Windows Analysis Report
Movavi Slideshow Maker 4.exe

Overview

General Information

Sample name: Movavi Slideshow Maker 4.exe
Analysis ID: 1541910
MD5: 0cd8f9edc5183f8729598f19cf2da06b
SHA1: 300049e800fe66c3ea872abf9ac9599b351ba9a6
SHA256: 9a6d2d6ca21a6b83a31aa5a5f855d653d66096ffe0b25dcdf04f4943e3d3892d
Infos:

Detection

Score: 72
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Hides threads from debuggers
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Tries to evade debugger and weak emulator (self modifying code)
Writes to foreign memory regions
Allocates memory with a write watch (potentially for evading sandboxes)
Checks for debuggers (devices)
Checks for kernel debuggers (NtQuerySystemInformation(SystemKernelDebuggerInformation))
Checks if the current process is being debugged
Contains capabilities to detect virtual machines
Creates a process in suspended mode (likely to inject code)
Drops PE files
Found dropped PE file which has not been started or loaded
JA3 SSL client fingerprint seen in connection with other malware
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
PE file contains an invalid checksum
PE file contains sections with non-standard names
Queries disk information (often used to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses a known web browser user agent for HTTP communication

Classification

Source: SlideshowMaker.exe, 00000001.00000003.1804727013.0000000000F38000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: -----BEGIN PUBLIC KEY----- memstr_fcd977cc-d
Uses 32bit PE files
Source: Movavi Slideshow Maker 4.exe Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
Source: unknown HTTPS traffic detected: 172.67.75.65:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown HTTPS traffic detected: 84.16.252.107:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown HTTPS traffic detected: 84.16.252.107:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown HTTPS traffic detected: 84.16.252.107:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\CoreApp.pdb**! source: SlideshowMaker.exe, 00000001.00000003.1805981700.0000000003A16000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1805338785.00000000039B1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\ParserFactory.pdb source: SlideshowMaker.exe, 00000001.00000003.1835870589.000000000494D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1831421405.00000000048E1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\ComputingResourceManager.pdb source: SlideshowMaker.exe, 00000001.00000003.1835870589.000000000494D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1831421405.00000000048E1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837223475.00000000049E9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\EditingScene.pdb)) source: SlideshowMaker.exe, 00000001.00000003.1847071702.0000000004D27000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1838380312.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1843495827.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1845596760.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\Policies.pdb""! source: SlideshowMaker.exe, 00000001.00000003.1835870589.000000000494D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1831421405.00000000048E1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\BeatDetection.pdb source: SlideshowMaker.exe, 00000001.00000003.1838380312.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1843495827.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1845596760.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\CodecPolicyController.pdb source: SlideshowMaker.exe, 00000001.00000003.1805981700.0000000003A16000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1807296039.0000000003B09000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1805338785.00000000039B1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\PatentActivator.pdb source: SlideshowMaker.exe, 00000001.00000003.1805981700.0000000003A16000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1805338785.00000000039B1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\OverlayEngine.pdb'' source: SlideshowMaker.exe, 00000001.00000003.1848952863.0000000004DA3000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1847071702.0000000004D27000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1838380312.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1849316625.0000000004E3C000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1843495827.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1845596760.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1849128230.0000000004DBD000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\CoreTime.pdb source: SlideshowMaker.exe, 00000001.00000003.1807067664.0000000003D70000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1811248442.0000000003D70000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1831966818.0000000003D7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1830647359.0000000003D70000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1810582792.0000000003D70000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1844730403.0000000003D91000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1806284873.0000000003D70000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\MQtDownloadManager.pdb source: SlideshowMaker.exe, 00000001.00000003.1800492043.00000000009AE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1806580685.0000000000A65000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1806643474.0000000000ADB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1799739278.0000000000911000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\MovaviAudIO.pdb source: SlideshowMaker.exe, 00000001.00000003.1835870589.000000000494D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1842263009.0000000004AFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1844762927.0000000004BD8000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1831421405.00000000048E1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1845596760.0000000004C11000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1838380312.0000000004A77000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1843495827.0000000004B5B000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837223475.00000000049E9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\Settings.pdb!! source: SlideshowMaker.exe, 00000001.00000003.1804916505.00000000012F3000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\AccelerationTracker.pdb!! source: SlideshowMaker.exe, 00000001.00000003.1835870589.000000000494D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1842263009.0000000004AFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1844762927.0000000004BD8000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1831421405.00000000048E1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1845596760.0000000004C11000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1846012651.0000000004C6A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1838380312.0000000004A77000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1843495827.0000000004B5B000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1846755210.0000000004CA7000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837223475.00000000049E9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\DesktopNotification.pdb source: SlideshowMaker.exe, 00000001.00000003.1800492043.00000000009AE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1807328586.0000000000AE9000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1806580685.0000000000A65000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1806643474.0000000000ADB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1799739278.0000000000911000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\CoreApp.pdb source: SlideshowMaker.exe, 00000001.00000003.1805981700.0000000003A16000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1805338785.00000000039B1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\EditorSerialization.pdb source: SlideshowMaker.exe, 00000001.00000003.1847071702.0000000004D27000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1838380312.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1843495827.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1845596760.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\work\SDK\glog\0.3.4\lib\Win\msvc-14.0\x86\libglog-msvc-14.pdb source: SlideshowMaker.exe, 00000001.00000003.1799152520.000000000050F000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\PlayerControl.pdb## source: SlideshowMaker.exe, 00000001.00000003.1835870589.000000000494D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1842263009.0000000004AFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1831421405.00000000048E1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1838380312.0000000004A77000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1843495827.0000000004B5B000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837223475.00000000049E9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\Settings.pdb source: SlideshowMaker.exe, 00000001.00000003.1804916505.00000000012F3000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: vcruntime140.i386.pdbGCTL source: SlideshowMaker.exe, 00000001.00000003.1799152520.000000000050F000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\GraphicsSvg.pdb source: SlideshowMaker.exe, 00000001.00000003.1848952863.0000000004DA3000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1847071702.0000000004D27000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1838380312.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1849316625.0000000004E3C000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1843495827.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1845596760.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1849461496.0000000004E58000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1849128230.0000000004DBD000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\EditorTransitions.pdb!! source: SlideshowMaker.exe, 00000001.00000003.1848952863.0000000004DA3000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1847071702.0000000004D27000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1838380312.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1843495827.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1845596760.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1849128230.0000000004DBD000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\MQtUtil.pdb source: SlideshowMaker.exe, 00000001.00000003.1805338785.00000000039B1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\Presets.pdb source: SlideshowMaker.exe, 00000001.00000003.1843349509.0000000004AC8000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1835870589.000000000494D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1831421405.00000000048E1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1838380312.0000000004A77000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837223475.00000000049E9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\AudioRendererSDL.pdb$$! source: SlideshowMaker.exe, 00000001.00000003.1835870589.000000000494D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1842263009.0000000004AFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1844762927.0000000004BD8000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1831421405.00000000048E1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1838380312.0000000004A77000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1843495827.0000000004B5B000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837223475.00000000049E9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\work\SDK\glog\0.3.4\lib\Win\msvc-14.0\x86\libglog-msvc-14.pdb"" source: SlideshowMaker.exe, 00000001.00000003.1799152520.000000000050F000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\OpenglSwitcherAPI.pdb## source: SlideshowMaker.exe, 00000001.00000003.1800492043.00000000009AE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1799739278.0000000000911000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: msvcp140.i386.pdb source: SlideshowMaker.exe, 00000001.00000003.1799152520.000000000050F000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\EditorTransitions.pdb source: SlideshowMaker.exe, 00000001.00000003.1848952863.0000000004DA3000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1847071702.0000000004D27000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1838380312.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1843495827.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1845596760.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1849128230.0000000004DBD000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\ASSWrapper.pdb source: SlideshowMaker.exe, 00000001.00000003.1835870589.000000000494D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1831421405.00000000048E1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837223475.00000000049E9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\MovaviIO.pdb66 source: SlideshowMaker.exe, 00000001.00000003.1805981700.0000000003A16000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1805338785.00000000039B1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\MQtDownloadManager.pdb$$ source: SlideshowMaker.exe, 00000001.00000003.1800492043.00000000009AE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1806580685.0000000000A65000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1806643474.0000000000ADB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1799739278.0000000000911000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\EffectsSpecial.pdb source: SlideshowMaker.exe, 00000001.00000003.1847452500.000000000155E000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848838300.0000000001598000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1851518505.00000000015A7000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\bamboo-home\xml-data\build-dir\SPOONVM-VM-JOB1\vm\Build\Output\x86\VmX.pdb source: Movavi Slideshow Maker 4.exe, 00000000.00000003.1705294826.00000000006E9000.00000004.00000020.00020000.00000000.sdmp, Movavi Slideshow Maker 4.exe, 00000000.00000002.2954049887.000000001003C000.00000002.10000000.00040000.00000000.sdmp, Movavi Slideshow Maker 4.exe, 00000000.00000002.2949192490.00000000006BB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1742216462.0000000001558000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1742834920.000000000155C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\bamboo-home\xml-data\build-dir\SPOONVM-VM-JOB1\vm\Build\Output\x86\StubExe.pdb source: Movavi Slideshow Maker 4.exe, 00000000.00000002.2950690600.0000000000BC0000.00000040.00001000.00020000.00000000.sdmp, Movavi Slideshow Maker 4.exe, 00000000.00000002.2950155746.0000000000870000.00000004.00001000.00020000.00000000.sdmp, Movavi Slideshow Maker 4.exe, 00000000.00000002.2948401633.0000000000401000.00000020.00000001.01000000.00000003.sdmp
Source: Binary string: C:\bamboo-home\xml-data\build-dir\SPOONVM-VM-JOB1\vm\Build\Output\x64\StubExe.pdb source: Movavi Slideshow Maker 4.exe, 00000000.00000002.2950690600.0000000000BC0000.00000040.00001000.00020000.00000000.sdmp, Movavi Slideshow Maker 4.exe, 00000000.00000002.2950155746.0000000000870000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\EditorEffects.pdb source: SlideshowMaker.exe, 00000001.00000003.1849072895.000000000604D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\DataHelpers.pdb source: SlideshowMaker.exe, 00000001.00000003.1831044187.0000000004687000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\ResourceUtil.pdb source: SlideshowMaker.exe, 00000001.00000003.1805981700.0000000003A16000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1805338785.00000000039B1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1810317163.0000000003B79000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\GraphicsSvg.pdb## source: SlideshowMaker.exe, 00000001.00000003.1848952863.0000000004DA3000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1847071702.0000000004D27000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1838380312.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1849316625.0000000004E3C000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1843495827.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1845596760.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1849461496.0000000004E58000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1849128230.0000000004DBD000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\MQtMediaUi.pdb source: SlideshowMaker.exe, 00000001.00000003.1847071702.0000000004D27000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1838380312.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1843495827.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1845596760.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\EffectFactory.pdb source: SlideshowMaker.exe, 00000001.00000003.1835870589.000000000494D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1831421405.00000000048E1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837223475.00000000049E9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\MovaviAudIO.pdb33" source: SlideshowMaker.exe, 00000001.00000003.1835870589.000000000494D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1842263009.0000000004AFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1844762927.0000000004BD8000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1831421405.00000000048E1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1845596760.0000000004C11000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1838380312.0000000004A77000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1843495827.0000000004B5B000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837223475.00000000049E9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\MQtUi.pdb source: SlideshowMaker.exe, 00000001.00000003.1846910089.0000000005DAA000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\CodecFactory.pdb source: SlideshowMaker.exe, 00000001.00000003.1830647359.0000000003C3E000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1805981700.0000000003A16000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1811248442.0000000003C2F000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1805338785.00000000039B1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1810317163.0000000003B79000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\BeatDetection.pdb&&" source: SlideshowMaker.exe, 00000001.00000003.1838380312.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1843495827.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1845596760.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\CoreTime.pdb source: SlideshowMaker.exe, 00000001.00000003.1807067664.0000000003D70000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1811248442.0000000003D70000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1831966818.0000000003D7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1830647359.0000000003D70000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1810582792.0000000003D70000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1844730403.0000000003D91000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1806284873.0000000003D70000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\PlayerControl.pdb source: SlideshowMaker.exe, 00000001.00000003.1835870589.000000000494D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1842263009.0000000004AFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1831421405.00000000048E1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1838380312.0000000004A77000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1843495827.0000000004B5B000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837223475.00000000049E9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\OpenglSwitcherAPI.pdb source: SlideshowMaker.exe, 00000001.00000003.1800492043.00000000009AE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1799739278.0000000000911000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\ComputingResourceManager.pdb"" source: SlideshowMaker.exe, 00000001.00000003.1835870589.000000000494D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1831421405.00000000048E1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837223475.00000000049E9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\GraphicsFramework.pdb source: SlideshowMaker.exe, 00000001.00000003.1847452500.000000000155E000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848838300.0000000001598000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: msvcp140.i386.pdbGCTL source: SlideshowMaker.exe, 00000001.00000003.1799152520.000000000050F000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\CrashHandler.pdb source: SlideshowMaker.exe, 00000001.00000003.1805981700.0000000003A16000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1811248442.0000000003C2F000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1805338785.00000000039B1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1810317163.0000000003B79000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\NagScreen.pdb source: SlideshowMaker.exe, 00000001.00000003.1805981700.0000000003A16000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1805338785.00000000039B1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1810317163.0000000003B79000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\UpdateChecker.pdb source: SlideshowMaker.exe, 00000001.00000003.1851648195.00000000009AE000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\AccelerationTracker.pdb source: SlideshowMaker.exe, 00000001.00000003.1835870589.000000000494D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1842263009.0000000004AFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1844762927.0000000004BD8000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1831421405.00000000048E1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1845596760.0000000004C11000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1846012651.0000000004C6A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1838380312.0000000004A77000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1843495827.0000000004B5B000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1846755210.0000000004CA7000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837223475.00000000049E9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\PatentActivator.pdb$$ source: SlideshowMaker.exe, 00000001.00000003.1805981700.0000000003A16000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1805338785.00000000039B1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\EditorSerialization.pdb&& source: SlideshowMaker.exe, 00000001.00000003.1847071702.0000000004D27000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1838380312.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1843495827.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1845596760.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\PackageInstaller.pdb source: SlideshowMaker.exe, 00000001.00000003.1848952863.0000000004DA3000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1849592510.0000000004ECE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1847071702.0000000004D27000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1838380312.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1849316625.0000000004E3C000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1843495827.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1845596760.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1849461496.0000000004E58000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1849128230.0000000004DBD000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\PlayerEngine.pdb)) source: SlideshowMaker.exe, 00000001.00000003.1835870589.000000000494D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1842263009.0000000004AFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1831421405.00000000048E1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1838380312.0000000004A77000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1843495827.0000000004B5B000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837223475.00000000049E9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\MQtMediaUtil.pdb source: SlideshowMaker.exe, 00000001.00000003.1835870589.000000000494D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1842263009.0000000004AFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1831421405.00000000048E1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1838380312.0000000004A77000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1843495827.0000000004B5B000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837223475.00000000049E9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: concrt140.i386.pdb source: SlideshowMaker.exe, 00000001.00000003.1835870589.000000000494D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1842263009.0000000004AFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1844762927.0000000004BD8000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1831421405.00000000048E1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1845596760.0000000004C11000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1846012651.0000000004C6A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1838380312.0000000004A77000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1843495827.0000000004B5B000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837223475.00000000049E9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\OglManager.pdb source: SlideshowMaker.exe, 00000001.00000003.1800492043.00000000009AE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1799739278.0000000000911000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\CoreLocalization.pdb!! source: SlideshowMaker.exe, 00000001.00000003.1799152520.000000000050F000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\bamboo-home\xml-data\build-dir\SPOONVM-VM-JOB1\vm\Build\Output\x86\Vm.pdb source: Movavi Slideshow Maker 4.exe, 00000000.00000002.2950690600.0000000000BC0000.00000040.00001000.00020000.00000000.sdmp, Movavi Slideshow Maker 4.exe, 00000000.00000002.2950155746.0000000000870000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\DesktopNotification.pdb%% source: SlideshowMaker.exe, 00000001.00000003.1800492043.00000000009AE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1807328586.0000000000AE9000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1806580685.0000000000A65000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1806643474.0000000000ADB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1799739278.0000000000911000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\EditorImports.pdb source: SlideshowMaker.exe, 00000001.00000003.1858645130.000000000050F000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\MediaTypes.pdb source: SlideshowMaker.exe, 00000001.00000003.1835870589.000000000494D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1831421405.00000000048E1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1838380312.0000000004A77000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837223475.00000000049E9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\GraphicsDecoration.pdb++ source: SlideshowMaker.exe, 00000001.00000003.1848952863.0000000004DA3000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1847071702.0000000004D27000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1838380312.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1843495827.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1845596760.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\MuxerFactory.pdb source: SlideshowMaker.exe, 00000001.00000003.1830647359.0000000003C3E000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1805981700.0000000003A16000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1811248442.0000000003C2F000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1805338785.00000000039B1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1830767493.0000000003CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1810317163.0000000003B79000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\GraphicsFramework.pdb%% source: SlideshowMaker.exe, 00000001.00000003.1847452500.000000000155E000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848838300.0000000001598000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\OverlayEngine.pdb source: SlideshowMaker.exe, 00000001.00000003.1848952863.0000000004DA3000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1847071702.0000000004D27000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1838380312.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1849316625.0000000004E3C000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1843495827.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1845596760.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1849128230.0000000004DBD000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\ProcInt.pdb@@! source: SlideshowMaker.exe, 00000001.00000003.1804822306.000000000117F000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: concrt140.i386.pdbGCTL source: SlideshowMaker.exe, 00000001.00000003.1835870589.000000000494D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1842263009.0000000004AFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1844762927.0000000004BD8000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1831421405.00000000048E1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1845596760.0000000004C11000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1846012651.0000000004C6A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1838380312.0000000004A77000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1843495827.0000000004B5B000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837223475.00000000049E9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\EditorEffects.pdb((" source: SlideshowMaker.exe, 00000001.00000003.1849072895.000000000604D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\MQtMediaUi.pdb"" source: SlideshowMaker.exe, 00000001.00000003.1847071702.0000000004D27000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1838380312.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1843495827.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1845596760.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\OglManager.pdb88! source: SlideshowMaker.exe, 00000001.00000003.1800492043.00000000009AE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1799739278.0000000000911000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\Converters.pdb!! source: SlideshowMaker.exe, 00000001.00000003.1835870589.000000000494D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1842263009.0000000004AFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1831421405.00000000048E1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1838380312.0000000004A77000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837223475.00000000049E9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\PlayerEngine.pdb source: SlideshowMaker.exe, 00000001.00000003.1835870589.000000000494D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1842263009.0000000004AFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1831421405.00000000048E1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1838380312.0000000004A77000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1843495827.0000000004B5B000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837223475.00000000049E9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\AppUtil.pdb00 source: SlideshowMaker.exe, 00000001.00000003.1805981700.0000000003A16000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1805338785.00000000039B1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1810317163.0000000003B79000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\FFWrapper.pdb source: SlideshowMaker.exe, 00000001.00000003.1830647359.0000000003C3E000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1805981700.0000000003A16000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1811248442.0000000003C2F000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1831122946.0000000003D18000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1805338785.00000000039B1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1830767493.0000000003CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1810317163.0000000003B79000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\EditorOverlays.pdb source: SlideshowMaker.exe, 00000001.00000003.1858645130.000000000050F000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\FilterFactory.pdb source: SlideshowMaker.exe, 00000001.00000003.1835870589.000000000494D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1831421405.00000000048E1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\PackageInstaller.pdb,, source: SlideshowMaker.exe, 00000001.00000003.1848952863.0000000004DA3000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1849592510.0000000004ECE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1847071702.0000000004D27000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1838380312.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1849316625.0000000004E3C000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1843495827.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1845596760.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1849461496.0000000004E58000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1849128230.0000000004DBD000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\CrashSenderWrapper.pdb source: SlideshowMaker.exe, 00000001.00000003.1800492043.00000000009AE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1807328586.0000000000AE9000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1806580685.0000000000A65000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1806643474.0000000000ADB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1831022848.0000000000B08000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1799739278.0000000000911000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\Tracker.pdb source: SlideshowMaker.exe, 00000001.00000003.1801066920.00000000005D5000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1799152520.000000000050F000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\EditingScene.pdb source: SlideshowMaker.exe, 00000001.00000003.1847071702.0000000004D27000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1838380312.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1843495827.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1845596760.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\Policies.pdb source: SlideshowMaker.exe, 00000001.00000003.1835870589.000000000494D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1831421405.00000000048E1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\SDLManager.pdb source: SlideshowMaker.exe, 00000001.00000003.1807067664.0000000003D70000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1811248442.0000000003D70000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1845946358.0000000003DA8000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1831966818.0000000003D7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1830647359.0000000003D70000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1810582792.0000000003D70000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1844730403.0000000003D91000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1806284873.0000000003D70000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\Demuxers.pdb source: SlideshowMaker.exe, 00000001.00000003.1835870589.000000000494D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1831421405.00000000048E1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1838380312.0000000004A77000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837223475.00000000049E9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\MagnetizeTools.pdb source: SlideshowMaker.exe, 00000001.00000003.1848952863.0000000004DA3000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1847071702.0000000004D27000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1838380312.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1843495827.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1845596760.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1849128230.0000000004DBD000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\CoreLocalization.pdb source: SlideshowMaker.exe, 00000001.00000003.1799152520.000000000050F000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\Threading.pdb source: SlideshowMaker.exe, 00000001.00000003.1835870589.000000000494D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1831421405.00000000048E1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837223475.00000000049E9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\GraphicsDecoration.pdb source: SlideshowMaker.exe, 00000001.00000003.1848952863.0000000004DA3000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1847071702.0000000004D27000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1838380312.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1843495827.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1845596760.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\CoreTracker.pdb source: SlideshowMaker.exe, 00000001.00000003.1801066920.00000000005D5000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1799152520.000000000050F000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\VideoRendererOGLQt.pdb source: SlideshowMaker.exe, 00000001.00000003.1835870589.000000000494D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1842263009.0000000004AFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1844762927.0000000004BD8000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1831421405.00000000048E1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1838380312.0000000004A77000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1843495827.0000000004B5B000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837223475.00000000049E9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\WebBrowser.pdb33' source: SlideshowMaker.exe, 00000001.00000003.1805981700.0000000003A16000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1805338785.00000000039B1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1810317163.0000000003B79000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\MQtUtil.pdbKK! source: SlideshowMaker.exe, 00000001.00000003.1805338785.00000000039B1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\ProcInt.pdb source: SlideshowMaker.exe, 00000001.00000003.1804822306.000000000117F000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\StreamReader.pdb source: SlideshowMaker.exe, 00000001.00000003.1835870589.000000000494D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1842263009.0000000004AFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1831421405.00000000048E1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1838380312.0000000004A77000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837223475.00000000049E9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\CoreManager.pdb source: SlideshowMaker.exe, 00000001.00000003.1830647359.0000000003C3E000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1805981700.0000000003A16000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1811248442.0000000003C2F000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1805338785.00000000039B1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1810317163.0000000003B79000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\NagScreen.pdb,, source: SlideshowMaker.exe, 00000001.00000003.1805981700.0000000003A16000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1805338785.00000000039B1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1810317163.0000000003B79000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\TrackerFactory.pdb source: SlideshowMaker.exe, 00000001.00000003.1800889302.0000000000995000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1799739278.0000000000911000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\GeneralMovaviTrackerWrapper.pdb source: SlideshowMaker.exe, 00000001.00000003.1835870589.000000000494D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1842263009.0000000004AFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1844762927.0000000004BD8000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1831421405.00000000048E1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1845596760.0000000004C11000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1846012651.0000000004C6A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1838380312.0000000004A77000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1843495827.0000000004B5B000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1846755210.0000000004CA7000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837223475.00000000049E9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\Threading.pdb!! source: SlideshowMaker.exe, 00000001.00000003.1835870589.000000000494D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1831421405.00000000048E1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837223475.00000000049E9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\AudioRendererSDL.pdb source: SlideshowMaker.exe, 00000001.00000003.1835870589.000000000494D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1842263009.0000000004AFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1844762927.0000000004BD8000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1831421405.00000000048E1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1838380312.0000000004A77000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1843495827.0000000004B5B000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837223475.00000000049E9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\MQtUi.pdbHH source: SlideshowMaker.exe, 00000001.00000003.1846910089.0000000005DAA000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\Converters.pdb source: SlideshowMaker.exe, 00000001.00000003.1835870589.000000000494D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1842263009.0000000004AFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1831421405.00000000048E1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1838380312.0000000004A77000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837223475.00000000049E9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\PackageInstallerModule.pdb source: SlideshowMaker.exe, 00000001.00000003.1830647359.0000000003C3E000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1805981700.0000000003A16000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1811248442.0000000003C2F000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1805338785.00000000039B1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1810317163.0000000003B79000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\WebBrowser.pdb source: SlideshowMaker.exe, 00000001.00000003.1805981700.0000000003A16000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1805338785.00000000039B1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1810317163.0000000003B79000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\PubSub.pdb!! source: SlideshowMaker.exe, 00000001.00000003.1847071702.0000000004D27000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1838380312.