL vs Movavi Slideshow Maker 4.exe
Uses 32bit PE files
Source: Movavi Slideshow Maker 4.exe Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
Source: classification engine Classification label: mal72.evad.winEXE@3/485@4/3
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe File created: C:\Users\user\Desktop\Data Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\__VMX_0x005DB7B3
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\__VMX_0x005DA719
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe Mutant created: \Sessions\1\BaseNamedObjects\Global\__VMX_0x005DA719
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Mutant created: \Sessions\1\BaseNamedObjects\Global\__VMX_0x005DB7B3
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe File created: C:\Users\user\AppData\Local\Temp\SPOON\ Jump to behavior
Source: Movavi Slideshow Maker 4.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe "C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe"
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe Process created: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe "C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe" /864A627C-C6B2-464A-AA13-25D62F282BD8
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe Process created: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe "C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe" /864A627C-C6B2-464A-AA13-25D62F282BD8 Jump to behavior
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe Section loaded: httpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: httpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: corelocalization.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: coreint.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: libglog-msvc-14.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: msvcp140.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: boost_system-vc140-mt-1_60.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: boost_chrono-vc140-mt-1_60.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: boost_filesystem-vc140-mt-1_60.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: confint.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: boost_locale-vc140-mt-1_60.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: trackerfactory.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: tracker.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: coretracker.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: openglswitcherapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: qt5widgets.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: qt5gui.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: qt5core.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: qt5network.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: oglmanager.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: procint.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: settings.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: boost_thread-vc140-mt-1_60.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: boost_date_time-vc140-mt-1_60.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: glew32.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: opengl32.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: glu32.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: mqtutil.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: qt5multimedia.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: movaviio.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: mqtdownloadmanager.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: libcurl.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: quazip.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: patentactivator.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: codecpolicycontroller.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: application.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: desktopnotification.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: coreapp.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: qt5quick.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: qt5qml.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: nagscreen.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: webbrowser.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: resourceutil.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: apputil.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: crashhandler.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: crashsenderwrapper.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: packageinstallermodule.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: editorlogic.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: qt5xml.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: qt5xmlpatterns.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: clientapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: coremanager.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: codecfactory.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: muxerfactory.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: datahelpers.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: ffwrapper.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: avutil.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: libgcc_s_dw2-1.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: libwinpthread-1.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: swresample.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: avcodec.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: avformat.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: avfilter.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: avresample.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: libass.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: swscale.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: parserfactory.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: policies.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: filterfactory.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: effectfactory.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: computingresourcemanager.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: threading.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: asswrapper.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: mediatypes.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: demuxers.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: presets.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: streamreader.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: converters.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: coretime.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: mqtmediautil.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: playercontrol.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: playerengine.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: boost_timer-vc140-mt-1_60.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: audiorenderersdl.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: sdlmanager.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: sdl.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: videorendereroglqt.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: movaviaudio.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: exivmetadata.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: videoanalyzer.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: concrt140.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: generalmovavitrackerwrapper.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: accelerationtracker.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: cudamanager.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: beatdetection.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: pubsub.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: editorserialization.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: editormodel.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: editorutil.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: mqtui.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: qt5winextras.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: mqtmediaui.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: graphicsframework.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: editingscene.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: graphicsdecoration.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: magnetizetools.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: editoreffects.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: editortransitions.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: overlayengine.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: graphicssvg.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: qt5svg.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: packageinstaller.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: editormodule.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: effectsspecial.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: updatechecker.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: socialprotocol.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: editorview.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: editoroverlays.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: editorimports.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: filmmaker.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: wintab32.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: generalplugin.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: dataexchange.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: d3d11.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: dcomp.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: dxgi.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: twinapi.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: ieframe.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: msiso.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: mshtml.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: powrprof.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: umpdc.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: libeay32.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: movavitracker.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: boost_regex-vc140-mt-1_60.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: effectsipp.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: effects.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: effectsff.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: resize.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: effectsogl.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: effectsstock.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: napinsp.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: pnrpnsp.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: wshbth.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: nlaapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: winrnr.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: decodersff.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: encodersff.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: databridge.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: d3d9core.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: d3d11core.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: dxva2.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: d3d9.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: encoderlossless.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: bitstreamfilterff.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: decodercuda.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: encodercuda.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: nvapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: nvcuda.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: nvencodeapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: encodernvenc.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: decoderim.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: encoderim.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: imcore.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: d3d10warp.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: d3d10warp.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: resourcepolicyclient.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: d3d10warp.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: d3d10warp.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: d3d10warp.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: libmfxhw32.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: d3d10warp.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: libmfxhw32.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: d3d10warp.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: libmfxhw32.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: d3d10warp.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: libmfxhw32.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: decodermf.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: mfwrapper.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: mfplat.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: mf.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: mfplat.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: msdmo.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: mfcore.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: ksuser.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: mfperfhelper.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: rtworkq.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: comppkgsup.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: windows.media.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: windows.applicationmodel.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: appxdeploymentclient.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: msauddecmft.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: winmmbase.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: msacm32.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: wmadmod.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: wmspdmod.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: msamrnbdecoder.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: mfdvdec.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: msmpeg2vdec.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: mfmjpegdec.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: mp4sdecd.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: mpg4decd.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: mp43decd.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: wmvsdecd.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: wmvdecod.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: mfaacenc.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: wmadmoe.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: msac3enc.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: mfh264enc.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: wmvxencd.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: encodermf.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: decoderraw.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: vcomp140.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: filtersff.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: filters.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: filtersogl.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: filtersspeex.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: muxers.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: parsersff.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: charsetrecode.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: parserraw.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: parsersmf.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: d3d10warp.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: srpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: mlang.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: msimtf.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: jscript9.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: d2d1.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: d3d10warp.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: dxcore.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: msls31.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: Movavi Slideshow Maker 4.exe Static file information: File size 80474129 > 1048576
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\CoreApp.pdb**! source: SlideshowMaker.exe, 00000009.00000003.1374251372.0000000003C80000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374563655.0000000003CEE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1373423805.0000000003B81000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\ParserFactory.pdb source: SlideshowMaker.exe, 00000009.00000003.1391903450.000000000495D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\ComputingResourceManager.pdb source: SlideshowMaker.exe, 00000009.00000003.1390323142.0000000004986000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\EditingScene.pdb)) source: SlideshowMaker.exe, 00000009.00000003.1390884817.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1392867696.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1395381060.0000000004CFE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1393289704.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1397208342.0000000004D85000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394983389.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394274414.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\Policies.pdb""! source: SlideshowMaker.exe, 00000009.00000003.1390323142.0000000004986000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\BeatDetection.pdb source: SlideshowMaker.exe, 00000009.00000003.1390884817.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1392867696.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1395381060.0000000004CFE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1393289704.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394983389.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394274414.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\CodecPolicyController.pdb source: SlideshowMaker.exe, 00000009.00000003.1374251372.0000000003C80000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1373423805.0000000003B81000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\PatentActivator.pdb source: SlideshowMaker.exe, 00000009.00000003.1374251372.0000000003C80000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1373423805.0000000003B81000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\OverlayEngine.pdb'' source: SlideshowMaker.exe, 00000009.00000003.1390884817.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1392867696.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1395381060.0000000004CFE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1393289704.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1397208342.0000000004D85000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394983389.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394274414.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\CoreTime.pdb source: SlideshowMaker.exe, 00000009.00000003.1374251372.0000000003F41000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1375620924.0000000003F41000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1375871241.0000000003F41000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\MQtDownloadManager.pdb source: SlideshowMaker.exe, 00000009.00000003.1373157037.0000000000A8C000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1373772577.0000000000AEA000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1373077353.0000000000A24000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000002.2520766407.00000000013D9000.00000002.10000000.00040000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\Resize.pdb source: SlideshowMaker.exe, 00000009.00000002.2521524914.0000000001526000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\MovaviAudIO.pdb source: SlideshowMaker.exe, 00000009.00000003.1391365609.0000000004A6E000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1391932278.0000000004AB7000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1390323142.0000000004986000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\Settings.pdb!! source: SlideshowMaker.exe, 00000009.00000003.1373022188.0000000001082000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\AccelerationTracker.pdb!! source: SlideshowMaker.exe, 00000009.00000003.1391365609.0000000004A6E000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1391932278.0000000004AB7000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394983389.0000000004CC9000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1390323142.0000000004986000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\DesktopNotification.pdb source: SlideshowMaker.exe, 00000009.00000003.1374821434.0000000000B03000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1373157037.0000000000A8C000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1373772577.0000000000AEA000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1373077353.0000000000A24000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\CoreApp.pdb source: SlideshowMaker.exe, 00000009.00000003.1374251372.0000000003C80000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374563655.0000000003CEE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1373423805.0000000003B81000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\EditorSerialization.pdb source: SlideshowMaker.exe, 00000009.00000003.1390884817.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1392867696.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1395381060.0000000004CFE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1393289704.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394983389.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394274414.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\SlideshowMaker.pdb<<* source: SlideshowMaker.exe, 00000009.00000002.2504217955.0000000000479000.00000002.00000001.01000000.00000008.sdmp