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1843495827.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1845596760.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\ASSWrapper.pdb!! source: SlideshowMaker.exe, 00000001.00000003.1835870589.000000000494D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1831421405.00000000048E1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837223475.00000000049E9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\VideoRendererOGLQt.pdb## source: SlideshowMaker.exe, 00000001.00000003.1835870589.000000000494D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1842263009.0000000004AFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1844762927.0000000004BD8000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1831421405.00000000048E1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1838380312.0000000004A77000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1843495827.0000000004B5B000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837223475.00000000049E9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: vcruntime140.i386.pdb source: SlideshowMaker.exe, 00000001.00000003.1799152520.000000000050F000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\MovaviIO.pdb source: SlideshowMaker.exe, 00000001.00000003.1805981700.0000000003A16000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1805338785.00000000039B1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\MediaTypes.pdb&& source: SlideshowMaker.exe, 00000001.00000003.1835870589.000000000494D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1831421405.00000000048E1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1838380312.0000000004A77000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837223475.00000000049E9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\GeneralMovaviTrackerWrapper.pdb## source: SlideshowMaker.exe, 00000001.00000003.1835870589.000000000494D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1842263009.0000000004AFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1844762927.0000000004BD8000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1831421405.00000000048E1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1845596760.0000000004C11000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1846012651.0000000004C6A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1838380312.0000000004A77000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1843495827.0000000004B5B000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1846755210.0000000004CA7000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837223475.00000000049E9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\PubSub.pdb source: SlideshowMaker.exe, 00000001.00000003.1847071702.0000000004D27000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1838380312.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1843495827.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1845596760.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\Presets.pdb!! source: SlideshowMaker.exe, 00000001.00000003.1843349509.0000000004AC8000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1835870589.000000000494D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1831421405.00000000048E1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1838380312.0000000004A77000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837223475.00000000049E9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\FFWrapper.pdb,,! source: SlideshowMaker.exe, 00000001.00000003.1830647359.0000000003C3E000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1805981700.0000000003A16000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1811248442.0000000003C2F000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1831122946.0000000003D18000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1805338785.00000000039B1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1830767493.0000000003CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1810317163.0000000003B79000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\MagnetizeTools.pdb%% source: SlideshowMaker.exe, 00000001.00000003.1848952863.0000000004DA3000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1847071702.0000000004D27000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1838380312.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1843495827.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1845596760.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1849128230.0000000004DBD000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\AppUtil.pdb source: SlideshowMaker.exe, 00000001.00000003.1805981700.0000000003A16000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1805338785.00000000039B1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1810317163.0000000003B79000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\UpdateChecker.pdb&& source: SlideshowMaker.exe, 00000001.00000003.1851648195.00000000009AE000.00000004.00000020.00020000.00000000.sdmp
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe File opened: C:\Users\user\AppData\Local\Temp\SPOON\CACHE\ Jump to behavior
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe File opened: C:\Users\user\AppData\Local\Temp\SPOON\ Jump to behavior
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe File opened: C:\Users\user\AppData\Local\Temp\ Jump to behavior
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe File opened: C:\Users\user\AppData\Local\ Jump to behavior
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe File opened: C:\Users\user\AppData\Local\Temp\SPOON\CACHE\0x34D1186B27098351\ Jump to behavior
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe File opened: C:\Users\user\ Jump to behavior
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: a795593605a13211941d44505b4d1e39
Source: Joe Sandbox View JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /get_nag.php?app=slideshowcreator&module=slideshowcreator&app_ver=4-1-0&partner=&app_mode=activated&lang=it&app_action=app_start&huid=4382b732c4891ce476ee93bd6ba3d93c6f2c1771&protocol=1&rnd=32718&os=win&act_key= HTTP/1.1Accept: */*Accept-Language: en-CHAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: mip2.movavi.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /get_nag.php?app=slideshowcreator&module=slideshowcreator&app_ver=4-1-0&partner=&app_mode=activated&lang=it&app_action=app_close&huid=4382b732c4891ce476ee93bd6ba3d93c6f2c1771&protocol=1&rnd=32711&os=win&act_key= HTTP/1.1Accept: */*Accept-Language: en-CHAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: mip2.movavi.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /api/v1/codec/all/?akey=&huid=4382b732c4891ce476ee93bd6ba3d93c6f2c1771 HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: codec-activate.movavi.com
Source: global traffic HTTP traffic detected: GET /get_nag.php?app=slideshowcreator&module=slideshowcreator&app_ver=4-1-0&partner=&app_mode=activated&lang=it&app_action=major_update&huid=4382b732c4891ce476ee93bd6ba3d93c6f2c1771&protocol=1&rnd=32718&os=win&act_key= HTTP/1.1Accept: */*Accept-Language: en-CHAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: mip2.movavi.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /get_nag.php?app=slideshowcreator&module=slideshowcreator&app_ver=4-1-0&partner=&app_mode=activated&lang=it&app_action=capture_screencast&huid=4382b732c4891ce476ee93bd6ba3d93c6f2c1771&protocol=1&rnd=32718&os=win&act_key= HTTP/1.1Accept: */*Accept-Language: en-CHAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: mip2.movavi.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /webnagscreens/crossale_suite/style.css HTTP/1.1Accept: */*Accept-Language: en-CHAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: img.movavi.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /webnagscreens/crossale_suite/it.png HTTP/1.1Accept: */*Accept-Language: en-CHAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: img.movavi.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /webnagscreens/crossale_suite/btn_close_it.png HTTP/1.1Accept: */*Accept-Language: en-CHAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: img.movavi.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /webnagscreens/crossale_suite/btn_buy_it.png HTTP/1.1Accept: */*Accept-Language: en-CHAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: img.movavi.comConnection: Keep-Alive
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic HTTP traffic detected: GET /get_nag.php?app=slideshowcreator&module=slideshowcreator&app_ver=4-1-0&partner=&app_mode=activated&lang=it&app_action=app_start&huid=4382b732c4891ce476ee93bd6ba3d93c6f2c1771&protocol=1&rnd=32718&os=win&act_key= HTTP/1.1Accept: */*Accept-Language: en-CHAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: mip2.movavi.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /get_nag.php?app=slideshowcreator&module=slideshowcreator&app_ver=4-1-0&partner=&app_mode=activated&lang=it&app_action=app_close&huid=4382b732c4891ce476ee93bd6ba3d93c6f2c1771&protocol=1&rnd=32711&os=win&act_key= HTTP/1.1Accept: */*Accept-Language: en-CHAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: mip2.movavi.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /api/v1/codec/all/?akey=&huid=4382b732c4891ce476ee93bd6ba3d93c6f2c1771 HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: codec-activate.movavi.com
Source: global traffic HTTP traffic detected: GET /get_nag.php?app=slideshowcreator&module=slideshowcreator&app_ver=4-1-0&partner=&app_mode=activated&lang=it&app_action=major_update&huid=4382b732c4891ce476ee93bd6ba3d93c6f2c1771&protocol=1&rnd=32718&os=win&act_key= HTTP/1.1Accept: */*Accept-Language: en-CHAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: mip2.movavi.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /get_nag.php?app=slideshowcreator&module=slideshowcreator&app_ver=4-1-0&partner=&app_mode=activated&lang=it&app_action=capture_screencast&huid=4382b732c4891ce476ee93bd6ba3d93c6f2c1771&protocol=1&rnd=32718&os=win&act_key= HTTP/1.1Accept: */*Accept-Language: en-CHAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: mip2.movavi.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /webnagscreens/crossale_suite/style.css HTTP/1.1Accept: */*Accept-Language: en-CHAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: img.movavi.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /webnagscreens/crossale_suite/it.png HTTP/1.1Accept: */*Accept-Language: en-CHAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: img.movavi.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /webnagscreens/crossale_suite/btn_close_it.png HTTP/1.1Accept: */*Accept-Language: en-CHAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: img.movavi.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /webnagscreens/crossale_suite/btn_buy_it.png HTTP/1.1Accept: */*Accept-Language: en-CHAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: img.movavi.comConnection: Keep-Alive
Source: SlideshowMaker.exe, 00000001.00000003.1804727013.0000000000F38000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: d04:7e:cb:e9:fc:a5:5f:7b:d0:9e:ae:36:e1:0c:ae:1email.google.comf5:c8:6a:f3:61:62:f1:3a:64:f5:4f:6d:c9:58:7c:06www.google.comd7:55:8f:da:f5:f1:10:5b:b2:13:28:2b:70:77:29:a3login.yahoo.com39:2a:43:4f:0e:07:df:1f:8a:a3:05:de:34:e0:c2:293e:75:ce:d4:6b:69:30:21:21:88:30:ae:86:a8:2a:71e9:02:8b:95:78:e4:15:dc:1a:71:0a:2b:88:15:44:47login.skype.com92:39:d5:34:8f:40:d1:69:5a:74:54:70:e1:f2:3f:43addons.mozilla.orgb0:b7:13:3e:d0:96:f9:b5:6f:ae:91:c8:74:bd:3a:c0login.live.comd8:f3:5f:4e:b7:87:2b:2d:ab:06:92:e3:15:38:2f:b0global trustee05:e2:e6:a4:cd:09:ea:54:d6:65:b0:75:fe:22:a2:56*.google.com0c:76:da:9c:91:0c:4e:2c:9e:fe:15:d0:58:93:3c:4cDigiNotar Root CAf1:4a:13:f4:87:2b:56:dc:39:df:84:ca:7a:a1:06:49DigiNotar Services CA36:16:71:55:43:42:1b:9d:e6:cb:a3:64:41:df:24:38DigiNotar Services 1024 CA0a:82:bd:1e:14:4e:88:14:d7:5b:1a:55:27:be:bf:3eDigiNotar Root CA G2a4:b6:ce:e3:2e:d3:35:46:26:3c:b3:55:3a:a8:92:21CertiID Enterprise Certificate Authority5b:d5:60:9c:64:17:68:cf:21:0e:35:fd:fb:05:ad:41DigiNotar Qualified CA46:9c:2c:b007:27:10:0dDigiNotar Cyber CA07:27:0f:f907:27:10:0301:31:69:b0DigiNotar PKIoverheid CA Overheid en Bedrijven01:31:34:bfDigiNotar PKIoverheid CA Organisatie - G2d6:d0:29:77:f1:49:fd:1a:83:f2:b9:ea:94:8c:5c:b4DigiNotar Extended Validation CA1e:7d:7a:53:3d:45:30:41:96:40:0f:71:48:1f:45:04DigiNotar Public CA 202546:9c:2c:af46:9c:3c:c907:27:14:a9Digisign Server ID (Enrich)4c:0e:63:6aDigisign Server ID - (Enrich)72:03:21:05:c5:0c:08:57:3d:8e:a5:30:4e:fe:e8:b0UTN-USERFirst-Hardware41MD5 Collisions Inc. (http://www.phreedom.org/md5)08:27*.EGO.GOV.TR08:64e-islem.kktcmerkezbankasi.org03:1d:a7AC DG Tr equals www.yahoo.com (Yahoo)
Source: SlideshowMaker.exe, 00000001.00000003.1830864474.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/auth/youtube.upload https://www.googleapis.com/auth/youtube https://www.googleapis.com/auth/userinfo.profile equals www.youtube.com (Youtube)
Source: SlideshowMaker.exe, 00000001.00000003.1864513012.000000000098D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/upload/youtube/v3/videos?uploadType=resumable&part=%1L3TXzVp equals www.youtube.com (Youtube)
Source: global traffic DNS traffic detected: DNS query: start.turbo.net
Source: global traffic DNS traffic detected: DNS query: mip2.movavi.com
Source: global traffic DNS traffic detected: DNS query: codec-activate.movavi.com
Source: global traffic DNS traffic detected: DNS query: img.movavi.com
Source: unknown HTTP traffic detected: POST /services/1.0/activity/vm-18.4.1281.0/run HTTP/1.1Spoon-ConfigId: 9D0F48FB-5A85-4D60-82CD-6B9F784D932BSpoon-ConfigDigest: dd217e68ba4377edc484768b4f73528bSpoon-BuildId: CFFB171A-E983-4234-BD47-C5170F552F60Spoon-MacDigest: C3F43D71F2ADABCC8BFCAAC51BBDEC9C71A3BF08Spoon-DeviceIp: 192.168.2.4Spoon-TrialProduct: TrueSpoon-StartupFile: @APPDATA@\Movavi Slideshow Maker 4\SlideshowMaker.exeUser-Agent: SpoonVm/1.0Host: start.turbo.netContent-Length: 0Cache-Control: no-cache
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 25 Oct 2024 08:04:55 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingCache-Control: no-cache, privateX-Error-Ex: Not found nagscreens from DBX-XSS-Protection: 0X-Frame-Options: SAMEORIGINReferrer-Policy: strict-origin-when-cross-origin
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 25 Oct 2024 08:04:57 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingCache-Control: no-cache, privateX-Error-Ex: Not found nagscreens from DBX-XSS-Protection: 0X-Frame-Options: SAMEORIGINReferrer-Policy: strict-origin-when-cross-origin
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 25 Oct 2024 08:04:57 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingCache-Control: no-cache, privateX-Error-Ex: Not found nagscreens from DBX-XSS-Protection: 0X-Frame-Options: SAMEORIGINReferrer-Policy: strict-origin-when-cross-origin
Source: SlideshowMaker.exe, 00000001.00000003.1849128230.0000000004DBD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://activate.movavi.com/activate3.php?pname=-APP_NAME-&hwid=-HARDWAREID-&akey=-APP_KEY-&version=-
Source: SlideshowMaker.exe, 00000001.00000003.1807328586.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837801545.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852178597.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1806580685.0000000000A65000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1830864474.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://activate.movavi.com/activateapple.php?pname=-APP_NAME-&hwid=-HARDWAREID-&akey=-APP_KEY-&versi
Source: SlideshowMaker.exe, 00000001.00000003.1804727013.0000000000F38000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://bugreports.qt.io/
Source: SlideshowMaker.exe, 00000001.00000003.1804727013.0000000000F38000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://bugreports.qt.io/finishedServerMicrosoft-IIS/4.Microsoft-IIS/5.Netscape-Enterprise/3.WebLogic
Source: SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://codec-activate.movavi.com/api/v1/codec/activate/?akey=-LICENSE_KEY-&huid=-HASH_USER_ID-&codec
Source: SlideshowMaker.exe, 00000001.00000003.1851648195.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1858805983.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837801545.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852178597.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1830864474.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://codec-activate.movavi.com/api/v1/codec/all/?akey=-LICENSE_KEY-&huid=-HASH_USER_ID-
Source: Movavi Slideshow Maker 4.exe, 00000000.00000002.2950690600.0000000000BC0000.00000040.00001000.00020000.00000000.sdmp, Movavi Slideshow Maker 4.exe, 00000000.00000003.1705001688.0000000000747000.00000004.00000020.00020000.00000000.sdmp, Movavi Slideshow Maker 4.exe, 00000000.00000002.2950155746.0000000000BB2000.00000004.00001000.00020000.00000000.sdmp, Movavi Slideshow Maker 4.exe, 00000000.00000003.1705001688.00000000006DA000.00000004.00000020.00020000.00000000.sdmp, Movavi Slideshow Maker 4.exe, 00000000.00000002.2949192490.0000000000747000.00000004.00000020.00020000.00000000.sdmp, Movavi Slideshow Maker 4.exe, 00000000.00000002.2950155746.0000000000870000.00000004.00001000.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1742216462.0000000001558000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
Source: Movavi Slideshow Maker 4.exe, 00000000.00000002.2950690600.0000000000BC0000.00000040.00001000.00020000.00000000.sdmp, Movavi Slideshow Maker 4.exe, 00000000.00000003.1705001688.0000000000747000.00000004.00000020.00020000.00000000.sdmp, Movavi Slideshow Maker 4.exe, 00000000.00000002.2950155746.0000000000BB2000.00000004.00001000.00020000.00000000.sdmp, Movavi Slideshow Maker 4.exe, 00000000.00000003.1705001688.00000000006DA000.00000004.00000020.00020000.00000000.sdmp, Movavi Slideshow Maker 4.exe, 00000000.00000002.2949192490.0000000000747000.00000004.00000020.00020000.00000000.sdmp, Movavi Slideshow Maker 4.exe, 00000000.00000002.2950155746.0000000000870000.00000004.00001000.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1742216462.0000000001558000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/COMODORSACodeSigningCA.crl0t
Source: SlideshowMaker.exe, 00000001.00000003.1800492043.00000000009AE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1799739278.0000000000911000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://files.movavi.com/dl/support/DevicesList
Source: SlideshowMaker.exe, 00000001.00000003.1800492043.00000000009AE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1799739278.0000000000911000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://files.movavi.com/dl/support/DevicesListOglManager::GetOglVersion()
Source: SlideshowMaker.exe, 00000001.00000003.1800492043.00000000009AE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1799739278.0000000000911000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://files.movavi.com/dl/support/opengl32software.zip
Source: SlideshowMaker.exe, 00000001.00000003.1800492043.00000000009AE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1799739278.0000000000911000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://files.movavi.com/dl/support/opengl32software.zipOpenglSwitcher.exedll.dllDownloading
Source: SlideshowMaker.exe, 00000001.00000003.1851648195.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1858805983.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837801545.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852178597.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1830864474.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://img.movavi.com/changelog/slideshowcreator/-LANG-/changelog
Source: SlideshowMaker.exe, 00000001.00000003.1837801545.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852178597.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1830864474.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://img.movavi.com/changelog/slideshowcreator/-LANG-/changelogrl0
Source: SlideshowMaker.exe, 00000001.00000003.1851648195.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1858805983.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837801545.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852178597.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1830864474.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://img.movavi.com/changelog/slideshowcreator/-LANG-/pkginfo
Source: SlideshowMaker.exe, 00000001.00000003.1851648195.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1858805983.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.mo
Source: SlideshowMaker.exe, 00000001.00000003.1851648195.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1858805983.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.mova
Source: SlideshowMaker.exe, 00000001.00000003.1851648195.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1858805983.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.moval
Source: SlideshowMaker.exe, 00000001.00000003.1851648195.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1858805983.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.co
Source: SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1830864474.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com
Source: SlideshowMaker.exe, 00000001.00000003.1851648195.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1858805983.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/-TAIL_WITH_ARGS-
Source: SlideshowMaker.exe, 00000001.00000003.1851648195.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1858805983.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837801545.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852178597.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1830864474.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/?asrc=menu&-TAIL_WITH_ARGS-
Source: SlideshowMaker.exe, 00000001.00000003.1837801545.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852178597.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1830864474.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/?asrc=menu&-TAIL_WITH_ARGS-TH_ARGS-0
Source: SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/?asrc=menu&-TAIL_WITH_ARGS-avi.com/support/activating_packages/?asrc=package
Source: SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1830864474.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/?asrc=menuabout&-TAIL_WITH_ARGS-
Source: SlideshowMaker.exe, 00000001.00000003.1837801545.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852178597.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1830864474.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/?asrc=menuabout&-TAIL_WITH_ARGS-RGS--P
Source: SlideshowMaker.exe, 00000001.00000003.1851648195.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1858805983.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837801545.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852178597.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1830864474.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/?asrc=socialtab&-TAIL_WITH_ARGS-
Source: SlideshowMaker.exe, 00000001.00000003.1837801545.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852178597.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1830864474.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/?asrc=socialtab&-TAIL_WITH_ARGS-RGS-;
Source: SlideshowMaker.exe, 00000001.00000003.1851648195.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1858805983.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/audioblocks/?asrc=other_i
Source: SlideshowMaker.exe, 00000001.00000003.1851648195.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1858805983.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837801545.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1835870589.000000000494D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1842263009.0000000004AFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852178597.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1844762927.0000000004BD8000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1831421405.00000000048E1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1845596760.0000000004C11000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1846012651.0000000004C6A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1838380312.0000000004A77000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1843495827.0000000004B5B000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1846755210.0000000004CA7000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1830864474.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837223475.00000000049E9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/audioblocks/?asrc=other_import&-TAIL_WITH_ARGS-
Source: SlideshowMaker.exe, 00000001.00000003.1837801545.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852178597.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1830864474.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/audioblocks/?asrc=other_import&-TAIL_WITH_ARGS-PSM
Source: SlideshowMaker.exe, 00000001.00000003.1851648195.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1858805983.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837801545.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1835870589.000000000494D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1842263009.0000000004AFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852178597.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1844762927.0000000004BD8000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1831421405.00000000048E1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1845596760.0000000004C11000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1846012651.0000000004C6A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1838380312.0000000004A77000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1843495827.0000000004B5B000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1846755210.0000000004CA7000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1830864474.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837223475.00000000049E9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/buy-suitefromslideshow/?asrc=crossnag_sc_vs&-TAIL_WITH_ARGS-
Source: SlideshowMaker.exe, 00000001.00000003.1851648195.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1858805983.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/buynow/?as
Source: SlideshowMaker.exe, 00000001.00000003.1851648195.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1858805983.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/buynow/?asrc
Source: SlideshowMaker.exe, 00000001.00000003.1851648195.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1858805983.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837801545.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852178597.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1830864474.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/buynow/?asrc=activationwizard&-TAIL_WITH_ARGS-
Source: SlideshowMaker.exe, 00000001.00000003.1837801545.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852178597.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1830864474.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/buynow/?asrc=activationwizard&-TAIL_WITH_ARGS-antec.comr
Source: SlideshowMaker.exe, 00000001.00000003.1851648195.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1858805983.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837801545.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852178597.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1830864474.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/buynow/?asrc=firststart&-TAIL_WITH_ARGS-
Source: SlideshowMaker.exe, 00000001.00000003.1837801545.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852178597.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1830864474.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/buynow/?asrc=firststart&-TAIL_WITH_ARGS-ROFILE=
Source: SlideshowMaker.exe, 00000001.00000003.1851648195.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1858805983.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837801545.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852178597.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1830864474.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/buynow/?asrc=menu&-TAIL_WITH_ARGS-
Source: SlideshowMaker.exe, 00000001.00000003.1837801545.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852178597.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1830864474.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/buynow/?asrc=menu&-TAIL_WITH_ARGS-=
Source: SlideshowMaker.exe, 00000001.00000003.1851648195.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1858805983.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837801545.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1835870589.000000000494D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1842263009.0000000004AFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852178597.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1844762927.0000000004BD8000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1831421405.00000000048E1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1845596760.0000000004C11000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1846012651.0000000004C6A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1838380312.0000000004A77000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1843495827.0000000004B5B000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1846755210.0000000004CA7000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1830864474.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837223475.00000000049E9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/buynow/?asrc=nagexport&-TAIL_WITH_ARGS-
Source: SlideshowMaker.exe, 00000001.00000003.1851648195.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1858805983.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837801545.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852178597.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1830864474.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/buynow/?asrc=nagtrial&-TAIL_WITH_ARGS-
Source: SlideshowMaker.exe, 00000001.00000003.1851648195.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1858805983.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837801545.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852178597.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1830864474.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/buynow/?asrc=nagtrialend&-TAIL_WITH_ARGS-
Source: SlideshowMaker.exe, 00000001.00000003.1837801545.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852178597.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1830864474.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/buynow/?asrc=nagtrialend&-TAIL_WITH_ARGS-0
Source: SlideshowMaker.exe, 00000001.00000003.1851648195.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1858805983.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837801545.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852178597.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1830864474.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/buynow/?asrc=nagtrialstart&-TAIL_WITH_ARGS-
Source: SlideshowMaker.exe, 00000001.00000003.1851648195.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1858805983.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837801545.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852178597.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1830864474.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/buynow/?asrc=nagtrialstartconversion&-TAIL_WITH_ARGS-
Source: SlideshowMaker.exe, 00000001.00000003.1851648195.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1858805983.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837801545.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1835870589.000000000494D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1842263009.0000000004AFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852178597.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1844762927.0000000004BD8000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1831421405.00000000048E1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1845596760.0000000004C11000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1846012651.0000000004C6A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1838380312.0000000004A77000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1843495827.0000000004B5B000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1846755210.0000000004CA7000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1830864474.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837223475.00000000049E9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/buynow/?asrc=newprojectdialog&-TAIL_WITH_ARGS-
Source: SlideshowMaker.exe, 00000001.00000003.1837801545.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852178597.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1830864474.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/buynow/?asrc=newprojectdialog&-TAIL_WITH_ARGS-es=1
Source: SlideshowMaker.exe, 00000001.00000003.1851648195.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1858805983.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837801545.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852178597.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1830864474.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/buynow/?asrc=se&-TAIL_WITH_ARGS-
Source: SlideshowMaker.exe, 00000001.00000003.1837801545.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852178597.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1830864474.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/buynow/?asrc=se&-TAIL_WITH_ARGS-_ARGS-s
Source: SlideshowMaker.exe, 00000001.00000003.1851648195.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1858805983.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837801545.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1835870589.000000000494D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1842263009.0000000004AFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852178597.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1844762927.0000000004BD8000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1831421405.00000000048E1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1845596760.0000000004C11000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1846012651.0000000004C6A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1838380312.0000000004A77000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1843495827.0000000004B5B000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1846755210.0000000004CA7000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1830864474.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837223475.00000000049E9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/buynow/?asrc=webnagtrial&-TAIL_WITH_ARGS-
Source: SlideshowMaker.exe, 00000001.00000003.1837801545.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852178597.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1830864474.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/buynow/?asrc=webnagtrial&-TAIL_WITH_ARGS-Root=C:
Source: SlideshowMaker.exe, 00000001.00000003.1837801545.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852178597.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1830864474.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/buynow/?asrc=webnagtrial&-TAIL_WITH_ARGS-ones
Source: SlideshowMaker.exe, 00000001.00000003.1851648195.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1858805983.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837801545.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1835870589.000000000494D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1842263009.0000000004AFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852178597.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1844762927.0000000004BD8000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1831421405.00000000048E1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1845596760.0000000004C11000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1846012651.0000000004C6A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1838380312.0000000004A77000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1843495827.0000000004B5B000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1846755210.0000000004CA7000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1830864474.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837223475.00000000049E9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/dlc/?asrc=&-TAIL_WITH_ARGS-
Source: SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/download/?asrc=checkupdatest&-TAIL_WITH_ARGS-
Source: SlideshowMaker.exe, 00000001.00000003.1851648195.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1858805983.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/download/?asrc=checkupdatest&-TAIL_WITH_ARGS-E_URL=http&X7
Source: SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/drivers-update/?asrc=other&-TAIL_WITH_ARGS-
Source: SlideshowMaker.exe, 00000001.00000003.1851648195.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1858805983.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/drivers-update/?asrc=other&-TAIL_WITH_ARGS-gs&-TAIL_WIT
Source: SlideshowMaker.exe, 00000001.00000003.1851648195.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1858805983.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837801545.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852178597.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1830864474.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/facebook/?asrc=menu&-TAIL_WITH_ARGS-
Source: SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/facebook/?asrc=socialtab&-TAIL_WITH_ARGS-
Source: SlideshowMaker.exe, 00000001.00000003.1851648195.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1858805983.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837801545.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852178597.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1830864474.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/faq/?asrc=menu&-TAIL_WITH_ARGS-
Source: SlideshowMaker.exe, 00000001.00000003.1837801545.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852178597.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1830864474.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/faq/?asrc=menu&-TAIL_WITH_ARGS-x4
Source: SlideshowMaker.exe, 00000001.00000003.1851648195.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1858805983.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837801545.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852178597.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1830864474.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/forum/?asrc=menu&-TAIL_WITH_ARGS-
Source: SlideshowMaker.exe, 00000001.00000003.1837801545.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852178597.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1830864474.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/forum/?asrc=menu&-TAIL_WITH_ARGS-RGS-5T
Source: SlideshowMaker.exe, 00000001.00000003.1851648195.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1858805983.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837801545.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852178597.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1830864474.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/forum/?asrc=socialtab&-TAIL_WITH_ARGS-
Source: SlideshowMaker.exe, 00000001.00000003.1837801545.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852178597.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1830864474.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/forum/?asrc=socialtab&-TAIL_WITH_ARGS-6O
Source: SlideshowMaker.exe, 00000001.00000003.1851648195.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1858805983.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837801545.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852178597.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1830864474.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/googleplus/?asrc=menu&-TAIL_WITH_ARGS-
Source: SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/googleplus/?asrc=socialtab&-TAIL_WITH_ARGS-
Source: SlideshowMaker.exe, 00000001.00000003.1851648195.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1858805983.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/googleplus/?asrc=socialtab&-TAIL_WITH_ARGS-ocialtab&-T
Source: SlideshowMaker.exe, 00000001.00000003.1851648195.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1858805983.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/gr
Source: SlideshowMaker.exe, 00000001.00000003.1851648195.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1858805983.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/grD_
Source: SlideshowMaker.exe, 00000001.00000003.1851648195.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1858805983.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837801545.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1835870589.000000000494D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1842263009.0000000004AFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852178597.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1844762927.0000000004BD8000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1831421405.00000000048E1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1845596760.0000000004C11000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1846012651.0000000004C6A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1838380312.0000000004A77000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1843495827.0000000004B5B000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1846755210.0000000004CA7000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1830864474.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837223475.00000000049E9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/graphicstock/?asrc=other_import&-TAIL_WITH_ARGS-
Source: SlideshowMaker.exe, 00000001.00000003.1837801545.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852178597.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1830864474.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/graphicstock/?asrc=other_import&-TAIL_WITH_ARGS-owe
Source: SlideshowMaker.exe, 00000001.00000003.1851648195.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1858805983.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837801545.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852178597.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1830864474.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/help/?asrc=menu&-TAIL_WITH_ARGS-
Source: SlideshowMaker.exe, 00000001.00000003.1837801545.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852178597.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1830864474.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/help/?asrc=menu&-TAIL_WITH_ARGS-RGS-
Source: SlideshowMaker.exe, 00000001.00000003.1851648195.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1858805983.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837801545.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1835870589.000000000494D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1842263009.0000000004AFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852178597.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1844762927.0000000004BD8000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1831421405.00000000048E1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1845596760.0000000004C11000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1846012651.0000000004C6A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1838380312.0000000004A77000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1843495827.0000000004B5B000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1846755210.0000000004CA7000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1830864474.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837223475.00000000049E9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/help/?asrc=newprojectdialog&-TAIL_WITH_ARGS-
Source: SlideshowMaker.exe, 00000001.00000003.1837801545.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852178597.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1830864474.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/help/?asrc=newprojectdialog&-TAIL_WITH_ARGS-_ARGS-Po
Source: SlideshowMaker.exe, 00000001.00000003.1851648195.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1858805983.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837801545.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1835870589.000000000494D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1842263009.0000000004AFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852178597.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1844762927.0000000004BD8000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1831421405.00000000048E1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1845596760.0000000004C11000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1846012651.0000000004C6A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1838380312.0000000004A77000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1843495827.0000000004B5B000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1846755210.0000000004CA7000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1830864474.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837223475.00000000049E9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/help_wizard/?asrc=newprojectdialog&-TAIL_WITH_ARGS-
Source: SlideshowMaker.exe, 00000001.00000003.1837801545.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852178597.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1830864474.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/help_wizard/?asrc=newprojectdialog&-TAIL_WITH_ARGS-=C
Source: SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/instagram/
Source: SlideshowMaker.exe, 00000001.00000003.1851648195.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1858805983.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837801545.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852178597.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1830864474.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/instagram/?asrc=menu&-TAIL_WITH_ARGS-
Source: SlideshowMaker.exe, 00000001.00000003.1837801545.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852178597.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1830864474.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/instagram/?asrc=menu&-TAIL_WITH_ARGS-o
Source: SlideshowMaker.exe, 00000001.00000003.1851648195.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1858805983.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837801545.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852178597.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1830864474.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/instagram/?asrc=socialtab&-TAIL_WITH_ARGS-
Source: SlideshowMaker.exe, 00000001.00000003.1837801545.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852178597.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1830864474.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/instagram/?asrc=socialtab&-TAIL_WITH_ARGS-cSESS
Source: SlideshowMaker.exe, 00000001.00000003.1830864474.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/intel/?asrc=settings&-TAIL_WITH_ARGS-
Source: SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/l
Source: SlideshowMaker.exe, 00000001.00000003.1851648195.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1858805983.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/livechat/?as
Source: SlideshowMaker.exe, 00000001.00000003.1851648195.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1858805983.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837801545.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852178597.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1830864474.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/livechat/?asrc=menu&-TAIL_WITH_ARGS-
Source: SlideshowMaker.exe, 00000001.00000003.1837801545.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852178597.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1830864474.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/livechat/?asrc=menu&-TAIL_WITH_ARGS-8a8Y
Source: SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1846012651.0000000004C6A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1838380312.0000000004A77000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1843495827.0000000004B5B000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1846755210.0000000004CA7000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1830864474.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837223475.00000000049E9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/livechat/?asrc=nagexport&-TAIL_WITH_ARGS-
Source: SlideshowMaker.exe, 00000001.00000003.1851648195.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1858805983.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/livechat/?asrc=nagexport&-TAIL_WITH_ARGS-ITH_ARGS-
Source: SlideshowMaker.exe, 00000001.00000003.1837801545.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852178597.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1830864474.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/livechat/?asrc=nagexport&-TAIL_WITH_ARGS-_ARGS-86)
Source: SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/livechat/?asrc=nagtrial&-TAIL_WITH_ARGS-
Source: SlideshowMaker.exe, 00000001.00000003.1851648195.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1858805983.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/livechat/?asrc=nagtrial&-TAIL_WITH_ARGS-TAIL_WITH_ARGSuZ
Source: SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/livechat/?asrc=nagtrialend&-TAIL_WITH_ARGS-
Source: SlideshowMaker.exe, 00000001.00000003.1851648195.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1858805983.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/livechat/?asrc=nagtrialend&-TAIL_WITH_ARGS-tab&-TAIL_W
Source: SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1830864474.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/livechat/?asrc=nagtrialstart&-TAIL_WITH_ARGS-
Source: SlideshowMaker.exe, 00000001.00000003.1851648195.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1858805983.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/livechat/?asrc=nagtrialstart&-TAIL_WITH_ARGS--LANG--AMP
Source: SlideshowMaker.exe, 00000001.00000003.1830864474.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/livechat/?asrc=nagtrialstart&-TAIL_WITH_ARGS-on&-TAIL_WITH_ARGS-nh
Source: SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/livechat/?asrc=nagtrialstartconversion&-TAIL_WITH_ARGS-
Source: SlideshowMaker.exe, 00000001.00000003.1851648195.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1858805983.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837801545.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852178597.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1830864474.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/livechat/?asrc=other&-TAIL_WITH_ARGS-
Source: SlideshowMaker.exe, 00000001.00000003.1837801545.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852178597.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1830864474.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/livechat/?asrc=other&-TAIL_WITH_ARGS--K
Source: SlideshowMaker.exe, 00000001.00000003.1851648195.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1858805983.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/livechat/?asrc=other&-TAIL_WITH_ARGS-entzres.dll.mui
Source: SlideshowMaker.exe, 00000001.00000003.1851648195.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1858805983.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/livechat/?asrc=webnagtri
Source: SlideshowMaker.exe, 00000001.00000003.1851648195.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1858805983.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/livechat/?asrc=webnagtri4
Source: SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1846012651.0000000004C6A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1838380312.0000000004A77000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1843495827.0000000004B5B000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1846755210.0000000004CA7000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1830864474.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837223475.00000000049E9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/livechat/?asrc=webnagtrial&-TAIL_WITH_ARGS-
Source: SlideshowMaker.exe, 00000001.00000003.1837801545.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852178597.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1830864474.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/livechat/?asrc=webnagtrial&-TAIL_WITH_ARGS-RGS-gwz
Source: SlideshowMaker.exe, 00000001.00000003.1851648195.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1858805983.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/livechat/?asrc=webnagtrial&-TAIL_WITH_ARGS-d=%2&activatk
Source: SlideshowMaker.exe, 00000001.00000003.1851648195.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1858805983.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837801545.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852178597.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1830864474.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/nvidia/?asrc=settings&-TAIL_WITH_ARGS-
Source: SlideshowMaker.exe, 00000001.00000003.1837801545.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852178597.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1830864474.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/nvidia/?asrc=settings&-TAIL_WITH_ARGS-0
Source: SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/odnok
Source: SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/odnoklassniki/?asrc=menu&-TAIL_WITH_ARGS-
Source: SlideshowMaker.exe, 00000001.00000003.1851648195.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1858805983.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/odnoklassniki/?asrc=menu&-TAIL_WITH_ARGS-RGS-
Source: SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/odnoklassniki/?asrc=socialtab&-TAIL_WITH_ARGS-
Source: SlideshowMaker.exe, 00000001.00000003.1851648195.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1858805983.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/odnoklassniki/?asrc=socialtab&-TAIL_WITH_ARGS-W
Source: SlideshowMaker.exe, 00000001.00000003.1851648195.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1858805983.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837801545.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852178597.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1830864474.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/offer-get-more/?asrc=menu&-TAIL_WITH_ARGS-
Source: SlideshowMaker.exe, 00000001.00000003.1837801545.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852178597.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1830864474.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/offer-get-more/?asrc=menu&-TAIL_WITH_ARGS-empUS
Source: SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/support/activating_packages/?asrc=packageinstallationwizard&-TAIL_WITH_ARGS-
Source: SlideshowMaker.exe, 00000001.00000003.1851648195.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1858805983.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837801545.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852178597.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1830864474.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/support/activation_offline/?asrc=activationwizard&-TAIL_WITH_ARGS-
Source: SlideshowMaker.exe, 00000001.00000003.1851648195.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1858805983.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837801545.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852178597.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1830864474.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/support/activation_online/?asrc=activationwizard&-TAIL_WITH_ARGS-
Source: SlideshowMaker.exe, 00000001.00000003.1837801545.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852178597.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1830864474.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/support/activation_online/?asrc=activationwizard&-TAIL_WITH_ARGS-GS-A
Source: SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/support/contact/?asrc=menu&-TAIL_WITH_ARGS-
Source: SlideshowMaker.exe, 00000001.00000003.1851648195.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1858805983.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/support/contact/?asrc=menu&-TAIL_WITH_ARGS-S-
Source: SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/thank_you_for_install/?app=-APP_NAM
Source: SlideshowMaker.exe, 00000001.00000003.1851648195.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/thank_you_for_install/?app=-APP_NAME--AMP-module=-MODULE_NAME--AMP-versi
Source: SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/thank_you_for_install/?app=-APP_NAME--AMP-module=-MODULE_NAME--AMP-version=-
Source: SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/thank_you_for_install/?app=-APP_NAME--AMP-version=-APP_VERSION--AMP-isTrial=
Source: SlideshowMaker.exe, 00000001.00000003.1851648195.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1858805983.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837801545.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852178597.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1830864474.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/upgrade--LICENSE_KEY-/?asrc=checkupdatest&-TAIL_WITH_ARGS-
Source: SlideshowMaker.exe, 00000001.00000003.1837801545.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852178597.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1830864474.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/upgrade--LICENSE_KEY-/?asrc=checkupdatest&-TAIL_WITH_ARGS-ARGS-GS-er
Source: SlideshowMaker.exe, 00000001.00000003.1851648195.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1858805983.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837801545.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1835870589.000000000494D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1842263009.0000000004AFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852178597.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1844762927.0000000004BD8000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1831421405.00000000048E1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1845596760.0000000004C11000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1846012651.0000000004C6A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1838380312.0000000004A77000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1843495827.0000000004B5B000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1846755210.0000000004CA7000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1830864474.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837223475.00000000049E9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/videoblocks/?asrc=other_import&-TAIL_WITH_ARGS-
Source: SlideshowMaker.exe, 00000001.00000003.1837801545.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852178597.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1830864474.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/videoblocks/?asrc=other_import&-TAIL_WITH_ARGS--0j
Source: SlideshowMaker.exe, 00000001.00000003.1851648195.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/videoblocks/?asrc=other_import&-TAIL_WITH_ARGS-er
Source: SlideshowMaker.exe, 00000001.00000003.1851648195.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1858805983.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837801545.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1835870589.000000000494D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1842263009.0000000004AFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852178597.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1844762927.0000000004BD8000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1831421405.00000000048E1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1845596760.0000000004C11000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1846012651.0000000004C6A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1838380312.0000000004A77000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1843495827.0000000004B5B000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1846755210.0000000004CA7000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1830864474.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837223475.00000000049E9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/videoeditordlc/?asrc=callouts_store&-TAIL_WITH_ARGS-
Source: SlideshowMaker.exe, 00000001.00000003.1837801545.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852178597.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1830864474.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/videoeditordlc/?asrc=callouts_store&-TAIL_WITH_ARGS-sym
Source: SlideshowMaker.exe, 00000001.00000003.1851648195.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1858805983.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837801545.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1835870589.000000000494D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1842263009.0000000004AFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852178597.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1844762927.0000000004BD8000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1831421405.00000000048E1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1845596760.0000000004C11000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1846012651.0000000004C6A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1838380312.0000000004A77000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1843495827.0000000004B5B000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1846755210.0000000004CA7000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1830864474.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837223475.00000000049E9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/videoeditordlc/?asrc=filters_store&-TAIL_WITH_ARGS-
Source: SlideshowMaker.exe, 00000001.00000003.1837801545.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852178597.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1830864474.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/videoeditordlc/?asrc=filters_store&-TAIL_WITH_ARGS-ER
Source: SlideshowMaker.exe, 00000001.00000003.1851648195.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1858805983.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837801545.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1835870589.000000000494D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1842263009.0000000004AFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852178597.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1844762927.0000000004BD8000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1831421405.00000000048E1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1845596760.0000000004C11000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1846012651.0000000004C6A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1838380312.0000000004A77000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1843495827.0000000004B5B000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1846755210.0000000004CA7000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1830864474.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837223475.00000000049E9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/videoeditordlc/?asrc=menu&-TAIL_WITH_ARGS-
Source: SlideshowMaker.exe, 00000001.00000003.1851648195.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1858805983.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837801545.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1835870589.000000000494D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1842263009.0000000004AFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852178597.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1844762927.0000000004BD8000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1831421405.00000000048E1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1845596760.0000000004C11000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1846012651.0000000004C6A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1838380312.0000000004A77000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1843495827.0000000004B5B000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1846755210.0000000004CA7000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1830864474.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837223475.00000000049E9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/videoeditordlc/?asrc=stickers_store&-TAIL_WITH_ARGS-
Source: SlideshowMaker.exe, 00000001.00000003.1837801545.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852178597.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1830864474.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/videoeditordlc/?asrc=stickers_store&-TAIL_WITH_ARGS-s
Source: SlideshowMaker.exe, 00000001.00000003.1830864474.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837223475.00000000049E9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/videoeditordlc/?asrc=titles_store&-TAIL_WITH_ARGS-
Source: SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/videoeditordlc/?asrc=titles_store&-TAIL_WITH_ARGS-ITH_ARGS-ITH
Source: SlideshowMaker.exe, 00000001.00000003.1851648195.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1858805983.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837801545.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1835870589.000000000494D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1842263009.0000000004AFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852178597.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1844762927.0000000004BD8000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1831421405.00000000048E1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1845596760.0000000004C11000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1846012651.0000000004C6A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1838380312.0000000004A77000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1843495827.0000000004B5B000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1846755210.0000000004CA7000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1830864474.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837223475.00000000049E9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/videoeditordlc/?asrc=transitions_store&-TAIL_WITH_ARGS-
Source: SlideshowMaker.exe, 00000001.00000003.1851648195.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1858805983.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837801545.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852178597.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1830864474.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/vkontakte/?asrc=menu&-TAIL_WITH_ARGS-
Source: SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/vkontakte/?asrc=socialtab&-TAIL_WITH_ARGS-
Source: SlideshowMaker.exe, 00000001.00000003.1851648195.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1858805983.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837801545.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852178597.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1830864474.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/youtube/?asrc=menu&-TAIL_WITH_ARGS-
Source: SlideshowMaker.exe, 00000001.00000003.1837801545.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852178597.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1830864474.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/youtube/?asrc=menu&-TAIL_WITH_ARGS-?2N2j
Source: SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1830864474.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/youtube/?asrc=socialtab&-TAIL_WITH_ARGS-
Source: SlideshowMaker.exe, 00000001.00000003.1830864474.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/youtube/?asrc=socialtab&-TAIL_WITH_ARGS--WITH_ARGS--
Source: SlideshowMaker.exe, 00000001.00000003.1837801545.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852178597.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1830864474.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/youtube/?asrc=socialtab&-TAIL_WITH_ARGS--WITH_ARGS-z
Source: SlideshowMaker.exe, 00000001.00000003.1837801545.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852178597.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1830864474.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com/youtube/?asrc=socialtab&-TAIL_WITH_ARGS--ialtab&-TAILU
Source: SlideshowMaker.exe, 00000001.00000003.1837801545.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852178597.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1830864474.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://links.movavi.com4
Source: SlideshowMaker.exe, 00000001.00000003.1807067664.0000000003D70000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1811248442.0000000003D70000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1831966818.0000000003D7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1830647359.0000000003D70000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1810582792.0000000003D70000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1806284873.0000000003D70000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://mingw-w64.sourceforge.net/X
Source: Movavi Slideshow Maker 4.exe, 00000000.00000002.2950690600.0000000000BC0000.00000040.00001000.00020000.00000000.sdmp, Movavi Slideshow Maker 4.exe, 00000000.00000003.1705001688.0000000000747000.00000004.00000020.00020000.00000000.sdmp, Movavi Slideshow Maker 4.exe, 00000000.00000002.2950155746.0000000000BB2000.00000004.00001000.00020000.00000000.sdmp, Movavi Slideshow Maker 4.exe, 00000000.00000003.1705001688.00000000006DA000.00000004.00000020.00020000.00000000.sdmp, Movavi Slideshow Maker 4.exe, 00000000.00000002.2949192490.0000000000747000.00000004.00000020.00020000.00000000.sdmp, Movavi Slideshow Maker 4.exe, 00000000.00000002.2950155746.0000000000870000.00000004.00001000.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1742216462.0000000001558000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0
Source: SlideshowMaker.exe, 00000001.00000003.1830647359.0000000003C3E000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1805981700.0000000003A16000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1811248442.0000000003C2F000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1805338785.00000000039B1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1810317163.0000000003B79000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://qt-project.org/xml/features/report-start-end-entity
Source: SlideshowMaker.exe, 00000001.00000003.1830647359.0000000003C3E000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1805981700.0000000003A16000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1811248442.0000000003C2F000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1805338785.00000000039B1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1810317163.0000000003B79000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://qt-project.org/xml/features/report-whitespace-only-CharData
Source: SlideshowMaker.exe, 00000001.00000003.1852726832.0000000003D9E000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1858754735.0000000003D9E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://rh.symcb.c
Source: Movavi Slideshow Maker 4.exe, 00000000.00000002.2948220868.0000000000199000.00000004.00000010.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848952863.0000000004DA3000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1851648195.00000000009AE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1831044187.0000000004736000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1800492043.00000000009AE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1849592510.0000000004ECE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1807328586.0000000000AE9000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1804822306.000000000117F000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1807328586.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1843349509.0000000004AC8000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1847071702.0000000004D27000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1833317656.00000000053A7000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1806694060.0000000003A66000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1835870589.000000000494D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1842263009.0000000004AFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1807067664.0000000003D70000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1858983421.000000000667F000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1811248442.0000000003D70000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1806580685.0000000000A65000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852726832.0000000003D9E000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1845946358.0000000003DA8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://rh.symcb.com/rh.crl0
Source: Movavi Slideshow Maker 4.exe, 00000000.00000002.2948220868.0000000000199000.00000004.00000010.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848952863.0000000004DA3000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1851648195.00000000009AE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1831044187.0000000004736000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1800492043.00000000009AE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1849592510.0000000004ECE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1807328586.0000000000AE9000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1804822306.000000000117F000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1807328586.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1843349509.0000000004AC8000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1847071702.0000000004D27000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1833317656.00000000053A7000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1806694060.0000000003A66000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1835870589.000000000494D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1842263009.0000000004AFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1807067664.0000000003D70000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1858983421.000000000667F000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1811248442.0000000003D70000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1806580685.0000000000A65000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1845946358.0000000003DA8000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1844762927.0000000004BD8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://rh.symcb.com/rh.crt0
Source: Movavi Slideshow Maker 4.exe, 00000000.00000002.2948220868.0000000000199000.00000004.00000010.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848952863.0000000004DA3000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1851648195.00000000009AE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1831044187.0000000004736000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1800492043.00000000009AE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1849592510.0000000004ECE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1807328586.0000000000AE9000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1804822306.000000000117F000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1807328586.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1843349509.0000000004AC8000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1847071702.0000000004D27000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1833317656.00000000053A7000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1806694060.0000000003A66000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1835870589.000000000494D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1842263009.0000000004AFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1807067664.0000000003D70000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1858983421.000000000667F000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1811248442.0000000003D70000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1806580685.0000000000A65000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852726832.0000000003D9E000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1845946358.0000000003DA8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://rh.symcd.com0&
Source: SlideshowMaker.exe, 00000001.00000003.1851518505.00000000015A7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://s.s
Source: SlideshowMaker.exe, 00000001.00000003.1848952863.0000000004DA3000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1849592510.0000000004ECE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1847071702.0000000004D27000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1838380312.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1849316625.0000000004E3C000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1843495827.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1845596760.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1849461496.0000000004E58000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1849128230.0000000004DBD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://s.symcb.com/universal-O$m
Source: Movavi Slideshow Maker 4.exe, 00000000.00000002.2948220868.0000000000199000.00000004.00000010.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848952863.0000000004DA3000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1851648195.00000000009AE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1831044187.0000000004736000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1851648195.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1864513012.000000000098D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1800492043.00000000009AE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1849592510.0000000004ECE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1807328586.0000000000AE9000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1858805983.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1804822306.000000000117F000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1807328586.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837801545.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1843349509.0000000004AC8000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1847071702.0000000004D27000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1833317656.00000000053A7000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1806694060.0000000003A66000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1835870589.000000000494D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1842263009.0000000004AFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1807067664.0000000003D70000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852178597.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://s.symcb.com/universal-root.crl0