Source: Binary string: D:\work\SDK\glog\0.3.4\lib\Win\msvc-14.0\x86\libglog-msvc-14.pdb source: SlideshowMaker.exe, 00000009.00000002.2510216302.00000000007EE000.00000002.10000000.00040000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\PlayerControl.pdb## source: SlideshowMaker.exe, 00000009.00000003.1393289704.0000000004B80000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1391365609.0000000004A6E000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1391932278.0000000004AB7000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1390323142.0000000004986000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\Settings.pdb source: SlideshowMaker.exe, 00000009.00000003.1373022188.0000000001082000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: vcruntime140.i386.pdbGCTL source: SlideshowMaker.exe, 00000009.00000002.2511227658.0000000000891000.00000020.10000000.00040000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\ClientAPI.pdb source: SlideshowMaker.exe, 00000009.00000003.1375528089.0000000004419000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\MovaviTracker.pdb(( source: SlideshowMaker.exe, 00000009.00000002.2505976219.0000000000500000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\GraphicsSvg.pdb source: SlideshowMaker.exe, 00000009.00000003.1390884817.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1392867696.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1395381060.0000000004CFE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1393289704.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1397208342.0000000004D85000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394983389.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394274414.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\EditorTransitions.pdb!! source: SlideshowMaker.exe, 00000009.00000003.1390884817.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1392867696.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1395381060.0000000004CFE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1393289704.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1397208342.0000000004D85000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394983389.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394274414.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\MQtUtil.pdb source: SlideshowMaker.exe, 00000009.00000003.1373423805.0000000003B81000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\Presets.pdb source: SlideshowMaker.exe, 00000009.00000003.1391365609.0000000004A6E000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1391932278.0000000004AB7000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1390323142.0000000004986000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\AudioRendererSDL.pdb$$! source: SlideshowMaker.exe, 00000009.00000003.1391365609.0000000004A6E000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1391932278.0000000004AB7000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1390323142.0000000004986000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\work\SDK\glog\0.3.4\lib\Win\msvc-14.0\x86\libglog-msvc-14.pdb"" source: SlideshowMaker.exe, 00000009.00000002.2510216302.00000000007EE000.00000002.10000000.00040000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\OpenglSwitcherAPI.pdb## source: SlideshowMaker.exe, 00000009.00000002.2516496387.0000000000C5A000.00000002.10000000.00040000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1373215076.00000000009D0000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\EditorTransitions.pdb source: SlideshowMaker.exe, 00000009.00000003.1390884817.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1392867696.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1395381060.0000000004CFE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1393289704.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1397208342.0000000004D85000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394983389.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394274414.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\ASSWrapper.pdb source: SlideshowMaker.exe, 00000009.00000003.1391365609.0000000004A6E000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1390323142.0000000004986000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\MovaviIO.pdb66 source: SlideshowMaker.exe, 00000009.00000003.1373423805.0000000003B81000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\EffectsSpecial.pdb source: SlideshowMaker.exe, 00000009.00000003.1390884817.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1392867696.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1398975329.0000000004EEC000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1395381060.0000000004CFE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1393289704.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1397208342.0000000004D85000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394983389.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\MQtDownloadManager.pdb$$ source: SlideshowMaker.exe, 00000009.00000003.1373157037.0000000000A8C000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1373772577.0000000000AEA000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1373077353.0000000000A24000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000002.2520766407.00000000013D9000.00000002.10000000.00040000.00000000.sdmp
Source: Binary string: C:\bamboo-home\xml-data\build-dir\SPOONVM-VM-JOB1\vm\Build\Output\x86\VmX.pdb source: Movavi Slideshow Maker 4.exe, 00000000.00000002.2506359177.000000000076B000.00000004.00000020.00020000.00000000.sdmp, Movavi Slideshow Maker 4.exe, 00000000.00000002.2515205517.000000001003C000.00000002.10000000.00040000.00000000.sdmp, Movavi Slideshow Maker 4.exe, 00000000.00000003.1262219785.0000000000799000.00000004.00000020.00020000.00000000.sdmp, Movavi Slideshow Maker 4.exe, 00000000.00000003.1262165775.000000000078C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\bamboo-home\xml-data\build-dir\SPOONVM-VM-JOB1\vm\Build\Output\x86\StubExe.pdb source: Movavi Slideshow Maker 4.exe, 00000000.00000002.2508095933.0000000000920000.00000004.00001000.00020000.00000000.sdmp, Movavi Slideshow Maker 4.exe, 00000000.00000002.2509935348.0000000000C70000.00000040.00001000.00020000.00000000.sdmp, Movavi Slideshow Maker 4.exe, 00000000.00000000.1260047165.0000000000401000.00000020.00000001.01000000.00000003.sdmp
Source: Binary string: C:\bamboo-home\xml-data\build-dir\SPOONVM-VM-JOB1\vm\Build\Output\x64\StubExe.pdb source: Movavi Slideshow Maker 4.exe, 00000000.00000002.2508095933.0000000000920000.00000004.00001000.00020000.00000000.sdmp, Movavi Slideshow Maker 4.exe, 00000000.00000002.2509935348.0000000000C70000.00000040.00001000.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\DataHelpers.pdb source: SlideshowMaker.exe, 00000009.00000003.1375748412.000000000469E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\ResourceUtil.pdb source: SlideshowMaker.exe, 00000009.00000003.1374878662.0000000003D47000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1375161890.0000000003D86000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374251372.0000000003C80000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374563655.0000000003CEE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1373423805.0000000003B81000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000002.2515646507.0000000000C18000.00000002.10000000.00040000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\GraphicsSvg.pdb## source: SlideshowMaker.exe, 00000009.00000003.1390884817.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1392867696.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1395381060.0000000004CFE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1393289704.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1397208342.0000000004D85000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394983389.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394274414.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\MQtMediaUi.pdb source: SlideshowMaker.exe, 00000009.00000003.1390884817.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1392867696.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1395381060.0000000004CFE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1393289704.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1397208342.0000000004D85000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394983389.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394274414.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\EffectFactory.pdb source: SlideshowMaker.exe, 00000009.00000003.1390323142.0000000004986000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\SlideshowMaker.pdb source: SlideshowMaker.exe, 00000009.00000002.2504217955.0000000000479000.00000002.00000001.01000000.00000008.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\MQtUi.pdb source: SlideshowMaker.exe, 00000009.00000003.1396666711.0000000005DD1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\MovaviAudIO.pdb33" source: SlideshowMaker.exe, 00000009.00000003.1391365609.0000000004A6E000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1391932278.0000000004AB7000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1390323142.0000000004986000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\CodecFactory.pdb source: SlideshowMaker.exe, 00000009.00000003.1374878662.0000000003D47000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1375161890.0000000003D86000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1375620924.0000000003E42000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374251372.0000000003C80000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374563655.0000000003CEE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1373423805.0000000003B81000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\BeatDetection.pdb&&" source: SlideshowMaker.exe, 00000009.00000003.1390884817.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1392867696.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1395381060.0000000004CFE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1393289704.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394983389.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394274414.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\CoreTime.pdb source: SlideshowMaker.exe, 00000009.00000003.1374251372.0000000003F41000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1375620924.0000000003F41000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1375871241.0000000003F41000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\PlayerControl.pdb source: SlideshowMaker.exe, 00000009.00000003.1393289704.0000000004B80000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1391365609.0000000004A6E000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1391932278.0000000004AB7000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1390323142.0000000004986000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\OpenglSwitcherAPI.pdb source: SlideshowMaker.exe, 00000009.00000002.2516496387.0000000000C5A000.00000002.10000000.00040000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1373215076.00000000009D0000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\ComputingResourceManager.pdb"" source: SlideshowMaker.exe, 00000009.00000003.1390323142.0000000004986000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\GraphicsFramework.pdb source: SlideshowMaker.exe, 00000009.00000003.1390884817.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1392867696.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1395381060.0000000004CFE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1393289704.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1397208342.0000000004D85000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394983389.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394274414.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\CrashHandler.pdb source: SlideshowMaker.exe, 00000009.00000003.1374878662.0000000003D47000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1375161890.0000000003D86000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374251372.0000000003C80000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374563655.0000000003CEE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1373423805.0000000003B81000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\NagScreen.pdb source: SlideshowMaker.exe, 00000009.00000003.1374878662.0000000003D47000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374251372.0000000003C80000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374563655.0000000003CEE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1373423805.0000000003B81000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\UpdateChecker.pdb source: SlideshowMaker.exe, 00000009.00000003.1390884817.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1392867696.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1398975329.0000000004EEC000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1395381060.0000000004CFE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1393289704.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1397208342.0000000004D85000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394983389.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\AccelerationTracker.pdb source: SlideshowMaker.exe, 00000009.00000003.1391365609.0000000004A6E000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1391932278.0000000004AB7000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394983389.0000000004CC9000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1390323142.0000000004986000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\CoreInt.pdbJJ$ source: SlideshowMaker.exe, 00000009.00000002.2508176517.00000000006CA000.00000002.10000000.00040000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1355258737.0000000000716000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\PatentActivator.pdb$$ source: SlideshowMaker.exe, 00000009.00000003.1374251372.0000000003C80000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1373423805.0000000003B81000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\EditorSerialization.pdb&& source: SlideshowMaker.exe, 00000009.00000003.1390884817.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1392867696.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1395381060.0000000004CFE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1393289704.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394983389.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394274414.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\PackageInstaller.pdb source: SlideshowMaker.exe, 00000009.00000003.1390884817.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1392867696.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1398975329.0000000004EEC000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1395381060.0000000004CFE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1393289704.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1397208342.0000000004D85000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394983389.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394274414.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\PlayerEngine.pdb)) source: SlideshowMaker.exe, 00000009.00000003.1391365609.0000000004A6E000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1391932278.0000000004AB7000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1390323142.0000000004986000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\MQtMediaUtil.pdb source: SlideshowMaker.exe, 00000009.00000003.1391365609.0000000004A6E000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1391932278.0000000004AB7000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1390323142.0000000004986000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: concrt140.i386.pdb source: SlideshowMaker.exe, 00000009.00000003.1391365609.0000000004A6E000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1391932278.0000000004AB7000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1390323142.0000000004986000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\OglManager.pdb source: SlideshowMaker.exe, 00000009.00000003.1373077353.0000000000A24000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\CoreLocalization.pdb!! source: SlideshowMaker.exe, 00000009.00000002.2507314676.0000000000627000.00000002.10000000.00040000.00000000.sdmp
Source: Binary string: C:\bamboo-home\xml-data\build-dir\SPOONVM-VM-JOB1\vm\Build\Output\x86\Vm.pdb source: Movavi Slideshow Maker 4.exe, 00000000.00000002.2508095933.0000000000920000.00000004.00001000.00020000.00000000.sdmp, Movavi Slideshow Maker 4.exe, 00000000.00000002.2509935348.0000000000C70000.00000040.00001000.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\DesktopNotification.pdb%% source: SlideshowMaker.exe, 00000009.00000003.1374821434.0000000000B03000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1373157037.0000000000A8C000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1373772577.0000000000AEA000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1373077353.0000000000A24000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\EditorImports.pdb source: SlideshowMaker.exe, 00000009.00000002.2509730262.00000000007A7000.00000002.10000000.00040000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\GraphicsDecoration.pdb++ source: SlideshowMaker.exe, 00000009.00000003.1390884817.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1392867696.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1395381060.0000000004CFE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1393289704.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1397208342.0000000004D85000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394983389.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394274414.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\MediaTypes.pdb source: SlideshowMaker.exe, 00000009.00000003.1391365609.0000000004A6E000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1390323142.0000000004986000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\MuxerFactory.pdb source: SlideshowMaker.exe, 00000009.00000003.1374878662.0000000003D47000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1375161890.0000000003D86000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1375620924.0000000003E42000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374251372.0000000003C80000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374563655.0000000003CEE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1373423805.0000000003B81000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\GraphicsFramework.pdb%% source: SlideshowMaker.exe, 00000009.00000003.1390884817.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1392867696.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1395381060.0000000004CFE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1393289704.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1397208342.0000000004D85000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394983389.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394274414.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\OverlayEngine.pdb source: SlideshowMaker.exe, 00000009.00000003.1390884817.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1392867696.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1395381060.0000000004CFE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1393289704.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1397208342.0000000004D85000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394983389.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394274414.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: concrt140.i386.pdbGCTL source: SlideshowMaker.exe, 00000009.00000003.1391365609.0000000004A6E000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1391932278.0000000004AB7000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1390323142.0000000004986000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\ProcInt.pdb@@! source: SlideshowMaker.exe, 00000009.00000002.2517703919.0000000000EAC000.00000002.10000000.00040000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1372954438.0000000000F0A000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\MQtMediaUi.pdb"" source: SlideshowMaker.exe, 00000009.00000003.1390884817.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1392867696.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1395381060.0000000004CFE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1393289704.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1397208342.0000000004D85000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394983389.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394274414.