Source: SlideshowMaker.exe, 00000001.00000003.1848952863.0000000004DA3000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1851648195.00000000009AE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1831044187.0000000004736000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1851648195.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1800492043.00000000009AE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1849592510.0000000004ECE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1807328586.0000000000AE9000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1858805983.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1804822306.000000000117F000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1807328586.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1843349509.0000000004AC8000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1847071702.0000000004D27000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1833317656.00000000053A7000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1806694060.0000000003A66000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1835870589.000000000494D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1842263009.0000000004AFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1807067664.0000000003D70000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1858983421.000000000667F000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1811248442.0000000003D70000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1806580685.0000000000A65000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://s.symcd.com0
Source: Movavi Slideshow Maker 4.exe, 00000000.00000002.2948220868.0000000000199000.00000004.00000010.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848952863.0000000004DA3000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1851648195.00000000009AE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1831044187.0000000004736000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1864513012.000000000098D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1800492043.00000000009AE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1849592510.0000000004ECE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1807328586.0000000000AE9000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1804822306.000000000117F000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1807328586.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837801545.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1843349509.0000000004AC8000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1847071702.0000000004D27000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1833317656.00000000053A7000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1806694060.0000000003A66000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1835870589.000000000494D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1842263009.0000000004AFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1807067664.0000000003D70000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852178597.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1858983421.000000000667F000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1811248442.0000000003D70000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://s.symcd.com06
Source: SlideshowMaker.exe, 00000001.00000003.1864283453.0000000000584000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://scripts.sil.org/OFLhttp://scripts.sil.org/OFL
Source: SlideshowMaker.exe, 00000001.00000003.1864283453.0000000000584000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://scripts.sil.org/OFLhttp://scripts.sil.org/OFLCopyright
Source: SlideshowMaker.exe, 00000001.00000003.1830647359.0000000003C3E000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1805981700.0000000003A16000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1811248442.0000000003C2F000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1805338785.00000000039B1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1810317163.0000000003B79000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://trolltech.com/xml/features/report-start-end-entity
Source: SlideshowMaker.exe, 00000001.00000003.1830647359.0000000003C3E000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1805981700.0000000003A16000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1811248442.0000000003C2F000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1805338785.00000000039B1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1810317163.0000000003B79000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://trolltech.com/xml/features/report-whitespace-only-CharData
Source: SlideshowMaker.exe, 00000001.00000003.1848952863.0000000004DA3000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1849592510.0000000004ECE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1847071702.0000000004D27000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1838380312.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1849316625.0000000004E3C000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1843495827.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1845596760.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1849461496.0000000004E58000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1849128230.0000000004DBD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ts-aia.ws.symantec.co3
Source: SlideshowMaker.exe, 00000001.00000003.1801066920.00000000005D5000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1799152520.000000000050F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ts-aia.ws.symantec.com
Source: SlideshowMaker.exe, 00000001.00000003.1848952863.0000000004DA3000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1851648195.00000000009AE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1831044187.0000000004736000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1864513012.000000000098D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1800492043.00000000009AE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1849592510.0000000004ECE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1807328586.0000000000AE9000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1804822306.000000000117F000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1864405341.0000000003A14000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1807328586.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837801545.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1843349509.0000000004AC8000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1847071702.0000000004D27000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1833317656.00000000053A7000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1806694060.0000000003A66000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1835870589.000000000494D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1842263009.0000000004AFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1807067664.0000000003D70000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852178597.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1858983421.000000000667F000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1811248442.0000000003D70000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0(
Source: SlideshowMaker.exe, 00000001.00000003.1801066920.00000000005D5000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1799152520.000000000050F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ts-aia.ws.symantec.comwfJ
Source: SlideshowMaker.exe, 00000001.00000003.1848952863.0000000004DA3000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1851648195.00000000009AE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1831044187.0000000004736000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1864513012.000000000098D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1800492043.00000000009AE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1849592510.0000000004ECE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1807328586.0000000000AE9000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1804822306.000000000117F000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1864405341.0000000003A14000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1807328586.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837801545.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1843349509.0000000004AC8000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1847071702.0000000004D27000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1833317656.00000000053A7000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1806694060.0000000003A66000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1835870589.000000000494D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1842263009.0000000004AFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1807067664.0000000003D70000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852178597.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1858983421.000000000667F000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1811248442.0000000003D70000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
Source: SlideshowMaker.exe, 00000001.00000003.1848952863.0000000004DA3000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1849592510.0000000004ECE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1847071702.0000000004D27000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1838380312.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1849316625.0000000004E3C000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1843495827.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1845596760.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1849461496.0000000004E58000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1849128230.0000000004DBD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ts-crl.ws.symantec.comG
Source: SlideshowMaker.exe, 00000001.00000003.1848952863.0000000004DA3000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1851648195.00000000009AE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1831044187.0000000004736000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1864513012.000000000098D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1800492043.00000000009AE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1849592510.0000000004ECE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1807328586.0000000000AE9000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1804822306.000000000117F000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1864405341.0000000003A14000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1807328586.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837801545.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1843349509.0000000004AC8000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1847071702.0000000004D27000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1833317656.00000000053A7000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1806694060.0000000003A66000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1835870589.000000000494D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1842263009.0000000004AFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1807067664.0000000003D70000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852178597.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1858983421.000000000667F000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1811248442.0000000003D70000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ts-ocsp.ws.symantec.com0;
Source: SlideshowMaker.exe, 00000001.00000003.1807328586.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1806580685.0000000000A65000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ts-ocsp.ws.symantec.comr
Source: Movavi Slideshow Maker 4.exe, 00000000.00000002.2949192490.0000000000765000.00000004.00000020.00020000.00000000.sdmp, Movavi Slideshow Maker 4.exe, 00000000.00000002.2949854026.00000000007C3000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://turbo.net/studio.
Source: SlideshowMaker.exe, 00000001.00000003.1804727013.0000000000F38000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.phreedom.org/md5)
Source: SlideshowMaker.exe, 00000001.00000003.1804727013.0000000000F38000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.phreedom.org/md5)08:27
Source: SlideshowMaker.exe, 00000001.00000003.1864283453.0000000000584000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.tipo.net.arhttp://www.tipo.net.arThis
Source: SlideshowMaker.exe, 00000001.00000003.1805338785.00000000039B1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.winimage.com/zLibDll
Source: SlideshowMaker.exe, 00000001.00000003.1806694060.0000000003A66000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1805981700.0000000003A16000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1805338785.00000000039B1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.winimage.com/zLibDll-/qiodevice_seek_file_func()
Source: SlideshowMaker.exe, 00000001.00000003.1806694060.0000000003A66000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1805981700.0000000003A16000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1805338785.00000000039B1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.winimage.com/zLibDll1.2.8
Source: SlideshowMaker.exe, 00000001.00000003.1830647359.0000000003C3E000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1805981700.0000000003A16000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1811248442.0000000003C2F000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1805338785.00000000039B1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1810317163.0000000003B79000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://xml.org/sax/features/namespace-prefixes
Source: SlideshowMaker.exe, 00000001.00000003.1830647359.0000000003C3E000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1805981700.0000000003A16000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1811248442.0000000003C2F000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1805338785.00000000039B1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1810317163.0000000003B79000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://xml.org/sax/features/namespaces
Source: SlideshowMaker.exe, 00000001.00000003.1830647359.0000000003C3E000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1805981700.0000000003A16000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1811248442.0000000003C2F000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1805338785.00000000039B1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1810317163.0000000003B79000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://xml.org/sax/features/namespaceshttp://xml.org/sax/features/namespace-prefixeshttp://trolltech
Source: SlideshowMaker.exe, 00000001.00000003.1807328586.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837801545.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852178597.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1806580685.0000000000A65000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1830864474.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://api.vimeo.com/%1_glewI
Source: SlideshowMaker.exe, 00000001.00000003.1806694060.0000000003A66000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1805981700.0000000003A16000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1805338785.00000000039B1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://curl.haxx.se/V
Source: SlideshowMaker.exe, 00000001.00000003.1806694060.0000000003A66000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1805981700.0000000003A16000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1805338785.00000000039B1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://curl.haxx.se/docs/copyright.htmlD
Source: SlideshowMaker.exe, 00000001.00000003.1806694060.0000000003A66000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1805981700.0000000003A16000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1805338785.00000000039B1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://curl.haxx.se/docs/http-cookies.html
Source: SlideshowMaker.exe, 00000001.00000003.1847452500.000000000155E000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848838300.0000000001598000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1851518505.00000000015A7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://d.s
Source: SlideshowMaker.exe, 00000001.00000003.1847452500.000000000155E000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848838300.0000000001598000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1851518505.00000000015A7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://d.sy
Source: SlideshowMaker.exe, 00000001.00000003.1807328586.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1806580685.0000000000A65000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://d.sym
Source: SlideshowMaker.exe, 00000001.00000003.1852726832.0000000003D9E000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1858754735.0000000003D9E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://d.symcb
Source: Movavi Slideshow Maker 4.exe, 00000000.00000002.2948220868.0000000000199000.00000004.00000010.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848952863.0000000004DA3000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1851648195.00000000009AE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1831044187.0000000004736000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1851648195.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1864513012.000000000098D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1800492043.00000000009AE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1849592510.0000000004ECE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1807328586.0000000000AE9000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1858805983.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1804822306.000000000117F000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1864405341.0000000003A14000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1807328586.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837801545.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1843349509.0000000004AC8000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1847071702.0000000004D27000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1833317656.00000000053A7000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1806694060.0000000003A66000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1835870589.000000000494D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1842263009.0000000004AFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1807067664.0000000003D70000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://d.symcb.com/cps0%
Source: SlideshowMaker.exe, 00000001.00000003.1851997073.0000000003D8E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://d.symcb.com/rpa0
Source: Movavi Slideshow Maker 4.exe, 00000000.00000002.2948220868.0000000000199000.00000004.00000010.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848952863.0000000004DA3000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1851648195.00000000009AE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1831044187.0000000004736000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1864513012.000000000098D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1800492043.00000000009AE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1849592510.0000000004ECE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1807328586.0000000000AE9000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1804822306.000000000117F000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1807328586.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837801545.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1843349509.0000000004AC8000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1847071702.0000000004D27000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1833317656.00000000053A7000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1806694060.0000000003A66000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1835870589.000000000494D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1842263009.0000000004AFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1807067664.0000000003D70000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852178597.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1858983421.000000000667F000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1811248442.0000000003D70000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://d.symcb.com/rpa0.
Source: SlideshowMaker.exe, 00000001.00000003.1848952863.0000000004DA3000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1851648195.00000000009AE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1831044187.0000000004736000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1851648195.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1800492043.00000000009AE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1849592510.0000000004ECE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1807328586.0000000000AE9000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1858805983.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1804822306.000000000117F000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1807328586.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1843349509.0000000004AC8000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1847071702.0000000004D27000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1833317656.00000000053A7000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1806694060.0000000003A66000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1835870589.000000000494D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1842263009.0000000004AFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1807067664.0000000003D70000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1858983421.000000000667F000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1811248442.0000000003D70000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1806580685.0000000000A65000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://d.symcb.com/rpa06
Source: SlideshowMaker.exe, 00000001.00000003.1807328586.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837801545.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852178597.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1806580685.0000000000A65000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1830864474.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://drive.google.com/?authuser=%1
Source: Movavi Slideshow Maker 4.exe, 00000000.00000002.2948220868.0000000000199000.00000004.00000010.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848952863.0000000004DA3000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1851648195.00000000009AE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1831044187.0000000004736000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1800492043.00000000009AE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1849592510.0000000004ECE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1807328586.0000000000AE9000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1804822306.000000000117F000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1807328586.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1843349509.0000000004AC8000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1847071702.0000000004D27000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1833317656.00000000053A7000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1806694060.0000000003A66000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1835870589.000000000494D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1842263009.0000000004AFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1807067664.0000000003D70000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1858983421.000000000667F000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1811248442.0000000003D70000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1806580685.0000000000A65000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852726832.0000000003D9E000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1845946358.0000000003DA8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://movavi.com0/
Source: Movavi Slideshow Maker 4.exe, 00000000.00000002.2949192490.00000000006BB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://start.turbo.net/
Source: Movavi Slideshow Maker 4.exe, 00000000.00000002.2951475363.0000000002CDD000.00000004.00000020.00020000.00000000.sdmp, Movavi Slideshow Maker 4.exe, 00000000.00000002.2951898539.0000000002DC5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://start.turbo.net/services/1.0/activity/vm-18.4.1281.0/run
Source: Movavi Slideshow Maker 4.exe, 00000000.00000002.2951898539.0000000002DC5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://start.turbo.net/services/1.0/activity/vm-18.4.1281.0/runio
Source: Movavi Slideshow Maker 4.exe, 00000000.00000002.2949192490.00000000006BB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://start.turbo.net/x4
Source: SlideshowMaker.exe, 00000001.00000003.1807328586.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837801545.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852178597.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1806580685.0000000000A65000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1830864474.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/auth/drive
Source: SlideshowMaker.exe, 00000001.00000003.1807328586.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837801545.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852178597.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1806580685.0000000000A65000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1830864474.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/auth/drive.appdata
Source: SlideshowMaker.exe, 00000001.00000003.1807328586.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837801545.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852178597.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1806580685.0000000000A65000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1830864474.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/auth/drive.file
Source: SlideshowMaker.exe, 00000001.00000003.1830864474.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/auth/userinfo.profile
Source: SlideshowMaker.exe, 00000001.00000003.1807328586.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837801545.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852178597.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1806580685.0000000000A65000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1830864474.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/auth/youtube
Source: SlideshowMaker.exe, 00000001.00000003.1807328586.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837801545.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852178597.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1806580685.0000000000A65000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1830864474.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/auth/youtube.upload
Source: SlideshowMaker.exe, 00000001.00000003.1807328586.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837801545.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852178597.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1806580685.0000000000A65000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1830864474.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/drive/v3/%1
Source: SlideshowMaker.exe, 00000001.00000003.1807328586.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837801545.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852178597.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1806580685.0000000000A65000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1830864474.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/oauth2/v1/userinfo?alt=jsont
Source: SlideshowMaker.exe, 00000001.00000003.1847071702.0000000004D27000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1838380312.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1843495827.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1845596760.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/upload/drive/v3/files?uploadType=resumable8
Source: SlideshowMaker.exe, 00000001.00000003.1864513012.000000000098D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/upload/youtube/v3/videos?uploadType=resumable&part=%1L3TXzVp
Source: SlideshowMaker.exe, 00000001.00000003.1851648195.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1858805983.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837801545.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852178597.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1830864474.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.movavi.com/photo-to-dvd-slideshow/?c=ssm4
Source: SlideshowMaker.exe, 00000001.00000003.1851648195.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1858805983.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837801545.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852178597.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1830864474.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.movavi.ru/photo-to-dvd-slideshow/?c=ssm4
Source: SlideshowMaker.exe, 00000001.00000003.1837801545.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852178597.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1852626571.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848392672.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1830864474.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.movavi.ru/photo-to-dvd-slideshow/?c=ssm49
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown HTTPS traffic detected: 172.67.75.65:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown HTTPS traffic detected: 84.16.252.107:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown HTTPS traffic detected: 84.16.252.107:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown HTTPS traffic detected: 84.16.252.107:443 -> 192.168.2.4:49738 version: TLS 1.2
Sample file is different than original file name gathered from version info
Source: Movavi Slideshow Maker 4.exe, 00000000.00000002.2952700959.0000000003570000.00000002.00000001.00040000.0000009B.sdmp Binary or memory string: System.OriginalFileName vs Movavi Slideshow Maker 4.exe
Source: Movavi Slideshow Maker 4.exe, 00000000.00000002.2953083712.00000000036F8000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameSlideshowMaker.exeR vs Movavi Slideshow Maker 4.exe
Source: Movavi Slideshow Maker 4.exe, 00000000.00000002.2950690600.0000000000BC0000.00000040.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameStubExe.exeL vs Movavi Slideshow Maker 4.exe
Source: Movavi Slideshow Maker 4.exe, 00000000.00000003.1706212885.0000000002CFB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: .System.OriginalFileName vs Movavi Slideshow Maker 4.exe
Source: Movavi Slideshow Maker 4.exe, 00000000.00000000.1702639611.00000000004FA000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameSlideshowMaker.exe, vs Movavi Slideshow Maker 4.exe
Source: Movavi Slideshow Maker 4.exe, 00000000.00000003.1708062818.00000000034D5000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: <propertyDescription name="System.OriginalFileName" formatID="{0CEF7D53-FA64-11D1-A203-0000F81FEDEE}" propID="6"> vs Movavi Slideshow Maker 4.exe
Source: Movavi Slideshow Maker 4.exe, 00000000.00000003.1705294826.00000000006E9000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameX.VirtualizationRuntime.dllL vs Movavi Slideshow Maker 4.exe
Source: Movavi Slideshow Maker 4.exe, 00000000.00000003.1711211617.0000000003745000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: System.OriginalFileName vs Movavi Slideshow Maker 4.exe
Source: Movavi Slideshow Maker 4.exe, 00000000.00000002.2950690600.0000000000EE9000.00000040.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameVm.dllL vs Movavi Slideshow Maker 4.exe
Source: Movavi Slideshow Maker 4.exe, 00000000.00000002.2949192490.00000000006BB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameX.VirtualizationRuntime.dllL vs Movavi Slideshow Maker 4.exe
Source: Movavi Slideshow Maker 4.exe, 00000000.00000002.2950155746.0000000000870000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameStubExe.exeL vs Movavi Slideshow Maker 4.exe
Source: Movavi Slideshow Maker 4.exe, 00000000.00000002.2950155746.0000000000870000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameVm.dllL vs Movavi Slideshow Maker 4.exe
Source: Movavi Slideshow Maker 4.exe, 00000000.00000002.2954165727.000000001005C000.00000002.10000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameX.VirtualizationRuntime.dllL vs Movavi Slideshow Maker 4.exe
Uses 32bit PE files
Source: Movavi Slideshow Maker 4.exe Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
Source: classification engine Classification label: mal72.evad.winEXE@3/485@4/3
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe File created: C:\Users\user\Desktop\Data Jump to behavior
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe Mutant created: \Sessions\1\BaseNamedObjects\Global\__VMX_0x0042CC09
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\__VMX_0x0042CC09
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Mutant created: \Sessions\1\BaseNamedObjects\Global\__VMX_0x0042DB0D
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\__VMX_0x0042DB0D
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe File created: C:\Users\user\AppData\Local\Temp\SPOON\ Jump to behavior
Source: Movavi Slideshow Maker 4.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe "C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe"
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe Process created: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe "C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe" /864A627C-C6B2-464A-AA13-25D62F282BD8
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe Process created: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe "C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe" /864A627C-C6B2-464A-AA13-25D62F282BD8 Jump to behavior
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe Section loaded: httpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: httpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: corelocalization.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: coreint.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: libglog-msvc-14.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: msvcp140.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: boost_system-vc140-mt-1_60.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: boost_chrono-vc140-mt-1_60.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: boost_filesystem-vc140-mt-1_60.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: confint.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: boost_locale-vc140-mt-1_60.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: trackerfactory.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: tracker.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: coretracker.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: openglswitcherapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: qt5widgets.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: qt5gui.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: qt5core.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: qt5network.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: oglmanager.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: procint.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: settings.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: boost_thread-vc140-mt-1_60.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: boost_date_time-vc140-mt-1_60.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: glew32.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: opengl32.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: glu32.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: mqtutil.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: qt5multimedia.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: movaviio.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: mqtdownloadmanager.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: libcurl.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: quazip.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: patentactivator.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: codecpolicycontroller.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: application.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: desktopnotification.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: coreapp.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: qt5quick.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: qt5qml.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: nagscreen.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: webbrowser.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: resourceutil.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: apputil.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: crashhandler.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: crashsenderwrapper.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: packageinstallermodule.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: editorlogic.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: qt5xml.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: qt5xmlpatterns.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: clientapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: coremanager.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: codecfactory.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: muxerfactory.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: datahelpers.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: ffwrapper.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: avutil.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: libgcc_s_dw2-1.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: libwinpthread-1.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: swresample.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: avcodec.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: avformat.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: avfilter.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: avresample.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: libass.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: swscale.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: parserfactory.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: policies.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: filterfactory.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: effectfactory.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: computingresourcemanager.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: threading.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: asswrapper.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: mediatypes.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: demuxers.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: presets.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: streamreader.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: converters.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: coretime.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: mqtmediautil.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: playercontrol.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: playerengine.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: boost_timer-vc140-mt-1_60.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: audiorenderersdl.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: sdlmanager.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: sdl.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: videorendereroglqt.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: movaviaudio.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: exivmetadata.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: videoanalyzer.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: concrt140.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: generalmovavitrackerwrapper.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: accelerationtracker.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: cudamanager.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: beatdetection.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: pubsub.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: editorserialization.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: editormodel.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: editorutil.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: mqtui.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: qt5winextras.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: mqtmediaui.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: graphicsframework.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: editingscene.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: graphicsdecoration.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: magnetizetools.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: editoreffects.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: editortransitions.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: overlayengine.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: graphicssvg.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: qt5svg.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: packageinstaller.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: editormodule.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: effectsspecial.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: updatechecker.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: socialprotocol.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: editorview.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: editoroverlays.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: editorimports.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: filmmaker.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: wintab32.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: generalplugin.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: dataexchange.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: d3d11.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: dcomp.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: dxgi.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: twinapi.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: ieframe.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: msiso.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: mshtml.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: powrprof.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: umpdc.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: libeay32.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: movavitracker.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: boost_regex-vc140-mt-1_60.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: napinsp.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: pnrpnsp.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: effectsipp.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: wshbth.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: nlaapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: winrnr.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: effects.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: effectsff.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: resize.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: effectsogl.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: effectsstock.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: decodersff.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: encodersff.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: databridge.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: d3d9core.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: d3d11core.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: dxva2.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: d3d9.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: encoderlossless.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: bitstreamfilterff.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: decodercuda.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: encodercuda.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: nvapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: nvcuda.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: nvencodeapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: encodernvenc.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: decoderim.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: encoderim.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: imcore.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: d3d10warp.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: d3d10warp.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: resourcepolicyclient.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: d3d10warp.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: d3d10warp.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: d3d10warp.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: libmfxhw32.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: d3d10warp.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: libmfxhw32.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: d3d10warp.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: libmfxhw32.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: d3d10warp.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: libmfxhw32.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: decodermf.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: mfwrapper.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: mfplat.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: mf.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: mfplat.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: msdmo.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: mfcore.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: ksuser.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: mfperfhelper.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: rtworkq.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: comppkgsup.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: windows.media.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: windows.applicationmodel.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: appxdeploymentclient.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: msauddecmft.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: winmmbase.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: msacm32.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: wmadmod.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: wmspdmod.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: msamrnbdecoder.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: mfdvdec.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: msmpeg2vdec.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: mfmjpegdec.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: mp4sdecd.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: mpg4decd.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: mp43decd.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: wmvsdecd.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: wmvdecod.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: mfaacenc.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: wmadmoe.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: msac3enc.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: mfh264enc.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: wmvxencd.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: encodermf.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: decoderraw.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: vcomp140.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: filtersff.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: filters.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: filtersogl.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: filtersspeex.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: muxers.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: parsersff.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: charsetrecode.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: parserraw.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: parsersmf.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: d3d10warp.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: srpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: mlang.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: msimtf.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: jscript9.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: d2d1.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: d3d10warp.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: dxcore.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: msls31.dll Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32 Jump to behavior
Source: Movavi Slideshow Maker 4.exe Static file information: File size 80474129 > 1048576
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\CoreApp.pdb**! source: SlideshowMaker.exe, 00000001.00000003.1805981700.0000000003A16000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1805338785.00000000039B1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\ParserFactory.pdb source: SlideshowMaker.exe, 00000001.00000003.1835870589.000000000494D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1831421405.00000000048E1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\ComputingResourceManager.pdb source: SlideshowMaker.exe, 00000001.00000003.1835870589.000000000494D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1831421405.00000000048E1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837223475.00000000049E9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\EditingScene.pdb)) source: SlideshowMaker.exe, 00000001.00000003.1847071702.0000000004D27000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1838380312.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1843495827.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1845596760.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\Policies.pdb""! source: SlideshowMaker.exe, 00000001.00000003.1835870589.000000000494D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1831421405.00000000048E1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\BeatDetection.pdb source: SlideshowMaker.exe, 00000001.00000003.1838380312.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1843495827.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1845596760.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\CodecPolicyController.pdb source: SlideshowMaker.exe, 00000001.00000003.1805981700.0000000003A16000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1807296039.0000000003B09000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1805338785.00000000039B1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\PatentActivator.pdb source: SlideshowMaker.exe, 00000001.00000003.1805981700.0000000003A16000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1805338785.00000000039B1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\OverlayEngine.pdb'' source: SlideshowMaker.exe, 00000001.00000003.1848952863.0000000004DA3000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1847071702.0000000004D27000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1838380312.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1849316625.0000000004E3C000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1843495827.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1845596760.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1849128230.0000000004DBD000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\CoreTime.pdb source: SlideshowMaker.exe, 00000001.00000003.1807067664.0000000003D70000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1811248442.0000000003D70000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1831966818.0000000003D7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1830647359.0000000003D70000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1810582792.0000000003D70000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1844730403.0000000003D91000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1806284873.0000000003D70000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\MQtDownloadManager.pdb source: SlideshowMaker.exe, 00000001.00000003.1800492043.00000000009AE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1806580685.0000000000A65000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1806643474.0000000000ADB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1799739278.0000000000911000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\MovaviAudIO.pdb source: SlideshowMaker.exe, 00000001.00000003.1835870589.000000000494D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1842263009.0000000004AFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1844762927.0000000004BD8000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1831421405.00000000048E1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1845596760.0000000004C11000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1838380312.0000000004A77000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1843495827.0000000004B5B000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837223475.00000000049E9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\Settings.pdb!! source: SlideshowMaker.exe, 00000001.00000003.1804916505.00000000012F3000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\AccelerationTracker.pdb!! source: SlideshowMaker.exe, 00000001.00000003.1835870589.000000000494D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1842263009.0000000004AFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1844762927.0000000004BD8000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1831421405.00000000048E1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1845596760.0000000004C11000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1846012651.0000000004C6A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1838380312.0000000004A77000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1843495827.0000000004B5B000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1846755210.0000000004CA7000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837223475.00000000049E9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\DesktopNotification.pdb source: SlideshowMaker.exe, 00000001.00000003.1800492043.00000000009AE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1807328586.0000000000AE9000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1806580685.0000000000A65000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1806643474.0000000000ADB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1799739278.0000000000911000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\CoreApp.pdb source: SlideshowMaker.exe, 00000001.00000003.1805981700.0000000003A16000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1805338785.00000000039B1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\EditorSerialization.pdb source: SlideshowMaker.exe, 00000001.00000003.1847071702.0000000004D27000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1838380312.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1843495827.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1845596760.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\work\SDK\glog\0.3.4\lib\Win\msvc-14.0\x86\libglog-msvc-14.pdb source: SlideshowMaker.exe, 00000001.00000003.1799152520.000000000050F000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\PlayerControl.pdb## source: SlideshowMaker.exe, 00000001.00000003.1835870589.000000000494D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1842263009.0000000004AFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1831421405.00000000048E1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1838380312.0000000004A77000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1843495827.0000000004B5B000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837223475.00000000049E9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\Settings.pdb source: SlideshowMaker.exe, 00000001.00000003.1804916505.00000000012F3000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: vcruntime140.i386.pdbGCTL source: SlideshowMaker.exe, 00000001.00000003.1799152520.000000000050F000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\GraphicsSvg.pdb source: SlideshowMaker.exe, 00000001.00000003.1848952863.0000000004DA3000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1847071702.0000000004D27000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1838380312.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1849316625.0000000004E3C000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1843495827.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1845596760.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1849461496.0000000004E58000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1849128230.0000000004DBD000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\EditorTransitions.pdb!! source: SlideshowMaker.exe, 00000001.00000003.1848952863.0000000004DA3000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1847071702.0000000004D27000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1838380312.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1843495827.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1845596760.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1849128230.0000000004DBD000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\MQtUtil.pdb source: SlideshowMaker.exe, 00000001.00000003.1805338785.00000000039B1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\Presets.pdb source: SlideshowMaker.exe, 00000001.00000003.1843349509.0000000004AC8000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1835870589.000000000494D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1831421405.00000000048E1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1838380312.0000000004A77000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837223475.00000000049E9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\AudioRendererSDL.pdb$$! source: SlideshowMaker.exe, 00000001.00000003.1835870589.000000000494D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1842263009.0000000004AFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1844762927.0000000004BD8000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1831421405.00000000048E1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1838380312.0000000004A77000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1843495827.0000000004B5B000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837223475.00000000049E9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\work\SDK\glog\0.3.4\lib\Win\msvc-14.0\x86\libglog-msvc-14.pdb"" source: SlideshowMaker.exe, 00000001.00000003.1799152520.000000000050F000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\OpenglSwitcherAPI.pdb## source: SlideshowMaker.exe, 00000001.00000003.1800492043.00000000009AE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1799739278.0000000000911000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: msvcp140.i386.pdb source: SlideshowMaker.exe, 00000001.00000003.1799152520.000000000050F000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\EditorTransitions.pdb source: SlideshowMaker.exe, 00000001.00000003.1848952863.0000000004DA3000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1847071702.0000000004D27000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1838380312.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1843495827.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1845596760.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1849128230.0000000004DBD000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\ASSWrapper.pdb source: SlideshowMaker.exe, 00000001.00000003.1835870589.000000000494D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1831421405.00000000048E1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837223475.00000000049E9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\MovaviIO.pdb66 source: SlideshowMaker.exe, 00000001.00000003.1805981700.0000000003A16000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1805338785.00000000039B1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\MQtDownloadManager.pdb$$ source: SlideshowMaker.exe, 00000001.00000003.1800492043.00000000009AE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1806580685.0000000000A65000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1806643474.0000000000ADB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1799739278.0000000000911000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\EffectsSpecial.pdb source: SlideshowMaker.exe, 00000001.00000003.1847452500.000000000155E000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848838300.0000000001598000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1851518505.00000000015A7000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\bamboo-home\xml-data\build-dir\SPOONVM-VM-JOB1\vm\Build\Output\x86\VmX.pdb source: Movavi Slideshow Maker 4.exe, 00000000.00000003.1705294826.00000000006E9000.00000004.00000020.00020000.00000000.sdmp, Movavi Slideshow Maker 4.exe, 00000000.00000002.2954049887.000000001003C000.00000002.10000000.00040000.00000000.sdmp, Movavi Slideshow Maker 4.exe, 00000000.00000002.2949192490.00000000006BB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1742216462.0000000001558000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1742834920.000000000155C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\bamboo-home\xml-data\build-dir\SPOONVM-VM-JOB1\vm\Build\Output\x86\StubExe.pdb source: Movavi Slideshow Maker 4.exe, 00000000.00000002.2950690600.0000000000BC0000.00000040.00001000.00020000.00000000.sdmp, Movavi Slideshow Maker 4.exe, 00000000.00000002.2950155746.0000000000870000.00000004.00001000.00020000.00000000.sdmp, Movavi Slideshow Maker 4.exe, 00000000.00000002.2948401633.0000000000401000.00000020.00000001.01000000.00000003.sdmp
Source: Binary string: C:\bamboo-home\xml-data\build-dir\SPOONVM-VM-JOB1\vm\Build\Output\x64\StubExe.pdb source: Movavi Slideshow Maker 4.exe, 00000000.00000002.2950690600.0000000000BC0000.00000040.00001000.00020000.00000000.sdmp, Movavi Slideshow Maker 4.exe, 00000000.00000002.2950155746.0000000000870000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\EditorEffects.pdb source: SlideshowMaker.exe, 00000001.00000003.1849072895.000000000604D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\DataHelpers.pdb source: SlideshowMaker.exe, 00000001.00000003.1831044187.0000000004687000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\ResourceUtil.pdb source: SlideshowMaker.exe, 00000001.00000003.1805981700.0000000003A16000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1805338785.00000000039B1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1810317163.0000000003B79000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\GraphicsSvg.pdb## source: SlideshowMaker.exe, 00000001.00000003.1848952863.0000000004DA3000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1847071702.0000000004D27000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1838380312.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1849316625.0000000004E3C000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1843495827.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1845596760.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1849461496.0000000004E58000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1849128230.0000000004DBD000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\MQtMediaUi.pdb source: SlideshowMaker.exe, 00000001.00000003.1847071702.0000000004D27000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1838380312.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1843495827.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1845596760.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\EffectFactory.pdb source: SlideshowMaker.exe, 00000001.00000003.1835870589.000000000494D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1831421405.00000000048E1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837223475.00000000049E9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\MovaviAudIO.pdb33" source: SlideshowMaker.exe, 00000001.00000003.1835870589.000000000494D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1842263009.0000000004AFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1844762927.0000000004BD8000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1831421405.00000000048E1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1845596760.0000000004C11000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1838380312.0000000004A77000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1843495827.0000000004B5B000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837223475.00000000049E9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\MQtUi.pdb source: SlideshowMaker.exe, 00000001.00000003.1846910089.0000000005DAA000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\CodecFactory.pdb source: SlideshowMaker.exe, 00000001.00000003.1830647359.0000000003C3E000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1805981700.0000000003A16000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1811248442.0000000003C2F000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1805338785.00000000039B1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1810317163.0000000003B79000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\BeatDetection.pdb&&" source: SlideshowMaker.exe, 00000001.00000003.1838380312.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1843495827.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1845596760.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\CoreTime.pdb source: SlideshowMaker.exe, 00000001.00000003.1807067664.0000000003D70000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1811248442.0000000003D70000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1831966818.0000000003D7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1830647359.0000000003D70000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1810582792.0000000003D70000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1844730403.0000000003D91000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1806284873.0000000003D70000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\PlayerControl.pdb source: SlideshowMaker.exe, 00000001.00000003.1835870589.000000000494D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1842263009.0000000004AFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1831421405.00000000048E1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1838380312.0000000004A77000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1843495827.0000000004B5B000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837223475.00000000049E9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\OpenglSwitcherAPI.pdb source: SlideshowMaker.exe, 00000001.00000003.1800492043.00000000009AE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1799739278.0000000000911000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\ComputingResourceManager.pdb"" source: SlideshowMaker.exe, 00000001.00000003.1835870589.000000000494D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1831421405.00000000048E1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837223475.00000000049E9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\GraphicsFramework.pdb source: SlideshowMaker.exe, 00000001.00000003.1847452500.000000000155E000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848838300.0000000001598000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: msvcp140.i386.pdbGCTL source: SlideshowMaker.exe, 00000001.00000003.1799152520.000000000050F000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\CrashHandler.pdb source: SlideshowMaker.exe, 00000001.00000003.1805981700.0000000003A16000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1811248442.0000000003C2F000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1805338785.00000000039B1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1810317163.0000000003B79000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\NagScreen.pdb source: SlideshowMaker.exe, 00000001.00000003.1805981700.0000000003A16000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1805338785.00000000039B1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1810317163.0000000003B79000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\UpdateChecker.pdb source: SlideshowMaker.exe, 00000001.00000003.1851648195.00000000009AE000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\AccelerationTracker.pdb source: SlideshowMaker.exe, 00000001.00000003.1835870589.000000000494D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1842263009.0000000004AFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1844762927.0000000004BD8000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1831421405.00000000048E1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1845596760.0000000004C11000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1846012651.0000000004C6A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1838380312.0000000004A77000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1843495827.0000000004B5B000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1846755210.0000000004CA7000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837223475.00000000049E9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\PatentActivator.pdb$$ source: SlideshowMaker.exe, 00000001.00000003.1805981700.0000000003A16000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1805338785.00000000039B1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\EditorSerialization.pdb&& source: SlideshowMaker.exe, 00000001.00000003.1847071702.0000000004D27000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1838380312.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1843495827.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1845596760.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\PackageInstaller.pdb source: SlideshowMaker.exe, 00000001.00000003.1848952863.0000000004DA3000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1849592510.0000000004ECE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1847071702.0000000004D27000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1838380312.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1849316625.0000000004E3C000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1843495827.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1845596760.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1849461496.0000000004E58000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1849128230.0000000004DBD000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\PlayerEngine.pdb)) source: SlideshowMaker.exe, 00000001.00000003.1835870589.000000000494D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1842263009.0000000004AFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1831421405.00000000048E1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1838380312.0000000004A77000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1843495827.0000000004B5B000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837223475.00000000049E9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\MQtMediaUtil.pdb source: SlideshowMaker.exe, 00000001.00000003.1835870589.000000000494D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1842263009.0000000004AFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1831421405.00000000048E1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1838380312.0000000004A77000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1843495827.0000000004B5B000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837223475.00000000049E9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: concrt140.i386.pdb source: SlideshowMaker.exe, 00000001.00000003.1835870589.000000000494D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1842263009.0000000004AFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1844762927.0000000004BD8000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1831421405.00000000048E1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1845596760.0000000004C11000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1846012651.0000000004C6A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1838380312.0000000004A77000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1843495827.0000000004B5B000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837223475.00000000049E9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\OglManager.pdb source: SlideshowMaker.exe, 00000001.00000003.1800492043.00000000009AE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1799739278.0000000000911000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\CoreLocalization.pdb!! source: SlideshowMaker.exe, 00000001.00000003.1799152520.000000000050F000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\bamboo-home\xml-data\build-dir\SPOONVM-VM-JOB1\vm\Build\Output\x86\Vm.pdb source: Movavi Slideshow Maker 4.exe, 00000000.00000002.2950690600.0000000000BC0000.00000040.00001000.00020000.00000000.sdmp, Movavi Slideshow Maker 4.exe, 00000000.00000002.2950155746.0000000000870000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\DesktopNotification.pdb%% source: SlideshowMaker.exe, 00000001.00000003.1800492043.00000000009AE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1807328586.0000000000AE9000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1806580685.0000000000A65000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1806643474.0000000000ADB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1799739278.0000000000911000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\EditorImports.pdb source: SlideshowMaker.exe, 00000001.00000003.1858645130.000000000050F000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\MediaTypes.pdb source: SlideshowMaker.exe, 00000001.00000003.1835870589.000000000494D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1831421405.00000000048E1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1838380312.0000000004A77000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837223475.00000000049E9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\GraphicsDecoration.pdb++ source: SlideshowMaker.exe, 00000001.00000003.1848952863.0000000004DA3000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1847071702.0000000004D27000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1838380312.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1843495827.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1845596760.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\MuxerFactory.pdb source: SlideshowMaker.exe, 00000001.00000003.1830647359.0000000003C3E000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1805981700.0000000003A16000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1811248442.0000000003C2F000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1805338785.00000000039B1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1830767493.0000000003CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1810317163.0000000003B79000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\GraphicsFramework.pdb%% source: SlideshowMaker.exe, 00000001.00000003.1847452500.000000000155E000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1848838300.0000000001598000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\OverlayEngine.pdb source: SlideshowMaker.exe, 00000001.00000003.1848952863.0000000004DA3000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1847071702.0000000004D27000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1838380312.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1849316625.0000000004E3C000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1843495827.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1845596760.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1849128230.0000000004DBD000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\ProcInt.pdb@@! source: SlideshowMaker.exe, 00000001.00000003.1804822306.000000000117F000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: concrt140.i386.pdbGCTL source: SlideshowMaker.exe, 00000001.00000003.1835870589.000000000494D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1842263009.0000000004AFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1844762927.0000000004BD8000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1831421405.00000000048E1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1845596760.0000000004C11000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1846012651.0000000004C6A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1838380312.0000000004A77000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1843495827.0000000004B5B000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837223475.00000000049E9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\EditorEffects.pdb((" source: SlideshowMaker.exe, 00000001.00000003.1849072895.000000000604D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\MQtMediaUi.pdb"" source: SlideshowMaker.exe, 00000001.00000003.1847071702.0000000004D27000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1838380312.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1843495827.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1845596760.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\OglManager.pdb88! source: SlideshowMaker.exe, 00000001.00000003.1800492043.00000000009AE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1799739278.0000000000911000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\Converters.pdb!! source: SlideshowMaker.exe, 00000001.00000003.1835870589.000000000494D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1842263009.0000000004AFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1831421405.00000000048E1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1838380312.0000000004A77000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837223475.00000000049E9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\PlayerEngine.pdb source: SlideshowMaker.exe, 00000001.00000003.1835870589.000000000494D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1842263009.0000000004AFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1831421405.00000000048E1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1838380312.0000000004A77000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1843495827.0000000004B5B000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837223475.00000000049E9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\AppUtil.pdb00 source: SlideshowMaker.exe, 00000001.00000003.1805981700.0000000003A16000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1805338785.00000000039B1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1810317163.0000000003B79000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\FFWrapper.pdb source: SlideshowMaker.exe, 00000001.00000003.1830647359.0000000003C3E000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1805981700.0000000003A16000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1811248442.0000000003C2F000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1831122946.0000000003D18000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1805338785.00000000039B1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1830767493.0000000003CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1810317163.0000000003B79000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\EditorOverlays.pdb source: SlideshowMaker.exe, 00000001.00000003.1858645130.000000000050F000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\FilterFactory.pdb source: SlideshowMaker.exe, 00000001.00000003.1835870589.000000000494D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1831421405.00000000048E1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\PackageInstaller.pdb,, source: SlideshowMaker.exe, 00000001.00000003.1848952863.0000000004DA3000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1849592510.0000000004ECE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1847071702.0000000004D27000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1838380312.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1849316625.0000000004E3C000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1843495827.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1845596760.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1849461496.0000000004E58000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1849128230.0000000004DBD000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\CrashSenderWrapper.pdb source: SlideshowMaker.exe, 00000001.00000003.1800492043.00000000009AE000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1807328586.0000000000AE9000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1806580685.0000000000A65000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1806643474.0000000000ADB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1831022848.0000000000B08000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1799739278.0000000000911000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\Tracker.pdb source: SlideshowMaker.exe, 00000001.00000003.1801066920.00000000005D5000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1799152520.000000000050F000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\EditingScene.pdb source: SlideshowMaker.exe, 00000001.00000003.1847071702.0000000004D27000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1838380312.