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\OglManager.pdb88! source: SlideshowMaker.exe, 00000009.00000003.1373077353.0000000000A24000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\Converters.pdb!! source: SlideshowMaker.exe, 00000009.00000003.1391365609.0000000004A6E000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1391932278.0000000004AB7000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1390323142.0000000004986000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\PlayerEngine.pdb source: SlideshowMaker.exe, 00000009.00000003.1391365609.0000000004A6E000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1391932278.0000000004AB7000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1390323142.0000000004986000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\Resize.pdb source: SlideshowMaker.exe, 00000009.00000002.2521524914.0000000001526000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\SocialProtocol.pdb77 source: SlideshowMaker.exe, 00000009.00000003.1390884817.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1392867696.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1398975329.0000000004EEC000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1395381060.0000000004CFE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1393289704.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1397208342.0000000004D85000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394983389.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\AppUtil.pdb00 source: SlideshowMaker.exe, 00000009.00000003.1374878662.0000000003D47000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1375161890.0000000003D86000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374251372.0000000003C80000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374563655.0000000003CEE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1373423805.0000000003B81000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\ClientAPI.pdb55! source: SlideshowMaker.exe, 00000009.00000003.1375528089.0000000004419000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\FFWrapper.pdb source: SlideshowMaker.exe, 00000009.00000003.1374878662.0000000003D47000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1375161890.0000000003D86000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1375620924.0000000003E42000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374251372.0000000003C80000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374563655.0000000003CEE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1373423805.0000000003B81000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\EditorOverlays.pdb source: SlideshowMaker.exe, 00000009.00000002.2508762188.000000000073D000.00000002.10000000.00040000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\FilterFactory.pdb source: SlideshowMaker.exe, 00000009.00000003.1390323142.0000000004986000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\PackageInstaller.pdb,, source: SlideshowMaker.exe, 00000009.00000003.1390884817.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1392867696.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1398975329.0000000004EEC000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1395381060.0000000004CFE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1393289704.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1397208342.0000000004D85000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394983389.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394274414.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\CrashSenderWrapper.pdb source: SlideshowMaker.exe, 00000009.00000003.1374821434.0000000000B03000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1375492747.0000000000B1A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1373157037.0000000000A8C000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1373772577.0000000000AEA000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1373077353.0000000000A24000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\Tracker.pdb source: SlideshowMaker.exe, 00000009.00000002.2512404317.00000000008D5000.00000002.10000000.00040000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\EditingScene.pdb source: SlideshowMaker.exe, 00000009.00000003.1390884817.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1392867696.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1395381060.0000000004CFE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1393289704.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1397208342.0000000004D85000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394983389.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394274414.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\Policies.pdb source: SlideshowMaker.exe, 00000009.00000003.1390323142.0000000004986000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\SDLManager.pdb source: SlideshowMaker.exe, 00000009.00000003.1391365609.0000000004A6E000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1391932278.0000000004AB7000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1390323142.0000000004986000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\Demuxers.pdb source: SlideshowMaker.exe, 00000009.00000003.1391365609.0000000004A6E000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1391932278.0000000004AB7000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1390323142.0000000004986000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\MagnetizeTools.pdb source: SlideshowMaker.exe, 00000009.00000003.1390884817.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1392867696.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1395381060.0000000004CFE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1393289704.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1397208342.0000000004D85000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394983389.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394274414.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\CoreLocalization.pdb source: SlideshowMaker.exe, 00000009.00000002.2507314676.0000000000627000.00000002.10000000.00040000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\Threading.pdb source: SlideshowMaker.exe, 00000009.00000003.1390323142.0000000004986000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\GraphicsDecoration.pdb source: SlideshowMaker.exe, 00000009.00000003.1390884817.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1392867696.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1395381060.0000000004CFE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1393289704.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1397208342.0000000004D85000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394983389.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394274414.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\VideoRendererOGLQt.pdb source: SlideshowMaker.exe, 00000009.00000003.1391365609.0000000004A6E000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1391932278.0000000004AB7000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1390323142.0000000004986000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\WebBrowser.pdb33' source: SlideshowMaker.exe, 00000009.00000003.1374878662.0000000003D47000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1375161890.0000000003D86000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374251372.0000000003C80000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374563655.0000000003CEE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1373423805.0000000003B81000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\MQtUtil.pdbKK! source: SlideshowMaker.exe, 00000009.00000003.1373423805.0000000003B81000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\ProcInt.pdb source: SlideshowMaker.exe, 00000009.00000002.2517703919.0000000000EAC000.00000002.10000000.00040000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1372954438.0000000000F0A000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\StreamReader.pdb source: SlideshowMaker.exe, 00000009.00000003.1391365609.0000000004A6E000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1391932278.0000000004AB7000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1390323142.0000000004986000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\CoreManager.pdb source: SlideshowMaker.exe, 00000009.00000003.1374878662.0000000003D47000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1375161890.0000000003D86000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1375620924.0000000003E42000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374251372.0000000003C80000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374563655.0000000003CEE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1373423805.0000000003B81000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\NagScreen.pdb,, source: SlideshowMaker.exe, 00000009.00000003.1374878662.0000000003D47000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374251372.0000000003C80000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374563655.0000000003CEE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1373423805.0000000003B81000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\TrackerFactory.pdb source: SlideshowMaker.exe, 00000009.00000002.2514748268.0000000000BD1000.00000002.10000000.00040000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\GeneralMovaviTrackerWrapper.pdb source: SlideshowMaker.exe, 00000009.00000003.1391365609.0000000004A6E000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1391932278.0000000004AB7000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1390323142.0000000004986000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\Threading.pdb!! source: SlideshowMaker.exe, 00000009.00000003.1390323142.0000000004986000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\AudioRendererSDL.pdb source: SlideshowMaker.exe, 00000009.00000003.1391365609.0000000004A6E000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1391932278.0000000004AB7000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1390323142.0000000004986000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\MQtUi.pdbHH source: SlideshowMaker.exe, 00000009.00000003.1396666711.0000000005DD1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\Converters.pdb source: SlideshowMaker.exe, 00000009.00000003.1391365609.0000000004A6E000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1391932278.0000000004AB7000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1390323142.0000000004986000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\PackageInstallerModule.pdb source: SlideshowMaker.exe, 00000009.00000003.1374878662.0000000003D47000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1375161890.0000000003D86000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374251372.0000000003C80000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374563655.0000000003CEE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1373423805.0000000003B81000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\SocialProtocol.pdb source: SlideshowMaker.exe, 00000009.00000003.1390884817.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1392867696.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1398975329.0000000004EEC000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1395381060.0000000004CFE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1393289704.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1397208342.0000000004D85000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394983389.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\WebBrowser.pdb source: SlideshowMaker.exe, 00000009.00000003.1374878662.0000000003D47000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1375161890.0000000003D86000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374251372.0000000003C80000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374563655.0000000003CEE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1373423805.0000000003B81000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\PubSub.pdb!! source: SlideshowMaker.exe, 00000009.00000003.1390884817.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1392867696.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1395381060.0000000004CFE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1393289704.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394983389.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394274414.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\ASSWrapper.pdb!! source: SlideshowMaker.exe, 00000009.00000003.1391365609.0000000004A6E000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1390323142.0000000004986000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\VideoRendererOGLQt.pdb## source: SlideshowMaker.exe, 00000009.00000003.1391365609.0000000004A6E000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1391932278.0000000004AB7000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1390323142.0000000004986000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: vcruntime140.i386.pdb source: SlideshowMaker.exe, 00000009.00000002.2511227658.0000000000891000.00000020.10000000.00040000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\MovaviIO.pdb source: SlideshowMaker.exe, 00000009.00000003.1373423805.0000000003B81000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\CoreInt.pdb source: SlideshowMaker.exe, 00000009.00000002.2508176517.00000000006CA000.00000002.10000000.00040000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1355258737.0000000000716000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\MediaTypes.pdb&& source: SlideshowMaker.exe, 00000009.00000003.1391365609.0000000004A6E000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1390323142.0000000004986000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\GeneralMovaviTrackerWrapper.pdb## source: SlideshowMaker.exe, 00000009.00000003.1391365609.0000000004A6E000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1391932278.0000000004AB7000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1390323142.0000000004986000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\MovaviTracker.pdb source: SlideshowMaker.exe, 00000009.00000002.2505976219.0000000000500000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\PubSub.pdb source: SlideshowMaker.exe, 00000009.00000003.1390884817.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1392867696.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1395381060.0000000004CFE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1393289704.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394983389.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394274414.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\Presets.pdb!! source: SlideshowMaker.exe, 00000009.00000003.1391365609.0000000004A6E000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1391932278.0000000004AB7000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1390323142.0000000004986000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\FFWrapper.pdb,,! source: SlideshowMaker.exe, 00000009.00000003.1374878662.0000000003D47000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1375161890.0000000003D86000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1375620924.0000000003E42000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374251372.0000000003C80000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374563655.0000000003CEE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1373423805.0000000003B81000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\MagnetizeTools.pdb%% source: SlideshowMaker.exe, 00000009.00000003.1390884817.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1392867696.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1395381060.0000000004CFE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1393289704.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1397208342.0000000004D85000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394983389.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394274414.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\AppUtil.pdb source: SlideshowMaker.exe, 00000009.00000003.1374878662.0000000003D47000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1375161890.0000000003D86000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374251372.0000000003C80000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1374563655.0000000003CEE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1373423805.0000000003B81000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\UpdateChecker.pdb&& source: SlideshowMaker.exe, 00000009.00000003.1390884817.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1392867696.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1398975329.0000000004EEC000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1395381060.0000000004CFE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1393289704.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1397208342.0000000004D85000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000003.1394983389.0000000004CFB000.00000004.00000020.00020000.00000000.sdmp
PE file contains an invalid checksum
Source: SlideshowMaker.exe.0.dr Static PE information: real checksum: 0xdc081 should be: 0xde681
PE file contains sections with non-standard names
Source: Movavi Slideshow Maker 4.exe Static PE information: section name: .xcpad
Drops PE files
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\7888_698f0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\modified\@APPDATA@\Movavi Slideshow Maker 4\imageformats\qtiff.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\7888_05820000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\7888_05850000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\7888_6c460000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\modified\@APPDATA@\Movavi Slideshow Maker 4\EditorView.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\7888_00e30000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\7888_05480000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\modified\@APPDATA@\Movavi Slideshow Maker 4\FilmMaker.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\7888_05cd0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\7888_041c0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\7888_00400000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\7888_04220000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\7888_045c0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\7888_05ca0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\modified\@APPDATA@\Movavi Slideshow Maker 4\avformat.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\7888_06130000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\7888_06240000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\7888_056c0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\7888_6aec0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\7888_6a7c0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\7888_053a0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\7888_01190000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\7888_65bc0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\7888_040e0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\modified\@APPDATA@\Movavi Slideshow Maker 4\avcodec.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\modified\@APPDATA@\Movavi Slideshow Maker 4\Application.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\7888_62c80000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\modified\@APPDATA@\Movavi Slideshow Maker 4\avfilter.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\7888_66980000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\7888_015a0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\modified\@APPDATA@\Movavi Slideshow Maker 4\libeay32.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\7888_05f20000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\7888_05750000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\7888_6a400000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\7888_05500000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\modified\@APPDATA@\Movavi Slideshow Maker 4\EditorLogic.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\modified\@APPDATA@\Movavi Slideshow Maker 4\Qt5Quick.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\7888_693a0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\7888_6a810000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\7888_65200000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\7888_040c0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\7888_042d0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\7888_04570000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\7888_04770000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\7888_04350000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\7888_6b8d0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\7888_044e0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\7888_05910000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\7888_00bc0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\7888_05700000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\7888_00ff0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\7888_05d40000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\7888_05f50000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\7888_05b10000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\7888_69120000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\modified\@APPDATA@\Movavi Slideshow Maker 4\imageformats\qjpeg.dll Jump to dropped file