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1843495827.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1845596760.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\Policies.pdb source: SlideshowMaker.exe, 00000001.00000003.1835870589.000000000494D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1831421405.00000000048E1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\SDLManager.pdb source: SlideshowMaker.exe, 00000001.00000003.1807067664.0000000003D70000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1811248442.0000000003D70000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1845946358.0000000003DA8000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1831966818.0000000003D7A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1830647359.0000000003D70000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1810582792.0000000003D70000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1844730403.0000000003D91000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1806284873.0000000003D70000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\Demuxers.pdb source: SlideshowMaker.exe, 00000001.00000003.1835870589.000000000494D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1831421405.00000000048E1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1838380312.0000000004A77000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837223475.00000000049E9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\MagnetizeTools.pdb source: SlideshowMaker.exe, 00000001.00000003.1848952863.0000000004DA3000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1847071702.0000000004D27000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1838380312.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1843495827.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1845596760.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1849128230.0000000004DBD000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\CoreLocalization.pdb source: SlideshowMaker.exe, 00000001.00000003.1799152520.000000000050F000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\Threading.pdb source: SlideshowMaker.exe, 00000001.00000003.1835870589.000000000494D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1831421405.00000000048E1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837223475.00000000049E9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\GraphicsDecoration.pdb source: SlideshowMaker.exe, 00000001.00000003.1848952863.0000000004DA3000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1847071702.0000000004D27000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1838380312.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1843495827.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1845596760.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\CoreTracker.pdb source: SlideshowMaker.exe, 00000001.00000003.1801066920.00000000005D5000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1799152520.000000000050F000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\VideoRendererOGLQt.pdb source: SlideshowMaker.exe, 00000001.00000003.1835870589.000000000494D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1842263009.0000000004AFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1844762927.0000000004BD8000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1831421405.00000000048E1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1838380312.0000000004A77000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1843495827.0000000004B5B000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837223475.00000000049E9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\WebBrowser.pdb33' source: SlideshowMaker.exe, 00000001.00000003.1805981700.0000000003A16000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1805338785.00000000039B1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1810317163.0000000003B79000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\MQtUtil.pdbKK! source: SlideshowMaker.exe, 00000001.00000003.1805338785.00000000039B1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\ProcInt.pdb source: SlideshowMaker.exe, 00000001.00000003.1804822306.000000000117F000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\StreamReader.pdb source: SlideshowMaker.exe, 00000001.00000003.1835870589.000000000494D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1842263009.0000000004AFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1831421405.00000000048E1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1838380312.0000000004A77000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837223475.00000000049E9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\CoreManager.pdb source: SlideshowMaker.exe, 00000001.00000003.1830647359.0000000003C3E000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1805981700.0000000003A16000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1811248442.0000000003C2F000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1805338785.00000000039B1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1810317163.0000000003B79000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\NagScreen.pdb,, source: SlideshowMaker.exe, 00000001.00000003.1805981700.0000000003A16000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1805338785.00000000039B1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1810317163.0000000003B79000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\TrackerFactory.pdb source: SlideshowMaker.exe, 00000001.00000003.1800889302.0000000000995000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1799739278.0000000000911000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\GeneralMovaviTrackerWrapper.pdb source: SlideshowMaker.exe, 00000001.00000003.1835870589.000000000494D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1842263009.0000000004AFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1844762927.0000000004BD8000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1831421405.00000000048E1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1845596760.0000000004C11000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1846012651.0000000004C6A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1838380312.0000000004A77000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1843495827.0000000004B5B000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1846755210.0000000004CA7000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837223475.00000000049E9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\Threading.pdb!! source: SlideshowMaker.exe, 00000001.00000003.1835870589.000000000494D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1831421405.00000000048E1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837223475.00000000049E9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\AudioRendererSDL.pdb source: SlideshowMaker.exe, 00000001.00000003.1835870589.000000000494D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1842263009.0000000004AFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1844762927.0000000004BD8000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1831421405.00000000048E1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1838380312.0000000004A77000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1843495827.0000000004B5B000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837223475.00000000049E9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\MQtUi.pdbHH source: SlideshowMaker.exe, 00000001.00000003.1846910089.0000000005DAA000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\Converters.pdb source: SlideshowMaker.exe, 00000001.00000003.1835870589.000000000494D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1842263009.0000000004AFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1831421405.00000000048E1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1838380312.0000000004A77000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837223475.00000000049E9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\PackageInstallerModule.pdb source: SlideshowMaker.exe, 00000001.00000003.1830647359.0000000003C3E000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1805981700.0000000003A16000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1811248442.0000000003C2F000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1805338785.00000000039B1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1810317163.0000000003B79000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\WebBrowser.pdb source: SlideshowMaker.exe, 00000001.00000003.1805981700.0000000003A16000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1805338785.00000000039B1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1810317163.0000000003B79000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\PubSub.pdb!! source: SlideshowMaker.exe, 00000001.00000003.1847071702.0000000004D27000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1838380312.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1843495827.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1845596760.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\ASSWrapper.pdb!! source: SlideshowMaker.exe, 00000001.00000003.1835870589.000000000494D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1831421405.00000000048E1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837223475.00000000049E9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\VideoRendererOGLQt.pdb## source: SlideshowMaker.exe, 00000001.00000003.1835870589.000000000494D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1842263009.0000000004AFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1844762927.0000000004BD8000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1831421405.00000000048E1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1838380312.0000000004A77000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1843495827.0000000004B5B000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837223475.00000000049E9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: vcruntime140.i386.pdb source: SlideshowMaker.exe, 00000001.00000003.1799152520.000000000050F000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\MovaviIO.pdb source: SlideshowMaker.exe, 00000001.00000003.1805981700.0000000003A16000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1805338785.00000000039B1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\MediaTypes.pdb&& source: SlideshowMaker.exe, 00000001.00000003.1835870589.000000000494D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1831421405.00000000048E1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1838380312.0000000004A77000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837223475.00000000049E9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\GeneralMovaviTrackerWrapper.pdb## source: SlideshowMaker.exe, 00000001.00000003.1835870589.000000000494D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1842263009.0000000004AFB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1844762927.0000000004BD8000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1831421405.00000000048E1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1845596760.0000000004C11000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1846012651.0000000004C6A000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1838380312.0000000004A77000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1843495827.0000000004B5B000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1846755210.0000000004CA7000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837223475.00000000049E9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\PubSub.pdb source: SlideshowMaker.exe, 00000001.00000003.1847071702.0000000004D27000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1838380312.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1843495827.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1845596760.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\Presets.pdb!! source: SlideshowMaker.exe, 00000001.00000003.1843349509.0000000004AC8000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1835870589.000000000494D000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1831421405.00000000048E1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1838380312.0000000004A77000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1837223475.00000000049E9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\FFWrapper.pdb,,! source: SlideshowMaker.exe, 00000001.00000003.1830647359.0000000003C3E000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1805981700.0000000003A16000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1811248442.0000000003C2F000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1831122946.0000000003D18000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1805338785.00000000039B1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1830767493.0000000003CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1810317163.0000000003B79000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\MagnetizeTools.pdb%% source: SlideshowMaker.exe, 00000001.00000003.1848952863.0000000004DA3000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1847071702.0000000004D27000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1838380312.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1843495827.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1845596760.0000000004CEB000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1849128230.0000000004DBD000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\AppUtil.pdb source: SlideshowMaker.exe, 00000001.00000003.1805981700.0000000003A16000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1805338785.00000000039B1000.00000004.00000020.00020000.00000000.sdmp, SlideshowMaker.exe, 00000001.00000003.1810317163.0000000003B79000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\J\WS\VE124\build-x86_32\bin\UpdateChecker.pdb&& source: SlideshowMaker.exe, 00000001.00000003.1851648195.00000000009AE000.00000004.00000020.00020000.00000000.sdmp
PE file contains an invalid checksum
Source: SlideshowMaker.exe.0.dr Static PE information: real checksum: 0xdc081 should be: 0xde681
PE file contains sections with non-standard names
Source: Movavi Slideshow Maker 4.exe Static PE information: section name: .xcpad
Drops PE files
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\404_05690000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\404_00c20000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\404_05640000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\404_05c70000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\modified\@APPDATA@\Movavi Slideshow Maker 4\ConfInt.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\modified\@APPDATA@\Movavi Slideshow Maker 4\platforms\qwindows.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\modified\@APPDATA@\Movavi Slideshow Maker 4\Filters.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\404_00610000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\404_00650000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\404_05610000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\404_05c20000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\404_6eb40000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\modified\@APPDATA@\Movavi Slideshow Maker 4\GeneralPlugin.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\404_04150000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\404_04560000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\404_65200000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\modified\@APPDATA@\Movavi Slideshow Maker 4\Qt5Widgets.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\modified\@APPDATA@\Movavi Slideshow Maker 4\Qt5Core.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\modified\@APPDATA@\Movavi Slideshow Maker 4\avcodec.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\404_04050000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\404_05ea0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\404_00bb0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\404_01020000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\404_05760000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\modified\@APPDATA@\Movavi Slideshow Maker 4\EditorView.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\404_6c0a0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\404_05360000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\404_04090000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\404_64000000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\404_040c0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\404_05580000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\404_00b30000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\404_058c0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\404_06330000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\404_06110000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\modified\@APPDATA@\Movavi Slideshow Maker 4\imageformats\qjpeg.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\404_688d0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\404_04010000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\404_00730000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\404_05ab0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\404_044d0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\404_042c0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\modified\@APPDATA@\Movavi Slideshow Maker 4\Qt5Gui.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\404_6b5b0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\404_04210000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\404_056d0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\404_058e0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\404_06390000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\404_05ae0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\404_013c0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\404_65bc0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\404_6b080000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\404_054d0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\404_050a0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\modified\@APPDATA@\Movavi Slideshow Maker 4\imageformats\qgif.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\404_05490000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\404_66980000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\404_045b0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe File created: C:\Users\user\Desktop\Data\local\modified\@APPDATA@\Movavi Slideshow Maker 4\SlideshowMaker.exe Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\404_6a8b0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\404_05860000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\404_6d280000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\modified\@APPDATA@\Movavi Slideshow Maker 4\DecoderRAW.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\modified\@APPDATA@\Movavi Slideshow Maker 4\avfilter.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\404_06210000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\404_03940000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\404_6b300000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\404_690a0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\404_05820000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\404_06240000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\404_01260000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\404_00400000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\404_03f50000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\404_6ca20000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\404_03db0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\404_041b0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\404_04340000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\modified\@APPDATA@\Movavi Slideshow Maker 4\EditorModel.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\404_05ca0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\404_03ef0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\modified\@APPDATA@\Movavi Slideshow Maker 4\CudaManager.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\404_04270000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\404_64b40000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\modified\@APPDATA@\Movavi Slideshow Maker 4\Qt5XmlPatterns.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\modified\@APPDATA@\Movavi Slideshow Maker 4\VideoAnalyzer.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\404_6a200000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\modified\@APPDATA@\Movavi Slideshow Maker 4\Qt5Quick.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\404_6bc10000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\modified\@APPDATA@\Movavi Slideshow Maker 4\EditorLogic.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\404_6a670000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\404_05540000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\404_05450000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\404_69f70000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\404_63180000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\404_68b50000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\modified\@APPDATA@\Movavi Slideshow Maker 4\FilmMaker.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\modified\@APPDATA@\Movavi Slideshow Maker 4\EditorUtil.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\404_69bb0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\404_05d10000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\modified\@APPDATA@\Movavi Slideshow Maker 4\imageformats\qtiff.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\404_05f30000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\404_69fc0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\404_05f90000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\404_008e0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\modified\@APPDATA@\Movavi Slideshow Maker 4\Application.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\404_05720000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\404_01390000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\modified\@APPDATA@\Movavi Slideshow Maker 4\libass.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\404_05be0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\404_04760000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe File created: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\404_06280000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\modified\@APPDATA@\Movavi Slideshow Maker 4\avformat.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\404_04510000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\404_055c0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\404_004e0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\404_6c590000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\modified\@APPDATA@\Movavi Slideshow Maker 4\EditorModule.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\modified\@APPDATA@\Movavi Slideshow Maker 4\Qt5Qml.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\404_010a0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\404_05f00000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\404_057f0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\404_62c80000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\modified\@APPDATA@\Movavi Slideshow Maker 4\ExivMetadata.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\temp\404_69df0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File created: C:\Users\user\Desktop\Data\local\modified\@APPDATA@\Movavi Slideshow Maker 4\libeay32.dll Jump to dropped file

Boot Survival
barindex
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Window searched: window name: FilemonClass
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Window searched: window name: RegmonClass
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Window searched: window name: FilemonClass
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Window searched: window name: PROCMON_WINDOW_CLASS
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate Jump to behavior
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot Jump to behavior
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 67833AE second address: 67833B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 67833B3 second address: 6782BF9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCC4559B0F2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a or dword ptr [ebp+165E1EC4h], esi 0x00000010 push dword ptr [ebp+165E0921h] 0x00000016 stc 0x00000017 call dword ptr [ebp+165E366Dh] 0x0000001d pushad 0x0000001e cld 0x0000001f xor eax, eax 0x00000021 mov dword ptr [ebp+165E2E33h], eax 0x00000027 pushad 0x00000028 sub si, EF37h 0x0000002d popad 0x0000002e mov edx, dword ptr [esp+28h] 0x00000032 xor dword ptr [ebp+165E2E33h], esi 0x00000038 ja 00007FCC4559B0F2h 0x0000003e mov dword ptr [ebp+165E2B26h], eax 0x00000044 jmp 00007FCC4559B0F2h 0x00000049 mov esi, 0000003Ch 0x0000004e jmp 00007FCC4559B0F9h 0x00000053 add esi, dword ptr [esp+24h] 0x00000057 jns 00007FCC4559B0FDh 0x0000005d lodsw 0x0000005f pushad 0x00000060 sub dword ptr [ebp+165E2E33h], edi 0x00000066 or dword ptr [ebp+165E1B84h], eax 0x0000006c popad 0x0000006d add eax, dword ptr [esp+24h] 0x00000071 xor dword ptr [ebp+165E2E33h], edx 0x00000077 jmp 00007FCC4559B0EFh 0x0000007c mov ebx, dword ptr [esp+24h] 0x00000080 jl 00007FCC4559B0F2h 0x00000086 pushad 0x00000087 mov ax, 44D7h 0x0000008b jo 00007FCC4559B0E6h 0x00000091 popad 0x00000092 cmc 0x00000093 nop 0x00000094 push eax 0x00000095 push edx 0x00000096 push eax 0x00000097 push edx 0x00000098 js 00007FCC4559B0E6h 0x0000009e rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6782BF9 second address: 6782BFD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6782BFD second address: 6782C03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6782C03 second address: 6782C1F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCC44D34C0Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushad 0x0000000c jg 00007FCC44D34C06h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68F8195 second address: 68F81AC instructions: 0x00000000 rdtsc 0x00000002 jo 00007FCC4559B0E8h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jng 00007FCC4559B0E8h 0x00000015 push edi 0x00000016 pop edi 0x00000017 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68F81AC second address: 68F8237 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 mov si, 0065h 0x0000000d push 00000000h 0x0000000f jno 00007FCC44D34C0Ch 0x00000015 push CD659EA7h 0x0000001a push eax 0x0000001b jns 00007FCC44D34C0Ch 0x00000021 pop eax 0x00000022 add dword ptr [esp], 329A61D9h 0x00000029 mov dx, 0B32h 0x0000002d push 00000003h 0x0000002f mov dword ptr [ebp+165E1B30h], edi 0x00000035 push 00000000h 0x00000037 mov dword ptr [ebp+165E3991h], esi 0x0000003d push 00000003h 0x0000003f push 00000000h 0x00000041 push esi 0x00000042 call 00007FCC44D34C08h 0x00000047 pop esi 0x00000048 mov dword ptr [esp+04h], esi 0x0000004c add dword ptr [esp+04h], 0000001Dh 0x00000054 inc esi 0x00000055 push esi 0x00000056 ret 0x00000057 pop esi 0x00000058 ret 0x00000059 jc 00007FCC44D34C08h 0x0000005f mov esi, ebx 0x00000061 push 7B69AF08h 0x00000066 jo 00007FCC44D34C24h 0x0000006c push eax 0x0000006d push edx 0x0000006e jo 00007FCC44D34C06h 0x00000074 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68F8325 second address: 68F8397 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 mov eax, dword ptr [eax] 0x00000008 push edx 0x00000009 jg 00007FCC4559B0E8h 0x0000000f pushad 0x00000010 popad 0x00000011 pop edx 0x00000012 mov dword ptr [esp+04h], eax 0x00000016 jmp 00007FCC4559B0F7h 0x0000001b pop eax 0x0000001c cld 0x0000001d cmc 0x0000001e push 00000003h 0x00000020 or edi, dword ptr [ebp+165E2B1Eh] 0x00000026 push 00000000h 0x00000028 jmp 00007FCC4559B0EEh 0x0000002d push 00000003h 0x0000002f mov dword ptr [ebp+165E195Dh], edx 0x00000035 push D443FDDFh 0x0000003a push eax 0x0000003b push edx 0x0000003c pushad 0x0000003d ja 00007FCC4559B0E6h 0x00000043 jmp 00007FCC4559B0F3h 0x00000048 popad 0x00000049 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68F8549 second address: 68F8553 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FCC44D34C06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68F8553 second address: 68F856D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FCC4559B0F6h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68E943E second address: 68E9444 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68E9444 second address: 68E9448 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6917B43 second address: 6917B47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6918089 second address: 691808D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6918306 second address: 691830A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 691830A second address: 6918310 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6918442 second address: 6918446 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6918446 second address: 6918469 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FCC4559B0E6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c je 00007FCC4559B0F3h 0x00000012 jmp 00007FCC4559B0EDh 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6918469 second address: 691846D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 69188B0 second address: 69188C5 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 jo 00007FCC4559B0E6h 0x0000000d pushad 0x0000000e popad 0x0000000f pop edx 0x00000010 push esi 0x00000011 push eax 0x00000012 push edx 0x00000013 push edi 0x00000014 pop edi 0x00000015 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 690CD71 second address: 690CD75 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6918D09 second address: 6918D0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6918D0D second address: 6918D11 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6918D11 second address: 6918D29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007FCC4559B0EDh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6918D29 second address: 6918D2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6919961 second address: 6919966 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6919966 second address: 6919986 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 jmp 00007FCC44D34C18h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6919986 second address: 69199AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCC4559B0F3h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jg 00007FCC4559B11Eh 0x00000012 push eax 0x00000013 push edx 0x00000014 push edx 0x00000015 pop edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68E5F4D second address: 68E5F52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68E5F52 second address: 68E5F6F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FCC4559B0EFh 0x00000008 jg 00007FCC4559B0E6h 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 692187A second address: 6921893 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FCC44D34C0Eh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6921893 second address: 69218A2 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FCC4559B0E6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 69218A2 second address: 69218AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jl 00007FCC44D34C06h 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 69219E6 second address: 6921A0B instructions: 0x00000000 rdtsc 0x00000002 js 00007FCC4559B0EAh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jc 00007FCC4559B117h 0x00000010 pushad 0x00000011 jmp 00007FCC4559B0EEh 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6921B72 second address: 6921B98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007FCC44D34C11h 0x0000000d jne 00007FCC44D34C06h 0x00000013 js 00007FCC44D34C06h 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6922154 second address: 692215A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 692215A second address: 6922160 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6922160 second address: 6922166 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6922166 second address: 6922193 instructions: 0x00000000 rdtsc 0x00000002 js 00007FCC44D34C06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d jmp 00007FCC44D34C11h 0x00000012 popad 0x00000013 pop edx 0x00000014 pop eax 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 pushad 0x00000019 popad 0x0000001a pushad 0x0000001b popad 0x0000001c popad 0x0000001d push edi 0x0000001e pushad 0x0000001f popad 0x00000020 pop edi 0x00000021 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6922193 second address: 69221B1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCC4559B0F6h 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b push esi 0x0000000c pop esi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6922881 second address: 69228AE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007FCC44D34C1Dh 0x0000000c jmp 00007FCC44D34C15h 0x00000011 push esi 0x00000012 pop esi 0x00000013 push eax 0x00000014 push edx 0x00000015 jc 00007FCC44D34C20h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 69228AE second address: 69228D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCC4559B0F4h 0x00000009 jp 00007FCC4559B0F2h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6922A85 second address: 6922A92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 jnc 00007FCC44D34C06h 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6922A92 second address: 6922AB0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FCC4559B0F9h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 69230B7 second address: 69230D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 jc 00007FCC44D34C06h 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 popad 0x00000012 jmp 00007FCC44D34C0Fh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 692367D second address: 692368D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCC4559B0EBh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 692368D second address: 6923692 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6923D21 second address: 6923D27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6923D27 second address: 6923D2B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6923D2B second address: 6923D34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6923D34 second address: 6923D76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jmp 00007FCC44D34C18h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e jmp 00007FCC44D34C18h 0x00000013 jng 00007FCC44D34C06h 0x00000019 pushad 0x0000001a popad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6923F1B second address: 6923F1F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6924389 second address: 692438F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6929643 second address: 6929655 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jnl 00007FCC4559B0E6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6929655 second address: 692966D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCC44D34C14h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 692966D second address: 69296B0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCC4559B0EDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d pushad 0x0000000e pushad 0x0000000f push esi 0x00000010 pop esi 0x00000011 jnc 00007FCC4559B0E6h 0x00000017 popad 0x00000018 jmp 00007FCC4559B0F4h 0x0000001d popad 0x0000001e mov eax, dword ptr [eax] 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 jns 00007FCC4559B0E6h 0x00000029 push edx 0x0000002a pop edx 0x0000002b popad 0x0000002c rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 69284EF second address: 69284F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 69284F4 second address: 69284F9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 69284F9 second address: 69284FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68EAEEB second address: 68EAEEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68EAEEF second address: 68EAEFC instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push edi 0x0000000a pop edi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68EAEFC second address: 68EAF04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 692D8D2 second address: 692D8D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 692DA56 second address: 692DA72 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FCC4559B0F2h 0x00000009 jnl 00007FCC4559B0E6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 692DBEA second address: 692DBF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 692E05A second address: 692E06F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FCC4559B0EEh 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 692E06F second address: 692E086 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007FCC44D34C06h 0x0000000a jmp 00007FCC44D34C0Dh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 692E086 second address: 692E08A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 692E08A second address: 692E09F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d jns 00007FCC44D34C06h 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 692E09F second address: 692E0C8 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FCC4559B0EAh 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 pushad 0x00000014 jg 00007FCC4559B0E6h 0x0000001a jno 00007FCC4559B0E6h 0x00000020 pushad 0x00000021 popad 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 692E220 second address: 692E224 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 692E224 second address: 692E23C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCC4559B0F4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 692E23C second address: 692E256 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FCC44D34C16h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6931602 second address: 693161F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jbe 00007FCC4559B0ECh 0x0000000b jo 00007FCC4559B0E6h 0x00000011 popad 0x00000012 push eax 0x00000013 jnp 00007FCC4559B0F0h 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 693161F second address: 693169D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a jng 00007FCC44D34C14h 0x00000010 pushad 0x00000011 jbe 00007FCC44D34C06h 0x00000017 je 00007FCC44D34C06h 0x0000001d popad 0x0000001e mov eax, dword ptr [eax] 0x00000020 jmp 00007FCC44D34C0Fh 0x00000025 mov dword ptr [esp+04h], eax 0x00000029 jmp 00007FCC44D34C10h 0x0000002e pop eax 0x0000002f push 00000000h 0x00000031 push edx 0x00000032 call 00007FCC44D34C08h 0x00000037 pop edx 0x00000038 mov dword ptr [esp+04h], edx 0x0000003c add dword ptr [esp+04h], 0000001Dh 0x00000044 inc edx 0x00000045 push edx 0x00000046 ret 0x00000047 pop edx 0x00000048 ret 0x00000049 push 4E2C84C8h 0x0000004e push eax 0x0000004f push edx 0x00000050 jmp 00007FCC44D34C0Eh 0x00000055 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 69317AA second address: 69317AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 69317AE second address: 69317B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 69317B4 second address: 69317BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007FCC4559B0E6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 69317BE second address: 69317E2 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FCC44D34C19h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6932443 second address: 6932460 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FCC4559B0F9h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 69325E0 second address: 69325EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007FCC44D34C06h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6932744 second address: 6932749 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6933620 second address: 6933624 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6933624 second address: 693369D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push ebp 0x0000000d call 00007FCC4559B0E8h 0x00000012 pop ebp 0x00000013 mov dword ptr [esp+04h], ebp 0x00000017 add dword ptr [esp+04h], 00000014h 0x0000001f inc ebp 0x00000020 push ebp 0x00000021 ret 0x00000022 pop ebp 0x00000023 ret 0x00000024 xor si, 0ED5h 0x00000029 push 00000000h 0x0000002b push 00000000h 0x0000002d push ebp 0x0000002e call 00007FCC4559B0E8h 0x00000033 pop ebp 0x00000034 mov dword ptr [esp+04h], ebp 0x00000038 add dword ptr [esp+04h], 0000001Dh 0x00000040 inc ebp 0x00000041 push ebp 0x00000042 ret 0x00000043 pop ebp 0x00000044 ret 0x00000045 add dword ptr [ebp+165E1F7Fh], ecx 0x0000004b push 00000000h 0x0000004d mov edi, 299F096Dh 0x00000052 mov edi, dword ptr [ebp+165E1BFCh] 0x00000058 xchg eax, ebx 0x00000059 jno 00007FCC4559B0ECh 0x0000005f push eax 0x00000060 push eax 0x00000061 push edx 0x00000062 push eax 0x00000063 push edx 0x00000064 pushad 0x00000065 popad 0x00000066 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 693369D second address: 69336B8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCC44D34C17h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6934638 second address: 6934641 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 69351D9 second address: 69351F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FCC44D34C13h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6935296 second address: 693529B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6938CA0 second address: 6938CAA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6938CAA second address: 6938CAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6939677 second address: 693968B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FCC44D34C10h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 693B8D9 second address: 693B8DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 693B8DD second address: 693B8E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 693BE2E second address: 693BE3E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCC4559B0ECh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 693BE3E second address: 693BE77 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FCC44D34C1Ah 0x00000008 jmp 00007FCC44D34C14h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jnc 00007FCC44D34C18h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 693CFD8 second address: 693CFEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edi 0x00000008 push eax 0x00000009 jng 00007FCC4559B0EEh 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 693DEF9 second address: 693DEFD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 693DEFD second address: 693DF44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a mov dword ptr [ebp+165E1952h], ecx 0x00000010 push 00000000h 0x00000012 push 00000000h 0x00000014 push esi 0x00000015 call 00007FCC4559B0E8h 0x0000001a pop esi 0x0000001b mov dword ptr [esp+04h], esi 0x0000001f add dword ptr [esp+04h], 0000001Dh 0x00000027 inc esi 0x00000028 push esi 0x00000029 ret 0x0000002a pop esi 0x0000002b ret 0x0000002c push 00000000h 0x0000002e sbb bh, FFFFFFA7h 0x00000031 and bx, 304Dh 0x00000036 push eax 0x00000037 pushad 0x00000038 push eax 0x00000039 push edx 0x0000003a push eax 0x0000003b push edx 0x0000003c rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 693DF44 second address: 693DF48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6940E19 second address: 6940E1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6940E1D second address: 6940E22 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6941ECA second address: 6941ECE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6941ECE second address: 6941F2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 pushad 0x00000008 popad 0x00000009 pop ebx 0x0000000a popad 0x0000000b nop 0x0000000c jno 00007FCC44D34C0Ch 0x00000012 push 00000000h 0x00000014 push 00000000h 0x00000016 push eax 0x00000017 call 00007FCC44D34C08h 0x0000001c pop eax 0x0000001d mov dword ptr [esp+04h], eax 0x00000021 add dword ptr [esp+04h], 00000017h 0x00000029 inc eax 0x0000002a push eax 0x0000002b ret 0x0000002c pop eax 0x0000002d ret 0x0000002e push 00000000h 0x00000030 add dword ptr [ebp+165E200Eh], esi 0x00000036 mov edi, dword ptr [ebp+165E192Eh] 0x0000003c xchg eax, esi 0x0000003d jmp 00007FCC44D34C12h 0x00000042 push eax 0x00000043 push eax 0x00000044 push edx 0x00000045 push ebx 0x00000046 push eax 0x00000047 push edx 0x00000048 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6941F2E second address: 6941F33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6943D09 second address: 6943D58 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCC44D34C0Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push ecx 0x0000000f call 00007FCC44D34C08h 0x00000014 pop ecx 0x00000015 mov dword ptr [esp+04h], ecx 0x00000019 add dword ptr [esp+04h], 00000014h 0x00000021 inc ecx 0x00000022 push ecx 0x00000023 ret 0x00000024 pop ecx 0x00000025 ret 0x00000026 sub ebx, 05168331h 0x0000002c push 00000000h 0x0000002e mov edi, dword ptr [ebp+165E2BB2h] 0x00000034 and edi, dword ptr [ebp+165E2FE5h] 0x0000003a push 00000000h 0x0000003c adc bx, DF4Fh 0x00000041 push eax 0x00000042 push eax 0x00000043 push edx 0x00000044 push eax 0x00000045 push edx 0x00000046 push ebx 0x00000047 pop ebx 0x00000048 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6943D58 second address: 6943D66 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCC4559B0EAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6945CEA second address: 6945CF4 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FCC44D34C06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6945CF4 second address: 6945CFB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6945CFB second address: 6945D09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6948AD9 second address: 6948B45 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FCC4559B0E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FCC4559B0EFh 0x0000000f popad 0x00000010 nop 0x00000011 jp 00007FCC4559B0E7h 0x00000017 push 00000000h 0x00000019 push 00000000h 0x0000001b push ebx 0x0000001c call 00007FCC4559B0E8h 0x00000021 pop ebx 0x00000022 mov dword ptr [esp+04h], ebx 0x00000026 add dword ptr [esp+04h], 0000001Dh 0x0000002e inc ebx 0x0000002f push ebx 0x00000030 ret 0x00000031 pop ebx 0x00000032 ret 0x00000033 mov di, 8CFBh 0x00000037 mov dword ptr [ebp+165E19ABh], ebx 0x0000003d push 00000000h 0x0000003f jmp 00007FCC4559B0EAh 0x00000044 mov edi, dword ptr [ebp+165E2B0Eh] 0x0000004a xchg eax, esi 0x0000004b push eax 0x0000004c push edx 0x0000004d push esi 0x0000004e pushad 0x0000004f popad 0x00000050 pop esi 0x00000051 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6948B45 second address: 6948B4A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6948B4A second address: 6948B6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 jmp 00007FCC4559B0F7h 0x0000000e push eax 0x0000000f push edx 0x00000010 push edx 0x00000011 pop edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 694A9E3 second address: 694A9E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 694A9E7 second address: 694A9FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FCC4559B0F0h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 694A9FB second address: 694A9FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 694A9FF second address: 694AA94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push eax 0x0000000c call 00007FCC4559B0E8h 0x00000011 pop eax 0x00000012 mov dword ptr [esp+04h], eax 0x00000016 add dword ptr [esp+04h], 0000001Dh 0x0000001e inc eax 0x0000001f push eax 0x00000020 ret 0x00000021 pop eax 0x00000022 ret 0x00000023 adc edi, 2D948A29h 0x00000029 xor bh, 00000012h 0x0000002c push esi 0x0000002d and di, 0006h 0x00000032 pop ebx 0x00000033 push 00000000h 0x00000035 push 00000000h 0x00000037 push ecx 0x00000038 call 00007FCC4559B0E8h 0x0000003d pop ecx 0x0000003e mov dword ptr [esp+04h], ecx 0x00000042 add dword ptr [esp+04h], 0000001Ch 0x0000004a inc ecx 0x0000004b push ecx 0x0000004c ret 0x0000004d pop ecx 0x0000004e ret 0x0000004f mov edi, dword ptr [ebp+165E2C06h] 0x00000055 push 00000000h 0x00000057 push eax 0x00000058 jo 00007FCC4559B0ECh 0x0000005e mov dword ptr [ebp+165E1D20h], esi 0x00000064 pop ebx 0x00000065 xchg eax, esi 0x00000066 push eax 0x00000067 push edx 0x00000068 jmp 00007FCC4559B0F8h 0x0000006d rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6952CEE second address: 6952CF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 695432A second address: 695432F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 69589BE second address: 69589C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 69589C3 second address: 69589CE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007FCC4559B0E6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6958A9A second address: 6958A9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6958A9F second address: 6958AA4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 68DF1F7 second address: 68DF20A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCC44D34C0Dh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 695E3EA second address: 695E3F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 695E557 second address: 695E574 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCC44D34C12h 0x00000009 push edi 0x0000000a pop edi 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 695E574 second address: 695E578 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 695E578 second address: 695E57C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 695E997 second address: 695E99B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 695E99B second address: 695E9A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 695E9A5 second address: 695E9A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 695E9A9 second address: 695E9B3 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FCC44D34C06h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 695E9B3 second address: 695E9BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 695E9BF second address: 695E9C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 695ECD3 second address: 695ECD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 69628BC second address: 69628C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 69628C0 second address: 69628D5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FCC4559B0EFh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 69628D5 second address: 69628DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 69628DB second address: 69628E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 69628E1 second address: 69628E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 693000A second address: 693000F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6930101 second address: 6930126 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FCC44D34C0Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FCC44D34C12h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6930434 second address: 693043E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007FCC4559B0E6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 693043E second address: 6782BF9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b mov dx, 2DB2h 0x0000000f push dword ptr [ebp+165E0921h] 0x00000015 mov dx, bx 0x00000018 call dword ptr [ebp+165E366Dh] 0x0000001e pushad 0x0000001f cld 0x00000020 xor eax, eax 0x00000022 mov dword ptr [ebp+165E2E33h], eax 0x00000028 pushad 0x00000029 sub si, EF37h 0x0000002e popad 0x0000002f mov edx, dword ptr [esp+28h] 0x00000033 xor dword ptr [ebp+165E2E33h], esi 0x00000039 ja 00007FCC44D34C12h 0x0000003f mov dword ptr [ebp+165E2B26h], eax 0x00000045 jmp 00007FCC44D34C12h 0x0000004a mov esi, 0000003Ch 0x0000004f jmp 00007FCC44D34C19h 0x00000054 add esi, dword ptr [esp+24h] 0x00000058 jns 00007FCC44D34C1Dh 0x0000005e lodsw 0x00000060 pushad 0x00000061 sub dword ptr [ebp+165E2E33h], edi 0x00000067 or dword ptr [ebp+165E1B84h], eax 0x0000006d popad 0x0000006e add eax, dword ptr [esp+24h] 0x00000072 xor dword ptr [ebp+165E2E33h], edx 0x00000078 jmp 00007FCC44D34C0Fh 0x0000007d mov ebx, dword ptr [esp+24h] 0x00000081 jl 00007FCC44D34C12h 0x00000087 cmc 0x00000088 nop 0x00000089 push eax 0x0000008a push edx 0x0000008b push eax 0x0000008c push edx 0x0000008d js 00007FCC44D34C06h 0x00000093 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 69304DE second address: 69304E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 69304E2 second address: 6930518 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 je 00007FCC44D34C08h 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e popad 0x0000000f mov eax, dword ptr [eax] 0x00000011 jmp 00007FCC44D34C17h 0x00000016 mov dword ptr [esp+04h], eax 0x0000001a push eax 0x0000001b push edx 0x0000001c jc 00007FCC44D34C08h 0x00000022 pushad 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6930518 second address: 693051E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 693051E second address: 69305B1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop eax 0x00000009 push 00000000h 0x0000000b push ecx 0x0000000c call 00007FCC44D34C08h 0x00000011 pop ecx 0x00000012 mov dword ptr [esp+04h], ecx 0x00000016 add dword ptr [esp+04h], 00000016h 0x0000001e inc ecx 0x0000001f push ecx 0x00000020 ret 0x00000021 pop ecx 0x00000022 ret 0x00000023 call 00007FCC44D34C09h 0x00000028 je 00007FCC44D34C10h 0x0000002e pushad 0x0000002f js 00007FCC44D34C06h 0x00000035 push edi 0x00000036 pop edi 0x00000037 popad 0x00000038 push eax 0x00000039 jmp 00007FCC44D34C11h 0x0000003e mov eax, dword ptr [esp+04h] 0x00000042 jl 00007FCC44D34C27h 0x00000048 pushad 0x00000049 jmp 00007FCC44D34C12h 0x0000004e jmp 00007FCC44D34C0Dh 0x00000053 popad 0x00000054 mov eax, dword ptr [eax] 0x00000056 push ebx 0x00000057 jo 00007FCC44D34C08h 0x0000005d pushad 0x0000005e popad 0x0000005f pop ebx 0x00000060 mov dword ptr [esp+04h], eax 0x00000064 push eax 0x00000065 push edx 0x00000066 push esi 0x00000067 push edi 0x00000068 pop edi 0x00000069 pop esi 0x0000006a rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 69305B1 second address: 69305B6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 69306CC second address: 69306D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 69306D0 second address: 69306F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FCC4559B0F3h 0x0000000b popad 0x0000000c push eax 0x0000000d js 00007FCC4559B100h 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 69307E0 second address: 69307FB instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edi 0x0000000a popad 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f pushad 0x00000010 push ecx 0x00000011 jp 00007FCC44D34C06h 0x00000017 pop ecx 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6930954 second address: 693095E instructions: 0x00000000 rdtsc 0x00000002 jc 00007FCC4559B0ECh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 693095E second address: 6930974 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 jmp 00007FCC44D34C0Ah 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6930974 second address: 6930978 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6930A9F second address: 6930AA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6930AA6 second address: 6930B1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push edx 0x0000000c call 00007FCC4559B0E8h 0x00000011 pop edx 0x00000012 mov dword ptr [esp+04h], edx 0x00000016 add dword ptr [esp+04h], 00000014h 0x0000001e inc edx 0x0000001f push edx 0x00000020 ret 0x00000021 pop edx 0x00000022 ret 0x00000023 add dword ptr [ebp+165E19ABh], edi 0x00000029 push 00000004h 0x0000002b push 00000000h 0x0000002d push edi 0x0000002e call 00007FCC4559B0E8h 0x00000033 pop edi 0x00000034 mov dword ptr [esp+04h], edi 0x00000038 add dword ptr [esp+04h], 00000015h 0x00000040 inc edi 0x00000041 push edi 0x00000042 ret 0x00000043 pop edi 0x00000044 ret 0x00000045 jmp 00007FCC4559B0F5h 0x0000004a nop 0x0000004b jmp 00007FCC4559B0ECh 0x00000050 push eax 0x00000051 push eax 0x00000052 push edx 0x00000053 push ecx 0x00000054 jnp 00007FCC4559B0E6h 0x0000005a pop ecx 0x0000005b rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6931268 second address: 693126E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 693126E second address: 6931272 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6931272 second address: 693128F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FCC44D34C12h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 690D963 second address: 690D97B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCC4559B0ECh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jp 00007FCC4559B0ECh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6962E29 second address: 6962E2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6962E2D second address: 6962E37 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FCC4559B0E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6962E37 second address: 6962E72 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 js 00007FCC44D34C06h 0x00000009 pushad 0x0000000a popad 0x0000000b jl 00007FCC44D34C06h 0x00000011 popad 0x00000012 jne 00007FCC44D34C22h 0x00000018 pop edx 0x00000019 pop eax 0x0000001a pushad 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6963010 second address: 696301B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007FCC4559B0E6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 696301B second address: 6963037 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jmp 00007FCC44D34C0Dh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6963037 second address: 696303B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 696303B second address: 696305B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FCC44D34C17h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 696305B second address: 6963060 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6963060 second address: 6963081 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FCC44D34C0Ah 0x00000009 jmp 00007FCC44D34C13h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6963081 second address: 6963085 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 69634BC second address: 69634C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 69634C0 second address: 69634C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 69634C6 second address: 69634E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FCC44D34C0Ah 0x0000000e jng 00007FCC44D34C0Eh 0x00000014 pushad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 69634E3 second address: 69634E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 696900A second address: 6969016 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 pop eax 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6969016 second address: 6969039 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FCC4559B0F0h 0x00000009 jmp 00007FCC4559B0EFh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6969039 second address: 696905B instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FCC44D34C06h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FCC44D34C11h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6969325 second address: 6969341 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FCC4559B0F2h 0x00000008 ja 00007FCC4559B0E6h 0x0000000e jbe 00007FCC4559B0E6h 0x00000014 jc 00007FCC4559B0F8h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6968D53 second address: 6968D5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FCC44D34C06h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6968D5F second address: 6968D71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 jnc 00007FCC4559B0E6h 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6969A6F second address: 6969A83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push edx 0x00000006 jmp 00007FCC44D34C0Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6969A83 second address: 6969A8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push edx 0x00000006 push edi 0x00000007 pop edi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 696A039 second address: 696A055 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCC44D34C12h 0x00000007 js 00007FCC44D34C0Eh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 696FF0C second address: 696FF10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 696FF10 second address: 696FF2E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 js 00007FCC44D34C06h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ecx 0x0000000d jmp 00007FCC44D34C10h 0x00000012 pop ecx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 696FF2E second address: 696FF34 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 696FF34 second address: 696FF38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 696FF38 second address: 696FF42 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FCC4559B0E6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 696FF42 second address: 696FF4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 696FF4B second address: 696FF79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jo 00007FCC4559B0E6h 0x0000000c jmp 00007FCC4559B0EBh 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 push eax 0x00000015 push edx 0x00000016 push ecx 0x00000017 pushad 0x00000018 popad 0x00000019 pop ecx 0x0000001a jno 00007FCC4559B0EEh 0x00000020 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 696EAD3 second address: 696EAD8 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 696EE64 second address: 696EE68 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 696F278 second address: 696F2A2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCC44D34C0Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ecx 0x0000000a pushad 0x0000000b popad 0x0000000c pop ecx 0x0000000d jmp 00007FCC44D34C0Bh 0x00000012 push eax 0x00000013 push edx 0x00000014 je 00007FCC44D34C06h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 696F549 second address: 696F573 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCC4559B0F9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007FCC4559B0E8h 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 pushad 0x00000013 push eax 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 696F573 second address: 696F579 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 696F579 second address: 696F581 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 696FD7F second address: 696FD85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 696FD85 second address: 696FD89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 696FD89 second address: 696FD8D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 696FD8D second address: 696FDB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007FCC4559B0F5h 0x00000010 jbe 00007FCC4559B0E6h 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 696FDB8 second address: 696FDC2 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FCC44D34C06h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6979CDC second address: 6979CE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6979CE2 second address: 6979CE6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6979CE6 second address: 6979CEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6979CEC second address: 6979D04 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FCC44D34C0Eh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edi 0x0000000e pop edi 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6979D04 second address: 6979D0D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6979D0D second address: 6979D13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6979701 second address: 6979706 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6986984 second address: 6986988 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6986988 second address: 69869A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007FCC4559B0F6h 0x0000000c jmp 00007FCC4559B0F0h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 698529A second address: 69852A0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 698558D second address: 6985597 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FCC4559B0E6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6985597 second address: 69855A3 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a push edi 0x0000000b pop edi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 69855A3 second address: 69855B1 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FCC4559B0E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 69855B1 second address: 69855BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FCC44D34C06h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 69855BB second address: 69855DD instructions: 0x00000000 rdtsc 0x00000002 jo 00007FCC4559B0E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007FCC4559B0F1h 0x00000010 pushad 0x00000011 popad 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6985734 second address: 698574D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCC44D34C0Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jg 00007FCC44D34C08h 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 698574D second address: 6985752 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 69859E1 second address: 69859E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 69859E5 second address: 69859F2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push ecx 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6930D1C second address: 6930D70 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCC44D34C14h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a add edx, 735726AFh 0x00000010 mov ebx, dword ptr [ebp+16790D0Fh] 0x00000016 and edx, 217AE1CAh 0x0000001c add eax, ebx 0x0000001e push 00000000h 0x00000020 push ebp 0x00000021 call 00007FCC44D34C08h 0x00000026 pop ebp 0x00000027 mov dword ptr [esp+04h], ebp 0x0000002b add dword ptr [esp+04h], 00000014h 0x00000033 inc ebp 0x00000034 push ebp 0x00000035 ret 0x00000036 pop ebp 0x00000037 ret 0x00000038 sub dword ptr [ebp+165E19DBh], edi 0x0000003e push eax 0x0000003f pushad 0x00000040 push eax 0x00000041 push eax 0x00000042 push edx 0x00000043 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 69866FC second address: 6986710 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCC4559B0EEh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6988129 second address: 698812D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 698CC3F second address: 698CC5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop ebx 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FCC4559B0EFh 0x0000000e jg 00007FCC4559B0E6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 698CC5D second address: 698CC7B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCC44D34C12h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jo 00007FCC44D34C0Ch 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 698CC7B second address: 698CC9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jmp 00007FCC4559B0F9h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 698CF1A second address: 698CF25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 698CF25 second address: 698CF3C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FCC4559B0F1h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 698CF3C second address: 698CF5A instructions: 0x00000000 rdtsc 0x00000002 jo 00007FCC44D34C19h 0x00000008 jmp 00007FCC44D34C11h 0x0000000d push esi 0x0000000e pop esi 0x0000000f push esi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6992D18 second address: 6992D1E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6992D1E second address: 6992D31 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jng 00007FCC44D34C10h 0x0000000e push esi 0x0000000f push esi 0x00000010 pop esi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6992E6C second address: 6992E72 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6992E72 second address: 6992E78 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6992E78 second address: 6992E7C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6992FC2 second address: 6992FCD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6992FCD second address: 6993000 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a jng 00007FCC4559B0E6h 0x00000010 jmp 00007FCC4559B0F1h 0x00000015 jmp 00007FCC4559B0EBh 0x0000001a jns 00007FCC4559B0E6h 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 699389D second address: 69938A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 69938A3 second address: 69938A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6994156 second address: 699415E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 699415E second address: 6994162 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6994162 second address: 699416C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 699416C second address: 6994170 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 69949DA second address: 69949DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 69949DE second address: 69949F3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCC4559B0F1h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 699B9B7 second address: 699B9BC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 699FDEE second address: 699FDF2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 699EF38 second address: 699EF3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 699F1FC second address: 699F202 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 699F202 second address: 699F20B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 699F20B second address: 699F210 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 699F210 second address: 699F235 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007FCC44D34C0Ah 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FCC44D34C13h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 699F235 second address: 699F23C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 699F37B second address: 699F392 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCC44D34C13h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 699F534 second address: 699F53D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 69A7E08 second address: 69A7E19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FCC44D34C06h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 69A7E19 second address: 69A7E48 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FCC4559B0E6h 0x00000008 je 00007FCC4559B0E6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 push ecx 0x00000016 pop ecx 0x00000017 jmp 00007FCC4559B0F8h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 69A7E48 second address: 69A7E4C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 69A7E4C second address: 69A7E55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 69A7E55 second address: 69A7E5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 69A7E5A second address: 69A7E60 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 69A7E60 second address: 69A7E66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 69A6516 second address: 69A651A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 69A651A second address: 69A6530 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FCC44D34C06h 0x00000008 jg 00007FCC44D34C06h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 69A6694 second address: 69A669E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FCC4559B0E6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 69A669E second address: 69A66A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 69A66A4 second address: 69A66DC instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007FCC4559B0F8h 0x00000008 jmp 00007FCC4559B0F2h 0x0000000d pop esi 0x0000000e push eax 0x0000000f push edx 0x00000010 ja 00007FCC4559B0E6h 0x00000016 push eax 0x00000017 pop eax 0x00000018 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 69A6A03 second address: 69A6A07 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 69A6A07 second address: 69A6A0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 69A6A0D second address: 69A6A12 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 69A5AF5 second address: 69A5B1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jmp 00007FCC4559B0F8h 0x0000000a pushad 0x0000000b jc 00007FCC4559B0E6h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 69A5B1B second address: 69A5B27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FCC44D34C06h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 69A5B27 second address: 69A5B38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 jp 00007FCC4559B0E6h 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 69A5B38 second address: 69A5B5A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCC44D34C14h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jnl 00007FCC44D34C06h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 69A5B5A second address: 69A5B7E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FCC4559B0F4h 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f jne 00007FCC4559B0E6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 69A5B7E second address: 69A5B82 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 69A5B82 second address: 69A5B88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 69BA370 second address: 69BA37C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 69BA37C second address: 69BA38C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a push edi 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f pop edi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 69BA38C second address: 69BA392 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 69BA392 second address: 69BA396 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 69B934F second address: 69B935C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 jo 00007FCC44D34C06h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 69B967E second address: 69B9682 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 69B9682 second address: 69B9686 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 69B996B second address: 69B9971 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 69B9C2A second address: 69B9C58 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCC44D34C0Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007FCC44D34C17h 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 69B9C58 second address: 69B9C5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 69BB9FB second address: 69BBA01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 69BFAFE second address: 69BFB03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 69BFB03 second address: 69BFB0D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007FCC44D34C06h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 69BFB0D second address: 69BFB11 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 69BF59D second address: 69BF5AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCC44D34C0Ah 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 69C4793 second address: 69C47C2 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FCC4559B0E6h 0x00000008 js 00007FCC4559B0E6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 jl 00007FCC4559B0E6h 0x00000017 jmp 00007FCC4559B0F5h 0x0000001c push ecx 0x0000001d pop ecx 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 69C3448 second address: 69C3451 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 69C3451 second address: 69C349A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCC4559B0F0h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007FCC4559B0F4h 0x00000010 pushad 0x00000011 jbe 00007FCC4559B0E6h 0x00000017 jmp 00007FCC4559B0F6h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 69C3613 second address: 69C3617 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 69C376A second address: 69C3770 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 69C3770 second address: 69C3775 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 69C3775 second address: 69C378C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007FCC4559B0ECh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 69C378C second address: 69C37AB instructions: 0x00000000 rdtsc 0x00000002 jo 00007FCC44D34C06h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 jne 00007FCC44D34C06h 0x00000017 jo 00007FCC44D34C06h 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 69C37AB second address: 69C37B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 69C37B0 second address: 69C37BA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007FCC44D34C06h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 69C37BA second address: 69C37D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jmp 00007FCC4559B0EBh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edi 0x0000000c jnc 00007FCC4559B0E6h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 69F8017 second address: 69F8021 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FCC44D34C06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 69F8021 second address: 69F802B instructions: 0x00000000 rdtsc 0x00000002 jl 00007FCC4559B0F2h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 69F802B second address: 69F8039 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FCC44D34C06h 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 69F8039 second address: 69F803F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 69F803F second address: 69F8043 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 69F92B2 second address: 69F92D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FCC4559B0E6h 0x0000000a pop edi 0x0000000b jmp 00007FCC4559B0F8h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 69F92D5 second address: 69F92DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 69F92DA second address: 69F9314 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FCC4559B0E6h 0x0000000a pop eax 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f pop eax 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 pop edx 0x00000014 pop eax 0x00000015 push edi 0x00000016 pushad 0x00000017 jg 00007FCC4559B0E6h 0x0000001d jmp 00007FCC4559B0F6h 0x00000022 popad 0x00000023 push eax 0x00000024 push edx 0x00000025 pushad 0x00000026 popad 0x00000027 pushad 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 69F9314 second address: 69F9318 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 69C9121 second address: 69C9125 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 69C9125 second address: 69C912F instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FCC44D34C06h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 69C912F second address: 69C9135 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 69F9BA5 second address: 69F9BA9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 69FEA50 second address: 69FEA99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jmp 00007FCC4559B0EAh 0x0000000b popad 0x0000000c push ebx 0x0000000d jmp 00007FCC4559B0F9h 0x00000012 jns 00007FCC4559B0E6h 0x00000018 pop ebx 0x00000019 pop edi 0x0000001a push ecx 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007FCC4559B0F3h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6A1AAD6 second address: 6A1AAF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jo 00007FCC44D34C0Ch 0x0000000b js 00007FCC44D34C06h 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FCC44D34C0Bh 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6A1AAF6 second address: 6A1AAFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6A253AA second address: 6A253CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCC44D34C11h 0x00000009 popad 0x0000000a jg 00007FCC44D34C0Eh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6A2AE7D second address: 6A2AE93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 push ecx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop ecx 0x0000000b popad 0x0000000c pushad 0x0000000d pushad 0x0000000e jp 00007FCC4559B0E6h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6A2AE93 second address: 6A2AE9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6A2AE9B second address: 6A2AEAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jc 00007FCC4559B0E6h 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6A2B006 second address: 6A2B00A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6A2B121 second address: 6A2B127 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6A2B127 second address: 6A2B12D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6A2B12D second address: 6A2B133 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6A2B133 second address: 6A2B137 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6A2BBA7 second address: 6A2BBBF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCC4559B0F1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6A2BBBF second address: 6A2BBC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6A2C34D second address: 6A2C359 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007FCC4559B0E6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6A2C359 second address: 6A2C35D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6A2C4C3 second address: 6A2C4EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCC4559B0EEh 0x00000009 jmp 00007FCC4559B0F5h 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6A43148 second address: 6A43152 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FCC44D34C06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6A43152 second address: 6A43158 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6A43241 second address: 6A43257 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FCC44D34C0Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6A43257 second address: 6A4325B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6A65971 second address: 6A6597D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jbe 00007FCC44D34C06h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6A6597D second address: 6A6599C instructions: 0x00000000 rdtsc 