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe File created: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\7888_6be00000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\modified\@APPDATA@\Movavi Slideshow Maker 4\EditorUtil.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\7888_06310000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\modified\@APPDATA@\Movavi Slideshow Maker 4\ConfInt.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\7888_00db0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\7888_04160000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\7888_05790000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\7888_6aa50000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\7888_05570000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\7888_01210000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\7888_64000000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\7888_6c8f0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\7888_6a640000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\7888_00650000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\modified\@APPDATA@\Movavi Slideshow Maker 4\libass.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\7888_00c30000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\7888_05640000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\7888_062e0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\modified\@APPDATA@\Movavi Slideshow Maker 4\Qt5Core.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\7888_6eb40000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\7888_05c50000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\modified\@APPDATA@\Movavi Slideshow Maker 4\EditorModule.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\7888_05ec0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\7888_00610000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\7888_6b100000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\7888_05c10000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\modified\@APPDATA@\Movavi Slideshow Maker 4\imageformats\qgif.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\7888_055b0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\7888_008f0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\7888_06350000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe File created: C:\Users\user\Desktop\Data\local\modified\@APPDATA@\Movavi Slideshow Maker 4\SlideshowMaker.exe Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\7888_004e0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\modified\@APPDATA@\Movavi Slideshow Maker 4\DecoderRAW.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\7888_04520000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\7888_050e0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\7888_05ae0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\7888_055f0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\7888_050b0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\modified\@APPDATA@\Movavi Slideshow Maker 4\VideoAnalyzer.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\7888_058f0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\7888_054c0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\modified\@APPDATA@\Movavi Slideshow Maker 4\Qt5Gui.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\modified\@APPDATA@\Movavi Slideshow Maker 4\Qt5Widgets.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\modified\@APPDATA@\Movavi Slideshow Maker 4\platforms\qwindows.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\7888_00780000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\modified\@APPDATA@\Movavi Slideshow Maker 4\Qt5XmlPatterns.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\modified\@APPDATA@\Movavi Slideshow Maker 4\Filters.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\7888_013d0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\modified\@APPDATA@\Movavi Slideshow Maker 4\Qt5Qml.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\7888_00b40000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\7888_00710000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\modified\@APPDATA@\Movavi Slideshow Maker 4\GeneralPlugin.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\7888_01150000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\7888_01360000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\7888_6cde0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\7888_64b40000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\7888_05fb0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\7888_6d270000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\modified\@APPDATA@\Movavi Slideshow Maker 4\EditorModel.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\7888_6bb50000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\7888_01120000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\modified\@APPDATA@\Movavi Slideshow Maker 4\CudaManager.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\modified\@APPDATA@\Movavi Slideshow Maker 4\ExivMetadata.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\7888_04280000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\7888_63180000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\7888_05890000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\7888_05670000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\7888_01730000_tls.dll Jump to dropped file

Boot Survival
barindex
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Window searched: window name: FilemonClass
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Window searched: window name: RegmonClass
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Window searched: window name: FilemonClass
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 688433AE second address: 688433B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 688433B3 second address: 68842BF9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F69B06D9B02h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a or dword ptr [ebp+165E1EC4h], esi 0x00000010 push dword ptr [ebp+165E0921h] 0x00000016 stc 0x00000017 call dword ptr [ebp+165E366Dh] 0x0000001d pushad 0x0000001e cld 0x0000001f xor eax, eax 0x00000021 mov dword ptr [ebp+165E2E33h], eax 0x00000027 pushad 0x00000028 sub si, EF37h 0x0000002d popad 0x0000002e mov edx, dword ptr [esp+28h] 0x00000032 xor dword ptr [ebp+165E2E33h], esi 0x00000038 ja 00007F69B06D9B02h 0x0000003e mov dword ptr [ebp+165E2B26h], eax 0x00000044 jmp 00007F69B06D9B02h 0x00000049 mov esi, 0000003Ch 0x0000004e jmp 00007F69B06D9B09h 0x00000053 add esi, dword ptr [esp+24h] 0x00000057 jns 00007F69B06D9B0Dh 0x0000005d lodsw 0x0000005f pushad 0x00000060 sub dword ptr [ebp+165E2E33h], edi 0x00000066 or dword ptr [ebp+165E1B84h], eax 0x0000006c popad 0x0000006d add eax, dword ptr [esp+24h] 0x00000071 xor dword ptr [ebp+165E2E33h], edx 0x00000077 jmp 00007F69B06D9AFFh 0x0000007c mov ebx, dword ptr [esp+24h] 0x00000080 jl 00007F69B06D9B02h 0x00000086 pushad 0x00000087 mov ax, 44D7h 0x0000008b jo 00007F69B06D9AF6h 0x00000091 popad 0x00000092 cmc 0x00000093 nop 0x00000094 push eax 0x00000095 push edx 0x00000096 push eax 0x00000097 push edx 0x00000098 js 00007F69B06D9AF6h 0x0000009e rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68842BF9 second address: 68842BFD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68842BFD second address: 68842C03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68842C03 second address: 68842C1F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F69B15E520Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushad 0x0000000c jg 00007F69B15E5206h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 689B8195 second address: 689B81AC instructions: 0x00000000 rdtsc 0x00000002 jo 00007F69B06D9AF8h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jng 00007F69B06D9AF8h 0x00000015 push edi 0x00000016 pop edi 0x00000017 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 689B81AC second address: 689B8237 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 mov si, 0065h 0x0000000d push 00000000h 0x0000000f jno 00007F69B15E520Ch 0x00000015 push CD659EA7h 0x0000001a push eax 0x0000001b jns 00007F69B15E520Ch 0x00000021 pop eax 0x00000022 add dword ptr [esp], 329A61D9h 0x00000029 mov dx, 0B32h 0x0000002d push 00000003h 0x0000002f mov dword ptr [ebp+165E1B30h], edi 0x00000035 push 00000000h 0x00000037 mov dword ptr [ebp+165E3991h], esi 0x0000003d push 00000003h 0x0000003f push 00000000h 0x00000041 push esi 0x00000042 call 00007F69B15E5208h 0x00000047 pop esi 0x00000048 mov dword ptr [esp+04h], esi 0x0000004c add dword ptr [esp+04h], 0000001Dh 0x00000054 inc esi 0x00000055 push esi 0x00000056 ret 0x00000057 pop esi 0x00000058 ret 0x00000059 jc 00007F69B15E5208h 0x0000005f mov esi, ebx 0x00000061 push 7B69AF08h 0x00000066 jo 00007F69B15E5224h 0x0000006c push eax 0x0000006d push edx 0x0000006e jo 00007F69B15E5206h 0x00000074 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 689B8325 second address: 689B8397 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 mov eax, dword ptr [eax] 0x00000008 push edx 0x00000009 jg 00007F69B06D9AF8h 0x0000000f pushad 0x00000010 popad 0x00000011 pop edx 0x00000012 mov dword ptr [esp+04h], eax 0x00000016 jmp 00007F69B06D9B07h 0x0000001b pop eax 0x0000001c cld 0x0000001d cmc 0x0000001e push 00000003h 0x00000020 or edi, dword ptr [ebp+165E2B1Eh] 0x00000026 push 00000000h 0x00000028 jmp 00007F69B06D9AFEh 0x0000002d push 00000003h 0x0000002f mov dword ptr [ebp+165E195Dh], edx 0x00000035 push D443FDDFh 0x0000003a push eax 0x0000003b push edx 0x0000003c pushad 0x0000003d ja 00007F69B06D9AF6h 0x00000043 jmp 00007F69B06D9B03h 0x00000048 popad 0x00000049 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 689B8549 second address: 689B8553 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F69B15E5206h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 689B8553 second address: 689B856D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F69B06D9B06h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 689A943E second address: 689A9444 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 689A9444 second address: 689A9448 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 689D7B43 second address: 689D7B47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 689D8089 second address: 689D808D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 689D8306 second address: 689D830A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 689D830A second address: 689D8310 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 689D8442 second address: 689D8446 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 689D8446 second address: 689D8469 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F69B06D9AF6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c je 00007F69B06D9B03h 0x00000012 jmp 00007F69B06D9AFDh 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 689D8469 second address: 689D846D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 689D88B0 second address: 689D88C5 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 jo 00007F69B06D9AF6h 0x0000000d pushad 0x0000000e popad 0x0000000f pop edx 0x00000010 push esi 0x00000011 push eax 0x00000012 push edx 0x00000013 push edi 0x00000014 pop edi 0x00000015 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 689CCD71 second address: 689CCD75 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 689D8D09 second address: 689D8D0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 689D8D0D second address: 689D8D11 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 689D8D11 second address: 689D8D29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007F69B06D9AFDh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 689D8D29 second address: 689D8D2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 689D9961 second address: 689D9966 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 689D9966 second address: 689D9986 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 jmp 00007F69B15E5218h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 689D9986 second address: 689D99AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F69B06D9B03h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jg 00007F69B06D9B2Eh 0x00000012 push eax 0x00000013 push edx 0x00000014 push edx 0x00000015 pop edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 689A5F4D second address: 689A5F52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 689A5F52 second address: 689A5F6F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F69B06D9AFFh 0x00000008 jg 00007F69B06D9AF6h 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 689E187A second address: 689E1893 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F69B15E520Eh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 689E1893 second address: 689E18A2 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F69B06D9AF6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 689E18A2 second address: 689E18AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jl 00007F69B15E5206h 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 689E19E6 second address: 689E1A0B instructions: 0x00000000 rdtsc 0x00000002 js 00007F69B06D9AFAh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jc 00007F69B06D9B27h 0x00000010 pushad 0x00000011 jmp 00007F69B06D9AFEh 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 689E1B72 second address: 689E1B98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007F69B15E5211h 0x0000000d jne 00007F69B15E5206h 0x00000013 js 00007F69B15E5206h 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 689E2154 second address: 689E215A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 689E215A second address: 689E2160 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 689E2160 second address: 689E2166 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 689E2166 second address: 689E2193 instructions: 0x00000000 rdtsc 0x00000002 js 00007F69B15E5206h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d jmp 00007F69B15E5211h 0x00000012 popad 0x00000013 pop edx 0x00000014 pop eax 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 pushad 0x00000019 popad 0x0000001a pushad 0x0000001b popad 0x0000001c popad 0x0000001d push edi 0x0000001e pushad 0x0000001f popad 0x00000020 pop edi 0x00000021 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 689E2193 second address: 689E21B1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F69B06D9B06h 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b push esi 0x0000000c pop esi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 689E2881 second address: 689E28AE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007F69B15E521Dh 0x0000000c jmp 00007F69B15E5215h 0x00000011 push esi 0x00000012 pop esi 0x00000013 push eax 0x00000014 push edx 0x00000015 jc 00007F69B15E5220h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 689E28AE second address: 689E28D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F69B06D9B04h 0x00000009 jp 00007F69B06D9B02h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 689E2A85 second address: 689E2A92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 jnc 00007F69B15E5206h 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 689E2A92 second address: 689E2AB0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F69B06D9B09h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 689E30B7 second address: 689E30D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 jc 00007F69B15E5206h 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 popad 0x00000012 jmp 00007F69B15E520Fh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 689E367D second address: 689E368D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F69B06D9AFBh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 689E368D second address: 689E3692 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 689E3D21 second address: 689E3D27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 689E3D27 second address: 689E3D2B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 689E3D2B second address: 689E3D34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 689E3D34 second address: 689E3D76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jmp 00007F69B15E5218h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e jmp 00007F69B15E5218h 0x00000013 jng 00007F69B15E5206h 0x00000019 pushad 0x0000001a popad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 689E3F1B second address: 689E3F1F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 689E4389 second address: 689E438F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 689E9643 second address: 689E9655 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jnl 00007F69B06D9AF6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 689E9655 second address: 689E966D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F69B15E5214h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 689E966D second address: 689E96B0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F69B06D9AFDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d pushad 0x0000000e pushad 0x0000000f push esi 0x00000010 pop esi 0x00000011 jnc 00007F69B06D9AF6h 0x00000017 popad 0x00000018 jmp 00007F69B06D9B04h 0x0000001d popad 0x0000001e mov eax, dword ptr [eax] 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 jns 00007F69B06D9AF6h 0x00000029 push edx 0x0000002a pop edx 0x0000002b popad 0x0000002c rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 689E84EF second address: 689E84F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 689E84F4 second address: 689E84F9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 689E84F9 second address: 689E84FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 689AAEEB second address: 689AAEEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 689AAEEF second address: 689AAEFC instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push edi 0x0000000a pop edi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 689AAEFC second address: 689AAF04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 689ED8D2 second address: 689ED8D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 689EDA56 second address: 689EDA72 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F69B06D9B02h 0x00000009 jnl 00007F69B06D9AF6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 689EDBEA second address: 689EDBF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 689EE05A second address: 689EE06F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F69B06D9AFEh 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 689EE06F second address: 689EE086 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F69B15E5206h 0x0000000a jmp 00007F69B15E520Dh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 689EE086 second address: 689EE08A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 689EE08A second address: 689EE09F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d jns 00007F69B15E5206h 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 689EE09F second address: 689EE0C8 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F69B06D9AFAh 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 pushad 0x00000014 jg 00007F69B06D9AF6h 0x0000001a jno 00007F69B06D9AF6h 0x00000020 pushad 0x00000021 popad 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 689EE220 second address: 689EE224 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 689EE224 second address: 689EE23C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F69B06D9B04h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 689EE23C second address: 689EE256 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F69B15E5216h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 689F1602 second address: 689F161F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jbe 00007F69B06D9AFCh 0x0000000b jo 00007F69B06D9AF6h 0x00000011 popad 0x00000012 push eax 0x00000013 jnp 00007F69B06D9B00h 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 689F161F second address: 689F169D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a jng 00007F69B15E5214h 0x00000010 pushad 0x00000011 jbe 00007F69B15E5206h 0x00000017 je 00007F69B15E5206h 0x0000001d popad 0x0000001e mov eax, dword ptr [eax] 0x00000020 jmp 00007F69B15E520Fh 0x00000025 mov dword ptr [esp+04h], eax 0x00000029 jmp 00007F69B15E5210h 0x0000002e pop eax 0x0000002f push 00000000h 0x00000031 push edx 0x00000032 call 00007F69B15E5208h 0x00000037 pop edx 0x00000038 mov dword ptr [esp+04h], edx 0x0000003c add dword ptr [esp+04h], 0000001Dh 0x00000044 inc edx 0x00000045 push edx 0x00000046 ret 0x00000047 pop edx 0x00000048 ret 0x00000049 push 4E2C84C8h 0x0000004e push eax 0x0000004f push edx 0x00000050 jmp 00007F69B15E520Eh 0x00000055 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 689F17AA second address: 689F17AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 689F17AE second address: 689F17B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 689F17B4 second address: 689F17BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007F69B06D9AF6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 689F17BE second address: 689F17E2 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F69B15E5219h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 689F2443 second address: 689F2460 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F69B06D9B09h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 689F25E0 second address: 689F25EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007F69B15E5206h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 689F2744 second address: 689F2749 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 689F3620 second address: 689F3624 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 689F3624 second address: 689F369D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push ebp 0x0000000d call 00007F69B06D9AF8h 0x00000012 pop ebp 0x00000013 mov dword ptr [esp+04h], ebp 0x00000017 add dword ptr [esp+04h], 00000014h 0x0000001f inc ebp 0x00000020 push ebp 0x00000021 ret 0x00000022 pop ebp 0x00000023 ret 0x00000024 xor si, 0ED5h 0x00000029 push 00000000h 0x0000002b push 00000000h 0x0000002d push ebp 0x0000002e call 00007F69B06D9AF8h 0x00000033 pop ebp 0x00000034 mov dword ptr [esp+04h], ebp 0x00000038 add dword ptr [esp+04h], 0000001Dh 0x00000040 inc ebp 0x00000041 push ebp 0x00000042 ret 0x00000043 pop ebp 0x00000044 ret 0x00000045 add dword ptr [ebp+165E1F7Fh], ecx 0x0000004b push 00000000h 0x0000004d mov edi, 299F096Dh 0x00000052 mov edi, dword ptr [ebp+165E1BFCh] 0x00000058 xchg eax, ebx 0x00000059 jno 00007F69B06D9AFCh 0x0000005f push eax 0x00000060 push eax 0x00000061 push edx 0x00000062 push eax 0x00000063 push edx 0x00000064 pushad 0x00000065 popad 0x00000066 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 689F369D second address: 689F36B8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F69B15E5217h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 689F4638 second address: 689F4641 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 689F51D9 second address: 689F51F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F69B15E5213h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 689F5296 second address: 689F529B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 689F8CA0 second address: 689F8CAA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 689F8CAA second address: 689F8CAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 689F9677 second address: 689F968B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F69B15E5210h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 689FB8D9 second address: 689FB8DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 689FB8DD second address: 689FB8E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 689FBE2E second address: 689FBE3E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F69B06D9AFCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 689FBE3E second address: 689FBE77 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F69B15E521Ah 0x00000008 jmp 00007F69B15E5214h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jnc 00007F69B15E5218h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 689FCFD8 second address: 689FCFEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edi 0x00000008 push eax 0x00000009 jng 00007F69B06D9AFEh 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 689FDEF9 second address: 689FDEFD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 689FDEFD second address: 689FDF44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a mov dword ptr [ebp+165E1952h], ecx 0x00000010 push 00000000h 0x00000012 push 00000000h 0x00000014 push esi 0x00000015 call 00007F69B06D9AF8h 0x0000001a pop esi 0x0000001b mov dword ptr [esp+04h], esi 0x0000001f add dword ptr [esp+04h], 0000001Dh 0x00000027 inc esi 0x00000028 push esi 0x00000029 ret 0x0000002a pop esi 0x0000002b ret 0x0000002c push 00000000h 0x0000002e sbb bh, FFFFFFA7h 0x00000031 and bx, 304Dh 0x00000036 push eax 0x00000037 pushad 0x00000038 push eax 0x00000039 push edx 0x0000003a push eax 0x0000003b push edx 0x0000003c rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 689FDF44 second address: 689FDF48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A00E19 second address: 68A00E1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A00E1D second address: 68A00E22 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A01ECA second address: 68A01ECE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A01ECE second address: 68A01F2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 pushad 0x00000008 popad 0x00000009 pop ebx 0x0000000a popad 0x0000000b nop 0x0000000c jno 00007F69B15E520Ch 0x00000012 push 00000000h 0x00000014 push 00000000h 0x00000016 push eax 0x00000017 call 00007F69B15E5208h 0x0000001c pop eax 0x0000001d mov dword ptr [esp+04h], eax 0x00000021 add dword ptr [esp+04h], 00000017h 0x00000029 inc eax 0x0000002a push eax 0x0000002b ret 0x0000002c pop eax 0x0000002d ret 0x0000002e push 00000000h 0x00000030 add dword ptr [ebp+165E200Eh], esi 0x00000036 mov edi, dword ptr [ebp+165E192Eh] 0x0000003c xchg eax, esi 0x0000003d jmp 00007F69B15E5212h 0x00000042 push eax 0x00000043 push eax 0x00000044 push edx 0x00000045 push ebx 0x00000046 push eax 0x00000047 push edx 0x00000048 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A01F2E second address: 68A01F33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A03D09 second address: 68A03D58 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F69B15E520Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push ecx 0x0000000f call 00007F69B15E5208h 0x00000014 pop ecx 0x00000015 mov dword ptr [esp+04h], ecx 0x00000019 add dword ptr [esp+04h], 00000014h 0x00000021 inc ecx 0x00000022 push ecx 0x00000023 ret 0x00000024 pop ecx 0x00000025 ret 0x00000026 sub ebx, 05168331h 0x0000002c push 00000000h 0x0000002e mov edi, dword ptr [ebp+165E2BB2h] 0x00000034 and edi, dword ptr [ebp+165E2FE5h] 0x0000003a push 00000000h 0x0000003c adc bx, DF4Fh 0x00000041 push eax 0x00000042 push eax 0x00000043 push edx 0x00000044 push eax 0x00000045 push edx 0x00000046 push ebx 0x00000047 pop ebx 0x00000048 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A03D58 second address: 68A03D66 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F69B06D9AFAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A05CEA second address: 68A05CF4 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F69B15E5206h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A05CF4 second address: 68A05CFB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A05CFB second address: 68A05D09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A08AD9 second address: 68A08B45 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F69B06D9AF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F69B06D9AFFh 0x0000000f popad 0x00000010 nop 0x00000011 jp 00007F69B06D9AF7h 0x00000017 push 00000000h 0x00000019 push 00000000h 0x0000001b push ebx 0x0000001c call 00007F69B06D9AF8h 0x00000021 pop ebx 0x00000022 mov dword ptr [esp+04h], ebx 0x00000026 add dword ptr [esp+04h], 0000001Dh 0x0000002e inc ebx 0x0000002f push ebx 0x00000030 ret 0x00000031 pop ebx 0x00000032 ret 0x00000033 mov di, 8CFBh 0x00000037 mov dword ptr [ebp+165E19ABh], ebx 0x0000003d push 00000000h 0x0000003f jmp 00007F69B06D9AFAh 0x00000044 mov edi, dword ptr [ebp+165E2B0Eh] 0x0000004a xchg eax, esi 0x0000004b push eax 0x0000004c push edx 0x0000004d push esi 0x0000004e pushad 0x0000004f popad 0x00000050 pop esi 0x00000051 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A08B45 second address: 68A08B4A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A08B4A second address: 68A08B6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 jmp 00007F69B06D9B07h 0x0000000e push eax 0x0000000f push edx 0x00000010 push edx 0x00000011 pop edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A0A9E3 second address: 68A0A9E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A0A9E7 second address: 68A0A9FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F69B06D9B00h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A0A9FB second address: 68A0A9FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A0A9FF second address: 68A0AA94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push eax 0x0000000c call 00007F69B06D9AF8h 0x00000011 pop eax 0x00000012 mov dword ptr [esp+04h], eax 0x00000016 add dword ptr [esp+04h], 0000001Dh 0x0000001e inc eax 0x0000001f push eax 0x00000020 ret 0x00000021 pop eax 0x00000022 ret 0x00000023 adc edi, 2D948A29h 0x00000029 xor bh, 00000012h 0x0000002c push esi 0x0000002d and di, 0006h 0x00000032 pop ebx 0x00000033 push 00000000h 0x00000035 push 00000000h 0x00000037 push ecx 0x00000038 call 00007F69B06D9AF8h 0x0000003d pop ecx 0x0000003e mov dword ptr [esp+04h], ecx 0x00000042 add dword ptr [esp+04h], 0000001Ch 0x0000004a inc ecx 0x0000004b push ecx 0x0000004c ret 0x0000004d pop ecx 0x0000004e ret 0x0000004f mov edi, dword ptr [ebp+165E2C06h] 0x00000055 push 00000000h 0x00000057 push eax 0x00000058 jo 00007F69B06D9AFCh 0x0000005e mov dword ptr [ebp+165E1D20h], esi 0x00000064 pop ebx 0x00000065 xchg eax, esi 0x00000066 push eax 0x00000067 push edx 0x00000068 jmp 00007F69B06D9B08h 0x0000006d rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A12CEE second address: 68A12CF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A1432A second address: 68A1432F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A189BE second address: 68A189C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A189C3 second address: 68A189CE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007F69B06D9AF6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A18A9A second address: 68A18A9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A18A9F second address: 68A18AA4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6899F1F7 second address: 6899F20A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F69B15E520Dh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A1E3EA second address: 68A1E3F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A1E557 second address: 68A1E574 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F69B15E5212h 0x00000009 push edi 0x0000000a pop edi 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A1E574 second address: 68A1E578 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A1E578 second address: 68A1E57C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A1E997 second address: 68A1E99B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A1E99B second address: 68A1E9A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A1E9A5 second address: 68A1E9A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A1E9A9 second address: 68A1E9B3 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F69B15E5206h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A1E9B3 second address: 68A1E9BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A1E9BF second address: 68A1E9C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A1ECD3 second address: 68A1ECD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A228BC second address: 68A228C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A228C0 second address: 68A228D5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F69B06D9AFFh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A228D5 second address: 68A228DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A228DB second address: 68A228E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A228E1 second address: 68A228E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 689F000A second address: 689F000F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 689F0101 second address: 689F0126 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F69B15E520Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F69B15E5212h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 689F0434 second address: 689F043E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007F69B06D9AF6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 689F043E second address: 68842BF9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b mov dx, 2DB2h 0x0000000f push dword ptr [ebp+165E0921h] 0x00000015 mov dx, bx 0x00000018 call dword ptr [ebp+165E366Dh] 0x0000001e pushad 0x0000001f cld 0x00000020 xor eax, eax 0x00000022 mov dword ptr [ebp+165E2E33h], eax 0x00000028 pushad 0x00000029 sub si, EF37h 0x0000002e popad 0x0000002f mov edx, dword ptr [esp+28h] 0x00000033 xor dword ptr [ebp+165E2E33h], esi 0x00000039 ja 00007F69B15E5212h 0x0000003f mov dword ptr [ebp+165E2B26h], eax 0x00000045 jmp 00007F69B15E5212h 0x0000004a mov esi, 0000003Ch 0x0000004f jmp 00007F69B15E5219h 0x00000054 add esi, dword ptr [esp+24h] 0x00000058 jns 00007F69B15E521Dh 0x0000005e lodsw 0x00000060 pushad 0x00000061 sub dword ptr [ebp+165E2E33h], edi 0x00000067 or dword ptr [ebp+165E1B84h], eax 0x0000006d popad 0x0000006e add eax, dword ptr [esp+24h] 0x00000072 xor dword ptr [ebp+165E2E33h], edx 0x00000078 jmp 00007F69B15E520Fh 0x0000007d mov ebx, dword ptr [esp+24h] 0x00000081 jl 00007F69B15E5212h 0x00000087 cmc 0x00000088 nop 0x00000089 push eax 0x0000008a push edx 0x0000008b push eax 0x0000008c push edx 0x0000008d js 00007F69B15E5206h 0x00000093 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 689F04DE second address: 689F04E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 689F04E2 second address: 689F0518 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 je 00007F69B15E5208h 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e popad 0x0000000f mov eax, dword ptr [eax] 0x00000011 jmp 00007F69B15E5217h 0x00000016 mov dword ptr [esp+04h], eax 0x0000001a push eax 0x0000001b push edx 0x0000001c jc 00007F69B15E5208h 0x00000022 pushad 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 689F0518 second address: 689F051E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 689F051E second address: 689F05B1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop eax 0x00000009 push 00000000h 0x0000000b push ecx 0x0000000c call 00007F69B15E5208h 0x00000011 pop ecx 0x00000012 mov dword ptr [esp+04h], ecx 0x00000016 add dword ptr [esp+04h], 00000016h 0x0000001e inc ecx 0x0000001f push ecx 0x00000020 ret 0x00000021 pop ecx 0x00000022 ret 0x00000023 call 00007F69B15E5209h 0x00000028 je 00007F69B15E5210h 0x0000002e pushad 0x0000002f js 00007F69B15E5206h 0x00000035 push edi 0x00000036 pop edi 0x00000037 popad 0x00000038 push eax 0x00000039 jmp 00007F69B15E5211h 0x0000003e mov eax, dword ptr [esp+04h] 0x00000042 jl 00007F69B15E5227h 0x00000048 pushad 0x00000049 jmp 00007F69B15E5212h 0x0000004e jmp 00007F69B15E520Dh 0x00000053 popad 0x00000054 mov eax, dword ptr [eax] 0x00000056 push ebx 0x00000057 jo 00007F69B15E5208h 0x0000005d pushad 0x0000005e popad 0x0000005f pop ebx 0x00000060 mov dword ptr [esp+04h], eax 0x00000064 push eax 0x00000065 push edx 0x00000066 push esi 0x00000067 push edi 0x00000068 pop edi 0x00000069 pop esi 0x0000006a rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 689F05B1 second address: 689F05B6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 689F06CC second address: 689F06D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 689F06D0 second address: 689F06F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F69B06D9B03h 0x0000000b popad 0x0000000c push eax 0x0000000d js 00007F69B06D9B10h 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 689F07E0 second address: 689F07FB instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edi 0x0000000a popad 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f pushad 0x00000010 push ecx 0x00000011 jp 00007F69B15E5206h 0x00000017 pop ecx 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 689F0954 second address: 689F095E instructions: 0x00000000 rdtsc 0x00000002 jc 00007F69B06D9AFCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 689F095E second address: 689F0974 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 jmp 00007F69B15E520Ah 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 689F0974 second address: 689F0978 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 689F0A9F second address: 689F0AA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 689F0AA6 second address: 689F0B1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push edx 0x0000000c call 00007F69B06D9AF8h 0x00000011 pop edx 0x00000012 mov dword ptr [esp+04h], edx 0x00000016 add dword ptr [esp+04h], 00000014h 0x0000001e inc edx 0x0000001f push edx 0x00000020 ret 0x00000021 pop edx 0x00000022 ret 0x00000023 add dword ptr [ebp+165E19ABh], edi 0x00000029 push 00000004h 0x0000002b push 00000000h 0x0000002d push edi 0x0000002e call 00007F69B06D9AF8h 0x00000033 pop edi 0x00000034 mov dword ptr [esp+04h], edi 0x00000038 add dword ptr [esp+04h], 00000015h 0x00000040 inc edi 0x00000041 push edi 0x00000042 ret 0x00000043 pop edi 0x00000044 ret 0x00000045 jmp 00007F69B06D9B05h 0x0000004a nop 0x0000004b jmp 00007F69B06D9AFCh 0x00000050 push eax 0x00000051 push eax 0x00000052 push edx 0x00000053 push ecx 0x00000054 jnp 00007F69B06D9AF6h 0x0000005a pop ecx 0x0000005b rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 689F1268 second address: 689F126E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 689F126E second address: 689F1272 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 689F1272 second address: 689F128F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F69B15E5212h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 689CD963 second address: 689CD97B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F69B06D9AFCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jp 00007F69B06D9AFCh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A22E29 second address: 68A22E2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A22E2D second address: 68A22E37 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F69B06D9AF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A22E37 second address: 68A22E72 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 js 00007F69B15E5206h 0x00000009 pushad 0x0000000a popad 0x0000000b jl 00007F69B15E5206h 0x00000011 popad 0x00000012 jne 00007F69B15E5222h 0x00000018 pop edx 0x00000019 pop eax 0x0000001a pushad 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A23010 second address: 68A2301B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007F69B06D9AF6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A2301B second address: 68A23037 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jmp 00007F69B15E520Dh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A23037 second address: 68A2303B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A2303B second address: 68A2305B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F69B15E5217h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A2305B second address: 68A23060 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A23060 second address: 68A23081 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F69B15E520Ah 0x00000009 jmp 00007F69B15E5213h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A23081 second address: 68A23085 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A234BC second address: 68A234C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A234C0 second address: 68A234C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A234C6 second address: 68A234E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F69B15E520Ah 0x0000000e jng 00007F69B15E520Eh 0x00000014 pushad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A234E3 second address: 68A234E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A2900A second address: 68A29016 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 pop eax 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A29016 second address: 68A29039 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F69B06D9B00h 0x00000009 jmp 00007F69B06D9AFFh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A29039 second address: 68A2905B instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F69B15E5206h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F69B15E5211h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A29325 second address: 68A29341 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F69B06D9B02h 0x00000008 ja 00007F69B06D9AF6h 0x0000000e jbe 00007F69B06D9AF6h 0x00000014 jc 00007F69B06D9B08h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A28D53 second address: 68A28D5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F69B15E5206h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A28D5F second address: 68A28D71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 jnc 00007F69B06D9AF6h 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A29A6F second address: 68A29A83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push edx 0x00000006 jmp 00007F69B15E520Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A29A83 second address: 68A29A8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push edx 0x00000006 push edi 0x00000007 pop edi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A2A039 second address: 68A2A055 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F69B15E5212h 0x00000007 js 00007F69B15E520Eh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A2FF0C second address: 68A2FF10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A2FF10 second address: 68A2FF2E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 js 00007F69B15E5206h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ecx 0x0000000d jmp 00007F69B15E5210h 0x00000012 pop ecx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A2FF2E second address: 68A2FF34 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A2FF34 second address: 68A2FF38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A2FF38 second address: 68A2FF42 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F69B06D9AF6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A2FF42 second address: 68A2FF4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A2FF4B second address: 68A2FF79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jo 00007F69B06D9AF6h 0x0000000c jmp 00007F69B06D9AFBh 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 push eax 0x00000015 push edx 0x00000016 push ecx 0x00000017 pushad 0x00000018 popad 0x00000019 pop ecx 0x0000001a jno 00007F69B06D9AFEh 0x00000020 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A2EAD3 second address: 68A2EAD8 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A2EE64 second address: 68A2EE68 