0x00000002 jo 00007FCC4559B0E6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jmp 00007FCC4559B0EAh 0x00000012 jo 00007FCC4559B0ECh 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6A65211 second address: 6A65216 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6782F8B second address: 6782F99 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FCC4559B0E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6782F99 second address: 6782F9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6A7E6F9 second address: 6A7E728 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCC4559B0F9h 0x00000009 jmp 00007FCC4559B0F1h 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6A7E728 second address: 6A7E76C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCC44D34C12h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jnl 00007FCC44D34C12h 0x00000010 push eax 0x00000011 push edx 0x00000012 jns 00007FCC44D34C06h 0x00000018 jmp 00007FCC44D34C13h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6A7E88C second address: 6A7E892 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6A7E892 second address: 6A7E89E instructions: 0x00000000 rdtsc 0x00000002 jc 00007FCC44D34C06h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6A7E89E second address: 6A7E8A9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jc 00007FCC4559B0E6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6A7E8A9 second address: 6A7E8C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 pushad 0x00000007 popad 0x00000008 je 00007FCC44D34C06h 0x0000000e pop ebx 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6A7E8C0 second address: 6A7E8C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6A7E8C4 second address: 6A7E8C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6A7E8C8 second address: 6A7E8D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6A7E8D0 second address: 6A7E8D5 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6A7ECA4 second address: 6A7ECA8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6A7ECA8 second address: 6A7ECAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6A824F3 second address: 6A824FD instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FCC4559B0F2h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6A824FD second address: 6A8250E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FCC44D34C06h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edi 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6A8250E second address: 6A82512 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6A82809 second address: 6A8282F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCC44D34C0Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FCC44D34C15h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6A8282F second address: 6A82835 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6A829DB second address: 6A829E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6A82B3C second address: 6A82B50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCC4559B0F0h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6A82B50 second address: 6A82B66 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCC44D34C0Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jno 00007FCC44D34C08h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6A82CF2 second address: 6A82D10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCC4559B0EBh 0x00000009 pop edi 0x0000000a pop edi 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e jng 00007FCC4559B0E6h 0x00000014 pushad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6A82D10 second address: 6A82D15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6A82D15 second address: 6A82D32 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FCC4559B0F8h 0x00000008 jmp 00007FCC4559B0F2h 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6A82D32 second address: 6A82D4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCC44D34C17h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6A82E67 second address: 6A82E6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6A82E6B second address: 6A82E77 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FCC44D34C06h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6A82E77 second address: 6A82E86 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007FCC4559B0EAh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6A82E86 second address: 6A82E93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jc 00007FCC44D34C23h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6A87F10 second address: 6A87F14 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6A8BB47 second address: 6A8BB51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FCC44D34C06h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6A8F033 second address: 6A8F044 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 jmp 00007FCC4559B0EBh 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6AF1AA5 second address: 6AF1AA9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6AF1AA9 second address: 6AF1AAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6AF1AAF second address: 6AF1AB9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007FCC44D34C06h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6AF53E4 second address: 6AF540B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push ecx 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007FCC4559B0F2h 0x00000011 pop ecx 0x00000012 push eax 0x00000013 push edx 0x00000014 jnc 00007FCC4559B0E6h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6B0269A second address: 6B026A5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6B026A5 second address: 6B026F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop esi 0x00000006 pushad 0x00000007 jmp 00007FCC4559B0F6h 0x0000000c jmp 00007FCC4559B0F9h 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FCC4559B0F5h 0x00000018 jnc 00007FCC4559B0E6h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6B026F8 second address: 6B02704 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6B06AA5 second address: 6B06ABD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCC4559B0F2h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6B06ABD second address: 6B06AC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6B2A457 second address: 6B2A45B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6B3152E second address: 6B31537 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6B31537 second address: 6B3153B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6B31687 second address: 6B3169F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FCC44D34C14h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6B31836 second address: 6B3184E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCC4559B0F3h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6B3184E second address: 6B31879 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCC44D34C0Bh 0x00000007 push ebx 0x00000008 jmp 00007FCC44D34C13h 0x0000000d pop ebx 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6B31879 second address: 6B3187D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6B32340 second address: 6B32350 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jmp 00007FCC44D34C0Ah 0x0000000b rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6B32350 second address: 6B32367 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FCC4559B0EFh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6B32367 second address: 6B3239C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a js 00007FCC44D34C2Fh 0x00000010 push edi 0x00000011 jbe 00007FCC44D34C06h 0x00000017 jmp 00007FCC44D34C15h 0x0000001c pop edi 0x0000001d js 00007FCC44D34C0Ch 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6B32EE0 second address: 6B32EE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6B32EE4 second address: 6B32EEE instructions: 0x00000000 rdtsc 0x00000002 jo 00007FCC44D34C06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6B32EEE second address: 6B32F11 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FCC4559B0F5h 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007FCC4559B0EDh 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jo 00007FCC4559B0F2h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6B32F11 second address: 6B32F1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FCC44D34C06h 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6B32F1F second address: 6B32F25 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6B33201 second address: 6B33205 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6B33205 second address: 6B33209 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6B33209 second address: 6B3320F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6A4B41C second address: 6A4B420 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6A4B420 second address: 6A4B434 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCC44D34C0Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6A4B434 second address: 6A4B456 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FCC4559B0E6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FCC4559B0F3h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6A4B456 second address: 6A4B45A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6A4A522 second address: 6A4A528 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6A4A528 second address: 6A4A52D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6A6090A second address: 6A6090E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6A6090E second address: 6A60914 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6A60914 second address: 6A6092F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FCC4559B0F2h 0x0000000b push esi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6A6092F second address: 6A60935 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6A60935 second address: 6A60945 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 jp 00007FCC4559B0E8h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6A5F90C second address: 6A5F93E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FCC44D34C15h 0x0000000d jmp 00007FCC44D34C15h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6A07300 second address: 6A07318 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCC4559B0F3h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6A07318 second address: 6A0731E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6A5FBB3 second address: 6A5FC02 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCC4559B0F6h 0x00000007 jno 00007FCC4559B0ECh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push ebx 0x00000010 pushad 0x00000011 push esi 0x00000012 pop esi 0x00000013 jbe 00007FCC4559B0E6h 0x00000019 jmp 00007FCC4559B0EFh 0x0000001e popad 0x0000001f pushad 0x00000020 jno 00007FCC4559B0E6h 0x00000026 jl 00007FCC4559B0E6h 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6A4A79C second address: 6A4A7A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6A4A7A1 second address: 6A4A7B7 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FCC4559B0EEh 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a jns 00007FCC4559B0E6h 0x00000010 push eax 0x00000011 push edx 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 push esi 0x00000015 pop esi 0x00000016 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6A4B28D second address: 6A4B291 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6A4B291 second address: 6A4B2D4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCC4559B0F6h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007FCC4559B0F9h 0x00000010 jmp 00007FCC4559B0EAh 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6A4B2D4 second address: 6A4B2D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6A553F0 second address: 6A553F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6A553F4 second address: 6A55401 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push ebx 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6A55401 second address: 6A55419 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCC4559B0EFh 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6A55419 second address: 6A5541F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6A546D3 second address: 6A546E7 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push esi 0x00000004 pop esi 0x00000005 jmp 00007FCC4559B0EAh 0x0000000a pop esi 0x0000000b push eax 0x0000000c push edx 0x0000000d push edx 0x0000000e pop edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6A546E7 second address: 6A546EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6A616FA second address: 6A61700 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6A61700 second address: 6A61711 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b ja 00007FCC44D34C06h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6A61711 second address: 6A61715 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6A61715 second address: 6A6171E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6A6171E second address: 6A61723 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6A54B40 second address: 6A54B44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6A54B44 second address: 6A54B5F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCC4559B0F7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6A0EE2F second address: 6A0EE35 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6A0EE35 second address: 6A0EE3E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6A0EB38 second address: 6A0EB4E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FCC44D34C10h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6A0EB4E second address: 6A0EB71 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push esi 0x00000004 pop esi 0x00000005 jnl 00007FCC4559B0E6h 0x0000000b pop eax 0x0000000c jmp 00007FCC4559B0ECh 0x00000011 pop edx 0x00000012 pop eax 0x00000013 push edi 0x00000014 push eax 0x00000015 push edx 0x00000016 pop edx 0x00000017 pop eax 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6A0EB71 second address: 6A0EB80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCC44D34C0Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6A0EB80 second address: 6A0EB84 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6A54CD8 second address: 6A54CDC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6A54E2A second address: 6A54E2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6A54E2E second address: 6A54E3D instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jg 00007FCC44D34C06h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6A54E3D second address: 6A54E43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6A5526F second address: 6A552A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007FCC44D34C19h 0x0000000b jmp 00007FCC44D34C13h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6A4A922 second address: 6A4A928 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6A4A928 second address: 6A4A947 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a push edi 0x0000000b pop edi 0x0000000c jmp 00007FCC44D34C0Fh 0x00000011 pop ebx 0x00000012 push ecx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6A4A947 second address: 6A4A94E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ecx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6A4A94E second address: 6A4A953 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6A4AF0B second address: 6A4AF0F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6A4AF0F second address: 6A4AF3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCC44D34C10h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007FCC44D34C16h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6A4AF3B second address: 6A4AF40 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6B43B39 second address: 6B43B79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 jmp 00007FCC44D34C11h 0x0000000b popad 0x0000000c jmp 00007FCC44D34C19h 0x00000011 push edx 0x00000012 jmp 00007FCC44D34C0Ch 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6B43CB1 second address: 6B43CB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6B43CB5 second address: 6B43CD2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCC44D34C17h 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6B43F52 second address: 6B43F92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FCC4559B0E6h 0x0000000a popad 0x0000000b js 00007FCC4559B0F9h 0x00000011 jmp 00007FCC4559B0F3h 0x00000016 pop ecx 0x00000017 push esi 0x00000018 jmp 00007FCC4559B0F6h 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6B43F92 second address: 6B43F96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6B444A8 second address: 6B444BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCC4559B0F1h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6B444BD second address: 6B444C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6B444C1 second address: 6B444C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6B4461F second address: 6B44638 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FCC44D34C15h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 69AB537 second address: 69AB53B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 69AB53B second address: 69AB53F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 69AB53F second address: 69AB54B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a push edx 0x0000000b pop edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6A51765 second address: 6A517A1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCC44D34C14h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jp 00007FCC44D34C0Ch 0x0000000f jmp 00007FCC44D34C15h 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6A517A1 second address: 6A517A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6A517A7 second address: 6A517AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6A517AD second address: 6A517B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6A517B3 second address: 6A517C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a pop edx 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6A517C0 second address: 6A517C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6A517C4 second address: 6A517E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCC44D34C12h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jno 00007FCC44D34C06h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6A517E5 second address: 6A517ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6A517ED second address: 6A517FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 ja 00007FCC44D34C0Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6A0B244 second address: 6A0B261 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 push esi 0x00000007 pushad 0x00000008 jnl 00007FCC4559B0E6h 0x0000000e jmp 00007FCC4559B0EBh 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6A0AF50 second address: 6A0AF56 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6A0AF56 second address: 6A0AF5E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6A0AF5E second address: 6A0AF62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6A0AF62 second address: 6A0AF66 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6A51A6A second address: 6A51A70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6A51A70 second address: 6A51A82 instructions: 0x00000000 rdtsc 0x00000002 js 00007FCC4559B0E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop esi 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 push esi 0x00000011 pop esi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6A51BDA second address: 6A51BDF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6A51BDF second address: 6A51BEE instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FCC4559B0E8h 0x00000008 pushad 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6B48B30 second address: 6B48B42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FCC44D34C06h 0x0000000a pop eax 0x0000000b pop ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6B48B42 second address: 6B48B46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6B48B46 second address: 6B48B4A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6B48B4A second address: 6B48B66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FCC4559B0F2h 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6B48B66 second address: 6B48B7D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FCC44D34C11h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6B48B7D second address: 6B48B82 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6B48B82 second address: 6B48BAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCC44D34C0Bh 0x00000009 jmp 00007FCC44D34C0Ch 0x0000000e popad 0x0000000f jbe 00007FCC44D34C12h 0x00000015 jg 00007FCC44D34C06h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6B48F7E second address: 6B48F82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6B48F82 second address: 6B48F88 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6B48F88 second address: 6B48FC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FCC4559B0F5h 0x0000000b jmp 00007FCC4559B0F5h 0x00000010 pushad 0x00000011 jnp 00007FCC4559B0E6h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6B4636D second address: 6B463A5 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FCC44D34C06h 0x00000008 jl 00007FCC44D34C06h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 ja 00007FCC44D34C12h 0x00000016 popad 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007FCC44D34C10h 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6B463A5 second address: 6B463A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6B46560 second address: 6B46566 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6B46807 second address: 6B4680B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 69B477E second address: 69B479E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FCC44D34C13h 0x00000008 jl 00007FCC44D34C06h 0x0000000e push esi 0x0000000f pop esi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6B492C4 second address: 6B492EE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jl 00007FCC4559B0EAh 0x0000000e pushad 0x0000000f popad 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 pop eax 0x00000016 jmp 00007FCC4559B0F4h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6B5292F second address: 6B5295C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCC44D34C19h 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FCC44D34C10h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6B5295C second address: 6B52962 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6B626AA second address: 6B62719 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FCC44D34C12h 0x0000000b push edi 0x0000000c jmp 00007FCC44D34C0Ch 0x00000011 jmp 00007FCC44D34C12h 0x00000016 pop edi 0x00000017 jmp 00007FCC44D34C0Ah 0x0000001c popad 0x0000001d push eax 0x0000001e push edx 0x0000001f jne 00007FCC44D34C0Eh 0x00000025 pushad 0x00000026 jp 00007FCC44D34C06h 0x0000002c jmp 00007FCC44D34C12h 0x00000031 push ecx 0x00000032 pop ecx 0x00000033 popad 0x00000034 rdtsc
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe RDTSC instruction interceptor: First address: 6B6151C second address: 6B61520 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Tries to evade debugger and weak emulator (self modifying code)
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Special instruction interceptor: First address: 6782C7A instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Special instruction interceptor: First address: 67806C6 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Special instruction interceptor: First address: 694EC50 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Special instruction interceptor: First address: 6A203EE instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Special instruction interceptor: First address: 6A42B0D instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Special instruction interceptor: First address: 6A42B6D instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Special instruction interceptor: First address: 6A42BC7 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Special instruction interceptor: First address: 6A42C12 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Special instruction interceptor: First address: 6A42C6C instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Special instruction interceptor: First address: 6A42CEF instructions caused by: Self-modifying code
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Memory allocated: 97E0000 memory reserve | memory write watch
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Memory allocated: E000000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Memory allocated: E1A0000 memory reserve | memory write watch
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Memory allocated: E1C0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Memory allocated: 12CB0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Memory allocated: 12D10000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Memory allocated: 12DB0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Memory allocated: 12DF0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Memory allocated: 12E30000 memory commit | memory reserve | memory write watch
Contains capabilities to detect virtual machines
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion Jump to behavior
Found dropped PE file which has not been started or loaded
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\404_05690000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\404_00c20000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\404_05640000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\404_05c70000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\modified\@APPDATA@\Movavi Slideshow Maker 4\platforms\qwindows.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\404_00610000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\404_05610000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\404_00650000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\404_05c20000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\404_6eb40000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\404_04560000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\404_04150000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\404_65200000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\404_04050000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\404_05ea0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\404_00bb0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\404_01020000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\404_05760000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\404_6c0a0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\404_05360000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\404_04090000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\404_64000000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\404_040c0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\404_05580000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\404_00b30000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\404_058c0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\404_06330000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\404_06110000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\modified\@APPDATA@\Movavi Slideshow Maker 4\imageformats\qjpeg.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\404_688d0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\404_04010000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\404_00730000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\404_05ab0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\404_044d0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\404_042c0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\404_6b5b0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\404_04210000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\404_056d0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\404_058e0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\404_06390000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\404_05ae0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\404_013c0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\404_65bc0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\404_054d0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\404_6b080000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\404_050a0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\modified\@APPDATA@\Movavi Slideshow Maker 4\imageformats\qgif.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\404_05490000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\404_66980000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\404_045b0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\404_6a8b0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\modified\@APPDATA@\Movavi Slideshow Maker 4\SlideshowMaker.exe Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\404_6d280000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\404_05860000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\404_06210000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\404_6b300000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\404_03940000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\404_690a0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\404_06240000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\404_05820000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\404_01260000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\404_00400000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\404_03f50000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\404_041b0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\404_03db0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\404_6ca20000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\404_04340000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\404_05ca0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\404_03ef0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\404_04270000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\404_64b40000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\404_6a200000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\404_6bc10000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\404_05540000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\404_6a670000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\404_05450000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\404_69f70000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\404_63180000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\404_68b50000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\404_69bb0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\modified\@APPDATA@\Movavi Slideshow Maker 4\imageformats\qtiff.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\404_05d10000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\404_05f30000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\404_05f90000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\404_69fc0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\404_008e0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\404_05720000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\404_01390000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\404_05be0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\404_04760000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\404_06280000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\404_055c0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\404_04510000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\404_004e0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\404_6c590000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\404_010a0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\404_05f00000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\404_057f0000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\404_62c80000_tls.dll Jump to dropped file
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Dropped PE file which has not been started: C:\Users\user\Desktop\Data\local\temp\404_69df0000_tls.dll Jump to dropped file
Queries disk information (often used to detect virtual machines)
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File opened: PhysicalDrive0 Jump to behavior
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe File opened: C:\Users\user\AppData\Local\Temp\SPOON\CACHE\ Jump to behavior
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe File opened: C:\Users\user\AppData\Local\Temp\SPOON\ Jump to behavior
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe File opened: C:\Users\user\AppData\Local\Temp\ Jump to behavior
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe File opened: C:\Users\user\AppData\Local\ Jump to behavior
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe File opened: C:\Users\user\AppData\Local\Temp\SPOON\CACHE\0x34D1186B27098351\ Jump to behavior
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe File opened: C:\Users\user\ Jump to behavior
Source: Movavi Slideshow Maker 4.exe, 00000000.00000002.2953083712.00000000036F8000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
Source: Movavi Slideshow Maker 4.exe, 00000000.00000002.2951475363.0000000002D1F000.00000004.00000020.00020000.00000000.sdmp, Movavi Slideshow Maker 4.exe, 00000000.00000002.2951475363.0000000002CE4000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: Movavi Slideshow Maker 4.exe, 00000000.00000002.2951800952.0000000002D73000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: ??SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}oy
Source: Movavi Slideshow Maker 4.exe, 00000000.00000002.2951800952.0000000002D73000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}y
Source: Movavi Slideshow Maker 4.exe, 00000000.00000003.1706212885.0000000002CFB000.00000004.00000020.00020000.00000000.sdmp, Movavi Slideshow Maker 4.exe, 00000000.00000003.1706363049.0000000002D14000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe System information queried: ModuleInformation
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Process information queried: ProcessInformation

Anti Debugging
barindex
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe System information queried: CodeIntegrityInformation Jump to behavior
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe System information queried: CodeIntegrityInformation Jump to behavior
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe System information queried: CodeIntegrityInformation Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe System information queried: CodeIntegrityInformation
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe System information queried: CodeIntegrityInformation
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe System information queried: CodeIntegrityInformation
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe System information queried: CodeIntegrityInformation
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe System information queried: CodeIntegrityInformation
Hides threads from debuggers
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Thread information set: HideFromDebugger Jump to behavior
Tries to detect sandboxes and other dynamic analysis tools (window names)
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Open window title or class name: file monitor - sysinternals: www.sysinternals.com
Checks for debuggers (devices)
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File opened: NTICE
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File opened: SICE
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe File opened: SIWVID
Checks for kernel debuggers (NtQuerySystemInformation(SystemKernelDebuggerInformation))
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe System information queried: KernelDebuggerInformation Jump to behavior
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Memory allocated: page read and write | page guard

HIPS / PFW / Operating System Protection Evasion
barindex
Writes to foreign memory regions
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe Memory written: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe base: 35CFE0 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe Process created: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe "C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe" /864A627C-C6B2-464A-AA13-25D62F282BD8 Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Queries volume information: C:\Users\user\AppData\Roaming VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Queries volume information: C:\Users\user\AppData\Roaming VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Queries volume information: C:\ProgramData VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Queries volume information: C:\Users\user\AppData\Roaming VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Queries volume information: C:\Users\user\AppData\Roaming VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Queries volume information: C:\Users\user\AppData\Roaming VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Queries volume information: C:\Users\user\AppData\Roaming VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Queries volume information: C:\Users\user\AppData\Roaming VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Queries volume information: C:\Users\user\AppData\Roaming VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Queries volume information: C:\Users\user\AppData\Roaming VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Queries volume information: C:\Users\user\AppData\Roaming VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Queries volume information: C:\Users\user\AppData\Roaming VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Queries volume information: C:\Users\user\AppData\Roaming VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Data\local\stubexe\0x62CA35A75D236236\SlideshowMaker.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Movavi Slideshow Maker 4.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1541910 Sample: Movavi Slideshow Maker 4.exe Startdate: 25/10/2024 Architecture: WINDOWS Score: 72 30 start.turbo.net 2->30 32 mip2.movavi.com 2->32 34 4 other IPs or domains 2->34 6 Movavi Slideshow Maker 4.exe 1 493 2->6         started        process3 dnsIp4 36 start.turbo.net 172.67.75.65, 443, 49730 CLOUDFLARENETUS United States 6->36 16 C:\Users\user\Desktop\...\SlideshowMaker.exe, PE32 6->16 dropped 18 C:\Users\user\...\SlideshowMaker.exe.manifest, ASCII 6->18 dropped 20 C:\Users\user\Desktop\...\SlideshowMaker.exe, PE32 6->20 dropped 42 Writes to foreign memory regions 6->42 44 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 6->44 11 SlideshowMaker.exe 35 239 6->11         started        file5 signatures6 process7 dnsIp8 38 db4t5hkfesjuw.cloudfront.net 18.66.112.49, 49742, 49744, 80 MIT-GATEWAYSUS United States 11->38 40 lsw-03-balancer.movavi.com 84.16.252.107, 443, 49735, 49736 LEASEWEB-DE-FRA-10DE Germany 11->40 22 C:\Users\user\...\404_6eb40000_tls.dll, PE32 11->22 dropped 24 C:\Users\user\...\404_6d280000_tls.dll, PE32 11->24 dropped 26 C:\Users\user\...\404_6ca20000_tls.dll, PE32 11->26 dropped 28 121 other files (none is malicious) 11->28 dropped 46 Tries to detect sandboxes and other dynamic analysis tools (window names) 11->46 48 Tries to evade debugger and weak emulator (self modifying code) 11->48 50 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 11->50 52 4 other signatures 11->52 file9 signatures10
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
18.66.112.49
 db4t5hkfesjuw.cloudfront.net United States
3 MIT-GATEWAYSUS false
172.67.75.65
 start.turbo.net United States
13335 CLOUDFLARENETUS false
84.16.252.107
 lsw-03-balancer.movavi.com Germany
28753 LEASEWEB-DE-FRA-10DE false

Contacted Domains

Name IP Active
start.turbo.net 172.67.75.65 true
lsw-03-balancer.movavi.com 84.16.252.107 true
db4t5hkfesjuw.cloudfront.net 18.66.112.49 true
mip2.movavi.com unknown unknown
img.movavi.com unknown unknown
codec-activate.movavi.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://mip2.movavi.com/get_nag.php?app=slideshowcreator&module=slideshowcreator&app_ver=4-1-0&partner=&app_mode=activated&lang=it&app_action=app_start&huid=4382b732c4891ce476ee93bd6ba3d93c6f2c1771&protocol=1&rnd=32718&os=win&act_key= false
    		unknown
    https://codec-activate.movavi.com/api/v1/codec/all/?akey=&huid=4382b732c4891ce476ee93bd6ba3d93c6f2c1771 false
      		unknown
      http://img.movavi.com/webnagscreens/crossale_suite/btn_close_it.png false
        		unknown
        http://img.movavi.com/webnagscreens/crossale_suite/btn_buy_it.png false
          		unknown
          https://mip2.movavi.com/get_nag.php?app=slideshowcreator&module=slideshowcreator&app_ver=4-1-0&partner=&app_mode=activated&lang=it&app_action=app_close&huid=4382b732c4891ce476ee93bd6ba3d93c6f2c1771&protocol=1&rnd=32711&os=win&act_key= false
            		unknown