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A2F278 second address: 68A2F2A2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F69B15E520Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ecx 0x0000000a pushad 0x0000000b popad 0x0000000c pop ecx 0x0000000d jmp 00007F69B15E520Bh 0x00000012 push eax 0x00000013 push edx 0x00000014 je 00007F69B15E5206h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A2F549 second address: 68A2F573 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F69B06D9B09h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007F69B06D9AF8h 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 pushad 0x00000013 push eax 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A2F573 second address: 68A2F579 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A2F579 second address: 68A2F581 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A2FD7F second address: 68A2FD85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A2FD85 second address: 68A2FD89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A2FD89 second address: 68A2FD8D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A2FD8D second address: 68A2FDB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007F69B06D9B05h 0x00000010 jbe 00007F69B06D9AF6h 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A2FDB8 second address: 68A2FDC2 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F69B15E5206h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A39CDC second address: 68A39CE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A39CE2 second address: 68A39CE6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A39CE6 second address: 68A39CEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A39CEC second address: 68A39D04 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F69B15E520Eh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edi 0x0000000e pop edi 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A39D04 second address: 68A39D0D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A39D0D second address: 68A39D13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A39701 second address: 68A39706 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A46984 second address: 68A46988 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A46988 second address: 68A469A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007F69B06D9B06h 0x0000000c jmp 00007F69B06D9B00h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A4529A second address: 68A452A0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A4558D second address: 68A45597 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F69B06D9AF6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A45597 second address: 68A455A3 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a push edi 0x0000000b pop edi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A455A3 second address: 68A455B1 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F69B06D9AF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A455B1 second address: 68A455BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F69B15E5206h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A455BB second address: 68A455DD instructions: 0x00000000 rdtsc 0x00000002 jo 00007F69B06D9AF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007F69B06D9B01h 0x00000010 pushad 0x00000011 popad 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A45734 second address: 68A4574D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F69B15E520Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jg 00007F69B15E5208h 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A4574D second address: 68A45752 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A459E1 second address: 68A459E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A459E5 second address: 68A459F2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push ecx 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 689F0D1C second address: 689F0D70 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F69B15E5214h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a add edx, 735726AFh 0x00000010 mov ebx, dword ptr [ebp+16790D0Fh] 0x00000016 and edx, 217AE1CAh 0x0000001c add eax, ebx 0x0000001e push 00000000h 0x00000020 push ebp 0x00000021 call 00007F69B15E5208h 0x00000026 pop ebp 0x00000027 mov dword ptr [esp+04h], ebp 0x0000002b add dword ptr [esp+04h], 00000014h 0x00000033 inc ebp 0x00000034 push ebp 0x00000035 ret 0x00000036 pop ebp 0x00000037 ret 0x00000038 sub dword ptr [ebp+165E19DBh], edi 0x0000003e push eax 0x0000003f pushad 0x00000040 push eax 0x00000041 push eax 0x00000042 push edx 0x00000043 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A466FC second address: 68A46710 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F69B06D9AFEh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A48129 second address: 68A4812D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A4CC3F second address: 68A4CC5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop ebx 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F69B06D9AFFh 0x0000000e jg 00007F69B06D9AF6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A4CC5D second address: 68A4CC7B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F69B15E5212h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jo 00007F69B15E520Ch 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A4CC7B second address: 68A4CC9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jmp 00007F69B06D9B09h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A4CF1A second address: 68A4CF25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A4CF25 second address: 68A4CF3C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F69B06D9B01h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A4CF3C second address: 68A4CF5A instructions: 0x00000000 rdtsc 0x00000002 jo 00007F69B15E5219h 0x00000008 jmp 00007F69B15E5211h 0x0000000d push esi 0x0000000e pop esi 0x0000000f push esi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A52D18 second address: 68A52D1E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A52D1E second address: 68A52D31 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jng 00007F69B15E5210h 0x0000000e push esi 0x0000000f push esi 0x00000010 pop esi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A52E6C second address: 68A52E72 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A52E72 second address: 68A52E78 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A52E78 second address: 68A52E7C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A52FC2 second address: 68A52FCD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A52FCD second address: 68A53000 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a jng 00007F69B06D9AF6h 0x00000010 jmp 00007F69B06D9B01h 0x00000015 jmp 00007F69B06D9AFBh 0x0000001a jns 00007F69B06D9AF6h 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A5389D second address: 68A538A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A538A3 second address: 68A538A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A54156 second address: 68A5415E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A5415E second address: 68A54162 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A54162 second address: 68A5416C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A5416C second address: 68A54170 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A549DA second address: 68A549DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A549DE second address: 68A549F3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F69B06D9B01h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A5B9B7 second address: 68A5B9BC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A5FDEE second address: 68A5FDF2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A5EF38 second address: 68A5EF3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A5F1FC second address: 68A5F202 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A5F202 second address: 68A5F20B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A5F20B second address: 68A5F210 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A5F210 second address: 68A5F235 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007F69B15E520Ah 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F69B15E5213h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A5F235 second address: 68A5F23C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A5F37B second address: 68A5F392 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F69B15E5213h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A5F534 second address: 68A5F53D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A67E08 second address: 68A67E19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F69B15E5206h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A67E19 second address: 68A67E48 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F69B06D9AF6h 0x00000008 je 00007F69B06D9AF6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 push ecx 0x00000016 pop ecx 0x00000017 jmp 00007F69B06D9B08h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A67E48 second address: 68A67E4C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A67E4C second address: 68A67E55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A67E55 second address: 68A67E5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A67E5A second address: 68A67E60 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A67E60 second address: 68A67E66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A66516 second address: 68A6651A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A6651A second address: 68A66530 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F69B15E5206h 0x00000008 jg 00007F69B15E5206h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A66694 second address: 68A6669E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F69B06D9AF6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A6669E second address: 68A666A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A666A4 second address: 68A666DC instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007F69B06D9B08h 0x00000008 jmp 00007F69B06D9B02h 0x0000000d pop esi 0x0000000e push eax 0x0000000f push edx 0x00000010 ja 00007F69B06D9AF6h 0x00000016 push eax 0x00000017 pop eax 0x00000018 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A66A03 second address: 68A66A07 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A66A07 second address: 68A66A0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A66A0D second address: 68A66A12 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A65AF5 second address: 68A65B1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jmp 00007F69B06D9B08h 0x0000000a pushad 0x0000000b jc 00007F69B06D9AF6h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A65B1B second address: 68A65B27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F69B15E5206h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A65B27 second address: 68A65B38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 jp 00007F69B06D9AF6h 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A65B38 second address: 68A65B5A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F69B15E5214h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jnl 00007F69B15E5206h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A65B5A second address: 68A65B7E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F69B06D9B04h 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f jne 00007F69B06D9AF6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A65B7E second address: 68A65B82 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A65B82 second address: 68A65B88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A7A370 second address: 68A7A37C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A7A37C second address: 68A7A38C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a push edi 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f pop edi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A7A38C second address: 68A7A392 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A7A392 second address: 68A7A396 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A7934F second address: 68A7935C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 jo 00007F69B15E5206h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A7967E second address: 68A79682 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A79682 second address: 68A79686 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A7996B second address: 68A79971 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A79C2A second address: 68A79C58 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F69B15E520Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007F69B15E5217h 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A79C58 second address: 68A79C5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A7B9FB second address: 68A7BA01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A7FAFE second address: 68A7FB03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A7FB03 second address: 68A7FB0D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F69B15E5206h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A7FB0D second address: 68A7FB11 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A7F59D second address: 68A7F5AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F69B15E520Ah 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A84793 second address: 68A847C2 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F69B06D9AF6h 0x00000008 js 00007F69B06D9AF6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 jl 00007F69B06D9AF6h 0x00000017 jmp 00007F69B06D9B05h 0x0000001c push ecx 0x0000001d pop ecx 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A83448 second address: 68A83451 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A83451 second address: 68A8349A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F69B06D9B00h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F69B06D9B04h 0x00000010 pushad 0x00000011 jbe 00007F69B06D9AF6h 0x00000017 jmp 00007F69B06D9B06h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A83613 second address: 68A83617 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A8376A second address: 68A83770 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A83770 second address: 68A83775 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A83775 second address: 68A8378C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007F69B06D9AFCh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A8378C second address: 68A837AB instructions: 0x00000000 rdtsc 0x00000002 jo 00007F69B15E5206h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 jne 00007F69B15E5206h 0x00000017 jo 00007F69B15E5206h 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A837AB second address: 68A837B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A837B0 second address: 68A837BA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F69B15E5206h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A837BA second address: 68A837D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jmp 00007F69B06D9AFBh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edi 0x0000000c jnc 00007F69B06D9AF6h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68AB8017 second address: 68AB8021 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F69B15E5206h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68AB8021 second address: 68AB802B instructions: 0x00000000 rdtsc 0x00000002 jl 00007F69B06D9B02h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68AB802B second address: 68AB8039 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F69B15E5206h 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68AB8039 second address: 68AB803F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68AB803F second address: 68AB8043 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68AB92B2 second address: 68AB92D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F69B06D9AF6h 0x0000000a pop edi 0x0000000b jmp 00007F69B06D9B08h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68AB92D5 second address: 68AB92DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68AB92DA second address: 68AB9314 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F69B06D9AF6h 0x0000000a pop eax 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f pop eax 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 pop edx 0x00000014 pop eax 0x00000015 push edi 0x00000016 pushad 0x00000017 jg 00007F69B06D9AF6h 0x0000001d jmp 00007F69B06D9B06h 0x00000022 popad 0x00000023 push eax 0x00000024 push edx 0x00000025 pushad 0x00000026 popad 0x00000027 pushad 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68AB9314 second address: 68AB9318 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A89121 second address: 68A89125 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A89125 second address: 68A8912F instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F69B15E5206h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A8912F second address: 68A89135 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68AB9BA5 second address: 68AB9BA9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68ABEA50 second address: 68ABEA99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jmp 00007F69B06D9AFAh 0x0000000b popad 0x0000000c push ebx 0x0000000d jmp 00007F69B06D9B09h 0x00000012 jns 00007F69B06D9AF6h 0x00000018 pop ebx 0x00000019 pop edi 0x0000001a push ecx 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007F69B06D9B03h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68ADAAD6 second address: 68ADAAF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jo 00007F69B15E520Ch 0x0000000b js 00007F69B15E5206h 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F69B15E520Bh 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68ADAAF6 second address: 68ADAAFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68AE53AA second address: 68AE53CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F69B15E5211h 0x00000009 popad 0x0000000a jg 00007F69B15E520Eh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68AEAE7D second address: 68AEAE93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 push ecx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop ecx 0x0000000b popad 0x0000000c pushad 0x0000000d pushad 0x0000000e jp 00007F69B06D9AF6h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68AEAE93 second address: 68AEAE9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68AEAE9B second address: 68AEAEAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jc 00007F69B06D9AF6h 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68AEB006 second address: 68AEB00A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68AEB121 second address: 68AEB127 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68AEB127 second address: 68AEB12D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68AEB12D second address: 68AEB133 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68AEB133 second address: 68AEB137 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68AEBBA7 second address: 68AEBBBF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F69B06D9B01h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68AEBBBF second address: 68AEBBC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68AEC34D second address: 68AEC359 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F69B06D9AF6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68AEC359 second address: 68AEC35D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68AEC4C3 second address: 68AEC4EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F69B06D9AFEh 0x00000009 jmp 00007F69B06D9B05h 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68B03148 second address: 68B03152 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F69B15E5206h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68B03152 second address: 68B03158 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68B03241 second address: 68B03257 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F69B15E520Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68B03257 second address: 68B0325B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68B25971 second address: 68B2597D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jbe 00007F69B15E5206h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68B2597D second address: 68B2599C instructions: 0x00000000 rdtsc 0x00000002 jo 00007F69B06D9AF6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jmp 00007F69B06D9AFAh 0x00000012 jo 00007F69B06D9AFCh 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68B25211 second address: 68B25216 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68842F8B second address: 68842F99 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F69B06D9AF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68842F99 second address: 68842F9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68B3E6F9 second address: 68B3E728 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F69B06D9B09h 0x00000009 jmp 00007F69B06D9B01h 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68B3E728 second address: 68B3E76C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F69B15E5212h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jnl 00007F69B15E5212h 0x00000010 push eax 0x00000011 push edx 0x00000012 jns 00007F69B15E5206h 0x00000018 jmp 00007F69B15E5213h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68B3E88C second address: 68B3E892 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68B3E892 second address: 68B3E89E instructions: 0x00000000 rdtsc 0x00000002 jc 00007F69B15E5206h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68B3E89E second address: 68B3E8A9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jc 00007F69B06D9AF6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68B3E8A9 second address: 68B3E8C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 pushad 0x00000007 popad 0x00000008 je 00007F69B15E5206h 0x0000000e pop ebx 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68B3E8C0 second address: 68B3E8C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68B3E8C4 second address: 68B3E8C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68B3E8C8 second address: 68B3E8D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68B3E8D0 second address: 68B3E8D5 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68B3ECA4 second address: 68B3ECA8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68B3ECA8 second address: 68B3ECAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68B424F3 second address: 68B424FD instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F69B06D9B02h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68B424FD second address: 68B4250E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F69B15E5206h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edi 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68B4250E second address: 68B42512 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68B42809 second address: 68B4282F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F69B15E520Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F69B15E5215h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68B4282F second address: 68B42835 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68B429DB second address: 68B429E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68B42B3C second address: 68B42B50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F69B06D9B00h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68B42B50 second address: 68B42B66 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F69B15E520Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jno 00007F69B15E5208h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68B42CF2 second address: 68B42D10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F69B06D9AFBh 0x00000009 pop edi 0x0000000a pop edi 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e jng 00007F69B06D9AF6h 0x00000014 pushad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68B42D10 second address: 68B42D15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68B42D15 second address: 68B42D32 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F69B06D9B08h 0x00000008 jmp 00007F69B06D9B02h 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68B42D32 second address: 68B42D4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F69B15E5217h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68B42E67 second address: 68B42E6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68B42E6B second address: 68B42E77 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F69B15E5206h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68B42E77 second address: 68B42E86 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F69B06D9AFAh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68B42E86 second address: 68B42E93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jc 00007F69B15E5223h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68B47F10 second address: 68B47F14 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68B4BB47 second address: 68B4BB51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F69B15E5206h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68B4F033 second address: 68B4F044 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 jmp 00007F69B06D9AFBh 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68BB1AA5 second address: 68BB1AA9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68BB1AA9 second address: 68BB1AAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68BB1AAF second address: 68BB1AB9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F69B15E5206h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68BB53E4 second address: 68BB540B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push ecx 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007F69B06D9B02h 0x00000011 pop ecx 0x00000012 push eax 0x00000013 push edx 0x00000014 jnc 00007F69B06D9AF6h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68BC269A second address: 68BC26A5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68BC26A5 second address: 68BC26F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop esi 0x00000006 pushad 0x00000007 jmp 00007F69B06D9B06h 0x0000000c jmp 00007F69B06D9B09h 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F69B06D9B05h 0x00000018 jnc 00007F69B06D9AF6h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68BC26F8 second address: 68BC2704 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68BC6AA5 second address: 68BC6ABD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F69B06D9B02h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68BC6ABD second address: 68BC6AC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68BEA457 second address: 68BEA45B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68BF152E second address: 68BF1537 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68BF1537 second address: 68BF153B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68BF1687 second address: 68BF169F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F69B15E5214h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68BF1836 second address: 68BF184E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F69B06D9B03h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68BF184E second address: 68BF1879 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F69B15E520Bh 0x00000007 push ebx 0x00000008 jmp 00007F69B15E5213h 0x0000000d pop ebx 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68BF1879 second address: 68BF187D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68BF2340 second address: 68BF2350 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jmp 00007F69B15E520Ah 0x0000000b rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68BF2350 second address: 68BF2367 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F69B06D9AFFh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68BF2367 second address: 68BF239C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a js 00007F69B15E522Fh 0x00000010 push edi 0x00000011 jbe 00007F69B15E5206h 0x00000017 jmp 00007F69B15E5215h 0x0000001c pop edi 0x0000001d js 00007F69B15E520Ch 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68BF2EE0 second address: 68BF2EE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68BF2EE4 second address: 68BF2EEE instructions: 0x00000000 rdtsc 0x00000002 jo 00007F69B15E5206h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68BF2EEE second address: 68BF2F11 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F69B06D9B05h 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007F69B06D9AFDh 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jo 00007F69B06D9B02h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68BF2F11 second address: 68BF2F1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F69B15E5206h 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68BF2F1F second address: 68BF2F25 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68BF3201 second address: 68BF3205 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68BF3205 second address: 68BF3209 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68BF3209 second address: 68BF320F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68B0B41C second address: 68B0B420 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68B0B420 second address: 68B0B434 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F69B15E520Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68B0B434 second address: 68B0B456 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F69B06D9AF6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F69B06D9B03h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68B0B456 second address: 68B0B45A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68B0A522 second address: 68B0A528 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68B0A528 second address: 68B0A52D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68B2090A second address: 68B2090E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68B2090E second address: 68B20914 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68B20914 second address: 68B2092F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F69B06D9B02h 0x0000000b push esi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68B2092F second address: 68B20935 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68B20935 second address: 68B20945 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 jp 00007F69B06D9AF8h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68B1F90C second address: 68B1F93E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F69B15E5215h 0x0000000d jmp 00007F69B15E5215h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68AC7300 second address: 68AC7318 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F69B06D9B03h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68AC7318 second address: 68AC731E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68B1FBB3 second address: 68B1FC02 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F69B06D9B06h 0x00000007 jno 00007F69B06D9AFCh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push ebx 0x00000010 pushad 0x00000011 push esi 0x00000012 pop esi 0x00000013 jbe 00007F69B06D9AF6h 0x00000019 jmp 00007F69B06D9AFFh 0x0000001e popad 0x0000001f pushad 0x00000020 jno 00007F69B06D9AF6h 0x00000026 jl 00007F69B06D9AF6h 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68B0A79C second address: 68B0A7A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68B0A7A1 second address: 68B0A7B7 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F69B06D9AFEh 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a jns 00007F69B06D9AF6h 0x00000010 push eax 0x00000011 push edx 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 push esi 0x00000015 pop esi 0x00000016 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68B0B28D second address: 68B0B291 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68B0B291 second address: 68B0B2D4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F69B06D9B06h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F69B06D9B09h 0x00000010 jmp 00007F69B06D9AFAh 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68B0B2D4 second address: 68B0B2D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68B153F0 second address: 68B153F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68B153F4 second address: 68B15401 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push ebx 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68B15401 second address: 68B15419 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F69B06D9AFFh 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68B15419 second address: 68B1541F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68B146D3 second address: 68B146E7 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push esi 0x00000004 pop esi 0x00000005 jmp 00007F69B06D9AFAh 0x0000000a pop esi 0x0000000b push eax 0x0000000c push edx 0x0000000d push edx 0x0000000e pop edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68B146E7 second address: 68B146EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68B216FA second address: 68B21700 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68B21700 second address: 68B21711 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b ja 00007F69B15E5206h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68B21711 second address: 68B21715 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68B21715 second address: 68B2171E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68B2171E second address: 68B21723 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68B14B40 second address: 68B14B44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68B14B44 second address: 68B14B5F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F69B06D9B07h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68ACEE2F second address: 68ACEE35 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68ACEE35 second address: 68ACEE3E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68ACEB38 second address: 68ACEB4E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F69B15E5210h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68ACEB4E second address: 68ACEB71 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push esi 0x00000004 pop esi 0x00000005 jnl 00007F69B06D9AF6h 0x0000000b pop eax 0x0000000c jmp 00007F69B06D9AFCh 0x00000011 pop edx 0x00000012 pop eax 0x00000013 push edi 0x00000014 push eax 0x00000015 push edx 0x00000016 pop edx 0x00000017 pop eax 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68ACEB71 second address: 68ACEB80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F69B15E520Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68ACEB80 second address: 68ACEB84 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68B14CD8 second address: 68B14CDC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68B14E2A second address: 68B14E2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68B14E2E second address: 68B14E3D instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jg 00007F69B15E5206h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68B14E3D second address: 68B14E43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68B1526F second address: 68B152A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007F69B15E5219h 0x0000000b jmp 00007F69B15E5213h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68B0A922 second address: 68B0A928 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68B0A928 second address: 68B0A947 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a push edi 0x0000000b pop edi 0x0000000c jmp 00007F69B15E520Fh 0x00000011 pop ebx 0x00000012 push ecx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68B0A947 second address: 68B0A94E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ecx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68B0A94E second address: 68B0A953 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68B0AF0B second address: 68B0AF0F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68B0AF0F second address: 68B0AF3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F69B15E5210h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F69B15E5216h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68B0AF3B second address: 68B0AF40 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68C03B39 second address: 68C03B79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 jmp 00007F69B15E5211h 0x0000000b popad 0x0000000c jmp 00007F69B15E5219h 0x00000011 push edx 0x00000012 jmp 00007F69B15E520Ch 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68C03CB1 second address: 68C03CB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68C03CB5 second address: 68C03CD2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F69B15E5217h 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68C03F52 second address: 68C03F92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F69B06D9AF6h 0x0000000a popad 0x0000000b js 00007F69B06D9B09h 0x00000011 jmp 00007F69B06D9B03h 0x00000016 pop ecx 0x00000017 push esi 0x00000018 jmp 00007F69B06D9B06h 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68C03F92 second address: 68C03F96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68C044A8 second address: 68C044BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F69B06D9B01h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68C044BD second address: 68C044C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68C044C1 second address: 68C044C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68C0461F second address: 68C04638 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F69B15E5215h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A6B537 second address: 68A6B53B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A6B53B second address: 68A6B53F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A6B53F second address: 68A6B54B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a push edx 0x0000000b pop edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68B11765 second address: 68B117A1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F69B15E5214h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jp 00007F69B15E520Ch 0x0000000f jmp 00007F69B15E5215h 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68B117A1 second address: 68B117A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68B117A7 second address: 68B117AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68B117AD second address: 68B117B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68B117B3 second address: 68B117C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a pop edx 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68B117C0 second address: 68B117C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68B117C4 second address: 68B117E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F69B15E5212h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jno 00007F69B15E5206h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68B117E5 second address: 68B117ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68B117ED second address: 68B117FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 ja 00007F69B15E520Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68ACB244 second address: 68ACB261 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 push esi 0x00000007 pushad 0x00000008 jnl 00007F69B06D9AF6h 0x0000000e jmp 00007F69B06D9AFBh 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68ACAF50 second address: 68ACAF56 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68ACAF56 second address: 68ACAF5E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68ACAF5E second address: 68ACAF62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68ACAF62 second address: 68ACAF66 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68B11A6A second address: 68B11A70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68B11A70 second address: 68B11A82 instructions: 0x00000000 rdtsc 0x00000002 js 00007F69B06D9AF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop esi 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 push esi 0x00000011 pop esi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68B11BDA second address: 68B11BDF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68B11BDF second address: 68B11BEE instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F69B06D9AF8h 0x00000008 pushad 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68C08B30 second address: 68C08B42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F69B15E5206h 0x0000000a pop eax 0x0000000b pop ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68C08B42 second address: 68C08B46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68C08B46 second address: 68C08B4A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68C08B4A second address: 68C08B66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F69B06D9B02h 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68C08B66 second address: 68C08B7D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F69B15E5211h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68C08B7D second address: 68C08B82 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68C08B82 second address: 68C08BAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F69B15E520Bh 0x00000009 jmp 00007F69B15E520Ch 0x0000000e popad 0x0000000f jbe 00007F69B15E5212h 0x00000015 jg 00007F69B15E5206h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68C08F7E second address: 68C08F82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68C08F82 second address: 68C08F88 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68C08F88 second address: 68C08FC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F69B06D9B05h 0x0000000b jmp 00007F69B06D9B05h 0x00000010 pushad 0x00000011 jnp 00007F69B06D9AF6h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68C0636D second address: 68C063A5 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F69B15E5206h 0x00000008 jl 00007F69B15E5206h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 ja 00007F69B15E5212h 0x00000016 popad 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F69B15E5210h 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68C063A5 second address: 68C063A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68C06560 second address: 68C06566 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68C06807 second address: 68C0680B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68A7477E second address: 68A7479E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F69B15E5213h 0x00000008 jl 00007F69B15E5206h 0x0000000e push esi 0x0000000f pop esi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68C092C4 second address: 68C092EE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jl 00007F69B06D9AFAh 0x0000000e pushad 0x0000000f popad 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 pop eax 0x00000016 jmp 00007F69B06D9B04h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68C1292F second address: 68C1295C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F69B15E5219h 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F69B15E5210h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68C1295C second address: 68C12962 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68C226AA second address: 68C22719 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F69B15E5212h 0x0000000b push edi 0x0000000c jmp 00007F69B15E520Ch 0x00000011 jmp 00007F69B15E5212h 0x00000016 pop edi 0x00000017 jmp 00007F69B15E520Ah 0x0000001c popad 0x0000001d push eax 0x0000001e push edx 0x0000001f jne 00007F69B15E520Eh 0x00000025 pushad 0x00000026 jp 00007F69B15E5206h 0x0000002c jmp 00007F69B15E5212h 0x00000031 push ecx 0x00000032 pop ecx 0x00000033 popad 0x00000034 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68C2151C second address: 68C21520 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Tries to evade debugger and weak emulator (self modifying code)
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Special instruction interceptor: First address: 68842C7A instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Special instruction interceptor: First address: 688406C6 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Special instruction interceptor: First address: 68A0EC50 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Special instruction interceptor: First address: 68AE03EE instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Special instruction interceptor: First address: 68B02B0D instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Special instruction interceptor: First address: 68B02B6D instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Special instruction interceptor: First address: 68B02BC7 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Special instruction interceptor: First address: 68B02C12 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Special instruction interceptor: First address: 68B02C6C instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Special instruction interceptor: First address: 68B02CEF instructions caused by: Self-modifying code
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Memory allocated: 75D0000 memory reserve | memory write watch
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Memory allocated: CD50000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Memory allocated: CDF0000 memory reserve | memory write watch
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Memory allocated: CE10000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Memory allocated: 12890000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Memory allocated: 128F0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Memory allocated: 12990000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Memory allocated: 12AD0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Memory allocated: 12B30000 memory commit | memory reserve | memory write watch
Contains capabilities to detect virtual machines
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion Jump to behavior
Found dropped PE file which has not been started or loaded
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\7888_698f0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\modified\@APPDATA@\Movavi Slideshow Maker 4\imageformats\qtiff.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\7888_05820000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\7888_05850000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\7888_6c460000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\7888_00e30000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\7888_05480000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\7888_041c0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\7888_05cd0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\7888_00400000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\7888_045c0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\7888_04220000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\7888_05ca0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\7888_06130000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\7888_06240000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\7888_056c0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\7888_6aec0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\7888_6a7c0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\7888_053a0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\7888_01190000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\7888_65bc0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\7888_040e0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\7888_62c80000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\7888_66980000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\7888_015a0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\7888_05f20000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\7888_05750000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\7888_6a400000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\7888_05500000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\7888_693a0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\7888_6a810000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\7888_65200000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\7888_042d0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\7888_040c0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\7888_04570000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\7888_04770000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\7888_04350000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\7888_6b8d0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\7888_044e0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\7888_05910000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\7888_00bc0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\7888_00ff0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\7888_05700000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\7888_05f50000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\7888_05d40000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\7888_05b10000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\modified\@APPDATA@\Movavi Slideshow Maker 4\imageformats\qjpeg.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\7888_69120000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\7888_6be00000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\7888_06310000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\7888_00db0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\7888_04160000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\7888_05790000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\7888_6aa50000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\7888_01210000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\7888_05570000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\7888_64000000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\7888_6c8f0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\7888_6a640000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\7888_00650000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\7888_00c30000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\7888_05640000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\7888_062e0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\7888_6eb40000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\7888_05c50000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\7888_00610000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\7888_05ec0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\7888_6b100000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\7888_05c10000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\modified\@APPDATA@\Movavi Slideshow Maker 4\imageformats\qgif.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\7888_055b0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\7888_008f0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\7888_06350000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\modified\@APPDATA@\Movavi Slideshow Maker 4\SlideshowMaker.exe Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\7888_004e0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\7888_04520000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\7888_050e0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\7888_05ae0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\7888_055f0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\7888_050b0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\7888_058f0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\7888_054c0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\modified\@APPDATA@\Movavi Slideshow Maker 4\platforms\qwindows.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\7888_00780000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\7888_013d0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\7888_00b40000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\7888_00710000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\7888_01360000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\7888_01150000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\7888_6cde0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\7888_64b40000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\7888_05fb0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\7888_6d270000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\7888_6bb50000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\7888_01120000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\7888_04280000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\7888_63180000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\7888_05890000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\7888_05670000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\7888_01730000_tls.dll Jump to dropped file
Queries disk information (often used to detect virtual machines)
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File opened: PhysicalDrive0 Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File opened: C:\Users\user\Desktop\Data\local\modified\@APPDATA@\Movavi Slideshow Maker 4\ Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File opened: C:\Users\user\AppData\Local\Temp\SPOON\CACHE\0x082C556205010103\ Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File opened: C:\Users\user\AppData\Local\Temp\ Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File opened: C:\Users\user\AppData\Local\Temp\SPOON\CACHE\ Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File opened: C:\Users\user\Desktop\Data\roaming\modified\@APPDATA@\Movavi Slideshow Maker 4\ Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File opened: C:\Users\user\AppData\Local\Temp\SPOON\ Jump to behavior
Source: Movavi Slideshow Maker 4.exe, 00000000.00000002.2511937457.0000000002C19000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWX
Source: Movavi Slideshow Maker 4.exe, 00000000.00000002.2511937457.0000000002C19000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-0
Source: SlideshowMaker.exe, 00000009.00000003.1375989926.00000000047F7000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: xvmcidct
Source: Movavi Slideshow Maker 4.exe, 00000000.00000002.2511937457.0000000002C19000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000009.00000002.2521524914.0000000001526000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: Movavi Slideshow Maker 4.exe, 00000000.00000002.2511937457.0000000002C19000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: 9-%SystemRoot%\system32\wshbth.dllRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: Movavi Slideshow Maker 4.exe, 00000000.00000002.2511937457.0000000002C19000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWL
Source: Movavi Slideshow Maker 4.exe, 00000000.00000002.2511937457.0000000002C19000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\HQV
Source: SlideshowMaker.exe, 00000009.00000003.1375989926.00000000047F7000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: byuyv422rgb24bgr24yuv422pyuv444pyuv410pyuv411pgraygray8,y8monowmonobpal8yuvj420pyuvj422pyuvj444pxvmcmcxvmcidctuyvy422uyyvyy411bgr8bgr4bgr4_bytergb8rgb4rgb4_bytenv12nv21argbabgrgray16bey16begray16ley16leyuv440pyuvj440pyuva420pvdpau_h264vdpau_mpeg1vdpau_mpeg2vdpau_wmv3vdpau_vc1rgb48bergb48lergb565bergb565lergb555bergb555lebgr565bebgr565lebgr555bebgr555levaapi_mocovaapi_idctvaapi_vldyuv420p16leyuv420p16beyuv422p16leyuv422p16beyuv444p16leyuv444p16bevdpau_mpeg4dxva2_vldrgb444lergb444bebgr444lebgr444beya8gray8abgr48bebgr48leyuv420p9beyuv420p9leyuv420p10beyuv420p10leyuv422p10beyuv422p10leyuv444p9beyuv444p9leyuv444p10beyuv444p10leyuv422p9beyuv422p9levda_vldgbrpgbrp9begbrp9legbrp10begbrp10legbrp16begbrp16leyuva422pyuva444pyuva420p9beyuva420p9leyuva422p9beyuva422p9leyuva444p9beyuva444p9leyuva420p10beyuva420p10leyuva422p10beyuva422p10leyuva444p10beyuva444p10leyuva420p16beyuva420p16leyuva422p16beyuva422p16leyuva444p16beyuva444p16levdpauxyz12lexyz12benv16nv20lenv20bergba64bergba64lebgra64bebgra64leyvyu422vdaya16beya16legbrapgbrap16begbrap16leqsvmmald3d11va_vldcuda0rgbrgb00bgrbgr0yuv420p12beyuv420p12leyuv420p14beyuv420p14leyuv422p12beyuv422p12leyuv422p14beyuv422p14leyuv444p12beyuv444p12leyuv444p14beyuv444p14legbrp12begbrp12legbrp14begbrp14leyuvj411pbayer_bggr8bayer_rggb8bayer_gbrg8bayer_grbg8bayer_bggr16lebayer_bggr16bebayer_rggb16lebayer_rggb16bebayer_gbrg16lebayer_gbrg16bebayer_grbg16lebayer_grbg16beyuv440p10leyuv440p10beyuv440p12leyuv440p12beayuv64leayuv64bevideotoolbox_vldp010lep010begbrap12begbrap12legbrap10begbrap10lemediacodecgray12bey12begray12ley12legray10bey10begray10ley10lep016lep016be3
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe System information queried: ModuleInformation
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Process information queried: ProcessInformation

Anti Debugging
barindex
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe System information queried: CodeIntegrityInformation Jump to behavior
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe System information queried: CodeIntegrityInformation Jump to behavior
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe System information queried: CodeIntegrityInformation Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe System information queried: CodeIntegrityInformation
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe System information queried: CodeIntegrityInformation
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe System information queried: CodeIntegrityInformation
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe System information queried: CodeIntegrityInformation
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe System information queried: CodeIntegrityInformation
Hides threads from debuggers
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Thread information set: HideFromDebugger Jump to behavior
Tries to detect sandboxes and other dynamic analysis tools (window names)
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Open window title or class name: file monitor - sysinternals: www.sysinternals.com
Checks for debuggers (devices)
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File opened: NTICE
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File opened: SICE
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File opened: SIWVID
Checks for kernel debuggers (NtQuerySystemInformation(SystemKernelDebuggerInformation))
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe System information queried: KernelDebuggerInformation Jump to behavior
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Memory allocated: page read and write | page guard

HIPS / PFW / Operating System Protection Evasion
barindex
Writes to foreign memory regions
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe Memory written: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe base: 2E6FE0 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe Process created: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe "C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe" /864A627C-C6B2-464A-AA13-25D62F282BD8 Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Queries volume information: C:\Users\user\AppData\Roaming VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Queries volume information: C:\Users\user\AppData\Roaming VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Queries volume information: C:\ProgramData VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Queries volume information: C:\Users\user\AppData\Roaming VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Queries volume information: C:\Users\user\AppData\Roaming VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Queries volume information: C:\Users\user\AppData\Roaming VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Queries volume information: C:\Users\user\AppData\Roaming VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Queries volume information: C:\Users\user\AppData\Roaming VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Queries volume information: C:\Users\user\AppData\Roaming VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Queries volume information: C:\Users\user\AppData\Roaming VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Queries volume information: C:\Users\user\AppData\Roaming VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Queries volume information: C:\Users\user\AppData\Roaming VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Queries volume information: C:\Users\user\AppData\Roaming VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Queries volume information: C:\Users\user\AppData\Roaming VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Queries volume information: C:\Users\user\AppData\Roaming VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Queries volume information: C:\Users\user\AppData\Roaming VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Queries volume information: C:\Users\user\AppData\Roaming VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Queries volume information: C:\Users\user\AppData\Roaming VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1541901 Sample: Movavi Slideshow Maker 4.exe Startdate: 25/10/2024 Architecture: WINDOWS Score: 72 30 start.turbo.net 2->30 32 mip2.movavi.com 2->32 34 4 other IPs or domains 2->34 6 Movavi Slideshow Maker 4.exe 1 493 2->6         started        process3 dnsIp4 36 start.turbo.net 104.26.14.179, 443, 49699 CLOUDFLARENETUS United States 6->36 16 C:\Users\user\Desktop\...\SlideshowMaker.exe, PE32 6->16 dropped 18 C:\Users\user\...\SlideshowMaker.exe.manifest, ASCII 6->18 dropped 20 C:\Users\user\Desktop\...\SlideshowMaker.exe, PE32 6->20 dropped 42 Writes to foreign memory regions 6->42 44 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 6->44 11 SlideshowMaker.exe 36 235 6->11         started        file5 signatures6 process7 dnsIp8 38 db4t5hkfesjuw.cloudfront.net 18.66.112.33, 49751, 49768, 80 MIT-GATEWAYSUS United States 11->38 40 lsw-03-balancer.movavi.com 84.16.252.107, 443, 49731, 49732 LEASEWEB-DE-FRA-10DE Germany 11->40 22 C:\Users\user\...\7888_6eb40000_tls.dll, PE32 11->22 dropped 24 C:\Users\user\...\7888_6d270000_tls.dll, PE32 11->24 dropped 26 C:\Users\user\...\7888_6cde0000_tls.dll, PE32 11->26 dropped 28 121 other files (none is malicious) 11->28 dropped 46 Tries to detect sandboxes and other dynamic analysis tools (window names) 11->46 48 Tries to evade debugger and weak emulator (self modifying code) 11->48 50 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 11->50 52 4 other signatures 11->52 file9 signatures10
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
84.16.252.107
 lsw-03-balancer.movavi.com Germany
28753 LEASEWEB-DE-FRA-10DE false
104.26.14.179
 start.turbo.net United States
13335 CLOUDFLARENETUS false
18.66.112.33
 db4t5hkfesjuw.cloudfront.net United States
3 MIT-GATEWAYSUS false

Contacted Domains

Name IP Active
start.turbo.net 104.26.14.179 true
lsw-03-balancer.movavi.com 84.16.252.107 true
db4t5hkfesjuw.cloudfront.net 18.66.112.33 true
mip2.movavi.com unknown unknown
img.movavi.com unknown unknown
codec-activate.movavi.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://mip2.movavi.com/get_nag.php?app=slideshowcreator&module=slideshowcreator&app_ver=4-1-0&partner=&app_mode=activated&lang=it&app_action=major_update&huid=4ced03854cc6a95a6624cd0f09793cbc54da0a95&protocol=1&rnd=29792&os=win&act_key= false
    		unknown
    https://codec-activate.movavi.com/api/v1/codec/all/?akey=&huid=4ced03854cc6a95a6624cd0f09793cbc54da0a95 false
      		unknown
      http://img.movavi.com/webnagscreens/crossale_suite/btn_close_it.png false
        		unknown
        http://img.movavi.com/webnagscreens/crossale_suite/btn_buy_it.png false
          		unknown
          https://mip2.movavi.com/get_nag.php?app=slideshowcreator&module=slideshowcreator&app_ver=4-1-0&partner=&app_mode=activated&lang=it&app_action=app_close&huid=4ced03854cc6a95a6624cd0f09793cbc54da0a95&protocol=1&rnd=29789&os=win&act_key= false
            		unknown
            https://start.turbo.net/services/1.0/activity/vm-18.4.1281.0/run false
              		unknown
              http://img.movavi.com/webnagscreens/crossale_suite/it.png false
                		unknown
                https://mip2.movavi.com/get_nag.php?app=slideshowcreator&module=slideshowcreator&app_ver=4-1-0&partner=&app_mode=activated&lang=it&app_action=capture_screencast&huid=4ced03854cc6a95a6624cd0f09793cbc54da0a95&protocol=1&rnd=29792&os=win&act_key= false
                  		unknown
                  http://img.movavi.com/webnagscreens/crossale_suite/style.css false
                    		unknown
                    https://mip2.movavi.com/get_nag.php?app=slideshowcreator&module=slideshowcreator&app_ver=4-1-0&partner=&app_mode=activated&lang=it&app_action=app_start&huid=4ced03854cc6a95a6624cd0f09793cbc54da0a95&protocol=1&rnd=29792&os=win&act_key= false
                      		unknown