Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1571960
MD5:	cbf2b84f9b993a77c0e2170cccbacb7c
SHA1:	33fdf37b3a3f1394edc5d64c0952064b7f4177ea
SHA256:	9c9687e8c61b784d08f6d80853666faa0884043ce7b99f4fb3676f3bc563c2f5
Tags:	exeuser-Bitsight
Infos:

Detection

Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected Amadeys stealer DLL

Yara detected Credential Flusher

Yara detected LummaC Stealer

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

C2 URLs / IPs found in malware configuration

Creates multiple autostart registry keys

Disable Windows Defender notifications (registry)

Disable Windows Defender real time protection (registry)

Disables Windows Defender Tamper protection

Drops PE files to the document folder of the user

Excessive usage of taskkill to terminate processes

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies windows update settings

PE file contains section with special chars

Query firmware table information (likely to detect VMs)

Sigma detected: New RUN Key Pointing to Suspicious Folder

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Checks for debuggers (devices)

Checks for kernel debuggers (NtQuerySystemInformation(SystemKernelDebuggerInformation))

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Enables debug privileges

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Searches for user specific document files

Sigma detected: Browser Started with Remote Debugging

Sigma detected: CurrentVersion Autorun Keys Modification

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Uses taskkill to terminate processes

Yara detected Credential Stealer

Classification

Malware Threat Intel
Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/clickfix-tactic-the-phantom-meet/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Signatures

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://atten-supporse.biz/apiluv	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phppresolver.dll	Avira URL Cloud: Label: malware
Source: https://atten-supporse.biz/U	Avira URL Cloud: Label: malware
Source: https://atten-supporse.biz/#4	Avira URL Cloud: Label: malware
Source: https://atten-supporse.biz/s4p6	Avira URL Cloud: Label: malware
Source: https://atten-supporse.biz/apiEW	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/mine/random.exeg	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phper	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Avira: detection malicious, Label: HEUR/AGEN.1320706
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Avira: detection malicious, Label: TR/Crypt.XPACK.Gen
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Avira: detection malicious, Label: TR/ATRAPS.Gen
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Avira: detection malicious, Label: TR/Crypt.XPACK.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	Avira: detection malicious, Label: TR/ATRAPS.Gen
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Avira: detection malicious, Label: HEUR/AGEN.1320706

Found malware configuration

Source: 00000009.00000002.2153108799.0000000000481000.00000040.00000001.01000000.0000000B.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 00000010.00000002.2681962698.000000000155E000.00000004.00000020.00020000.00000000.sdmp	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/c4becf79229cb002.php"}
Source: f039f524ee.exe.2840.17.memstrmin	Malware Configuration Extractor: LummaC {"C2 url": ["impend-differ.biz", "dare-curbys.biz", "atten-supporse.biz", "formy-spill.biz", "se-blurry.biz", "covery-mover.biz", "print-vexer.biz", "dwell-exclaim.biz", "zinc-sneark.biz"], "Build id": "LOGS11--LiveTraffic"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	ReversingLabs: Detection: 44%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[2].exe	ReversingLabs: Detection: 23%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe	ReversingLabs: Detection: 34%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe	ReversingLabs: Detection: 44%
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	ReversingLabs: Detection: 34%
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	ReversingLabs: Detection: 44%
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	ReversingLabs: Detection: 23%
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	ReversingLabs: Detection: 44%

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 44%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Uses Microsoft's Enhanced Cryptographic Provider

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C466C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,	0_2_6C466C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5BA9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,	0_2_6C5BA9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5B4440 PK11_PrivDecrypt,	0_2_6C5B4440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C584420 SECKEY_DestroyEncryptedPrivateKeyInfo,memset,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,free,	0_2_6C584420
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5B44C0 PK11_PubEncrypt,	0_2_6C5B44C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6025B0 PK11_Encrypt,memcpy,PR_SetError,PK11_Encrypt,	0_2_6C6025B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5BA650 PK11SDR_Encrypt,PORT_NewArena_Util,PK11_GetInternalKeySlot,PK11_Authenticate,SECITEM_ZfreeItem_Util,TlsGetValue,EnterCriticalSection,PR_Unlock,PK11_CreateContextBySymKey,PK11_GetBlockSize,PORT_Alloc_Util,memcpy,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PORT_ArenaAlloc_Util,PK11_CipherOp,SEC_ASN1EncodeItem_Util,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,PK11_DestroyContext,	0_2_6C5BA650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C598670 PK11_ExportEncryptedPrivKeyInfo,	0_2_6C598670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C59E6E0 PK11_AEADOp,TlsGetValue,EnterCriticalSection,PORT_Alloc_Util,PK11_Encrypt,PORT_Alloc_Util,memcpy,memcpy,PR_SetError,PR_SetError,PR_Unlock,PR_SetError,PR_Unlock,PK11_Decrypt,PR_GetCurrentThread,PK11_Decrypt,PK11_Encrypt,memcpy,memcpy,PR_SetError,free,	0_2_6C59E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5DA730 SEC_PKCS12AddCertAndKey,PORT_ArenaMark_Util,PORT_ArenaMark_Util,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,PK11_GetInternalKeySlot,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,SECKEY_DestroyEncryptedPrivateKeyInfo,strlen,PR_SetError,PORT_FreeArena_Util,PORT_FreeArena_Util,PORT_ArenaAlloc_Util,PR_SetError,	0_2_6C5DA730
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E0180 SECMIME_DecryptionAllowed,SECOID_GetAlgorithmTag_Util,	0_2_6C5E0180

Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=f039f524ee.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=f039f524ee.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=f039f524ee.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon

Uses 32bit PE files

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2116362437.000000006C68F000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2116362437.000000006C68F000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: f039f524ee.exe, 00000011.00000003.3081089288.0000000008320000.00000004.00001000.00020000.00000000.sdmp, 9f6ad733e2.exe, 00000021.00000003.2802037515.0000000005190000.00000004.00001000.00020000.00000000.sdmp, 9f6ad733e2.exe, 00000021.00000002.2937994456.0000000000EF2000.00000040.00000001.01000000.00000014.sdmp
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmp

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: chrome.exe	Memory has grown: Private usage: 9MB later: 41MB
Source: firefox.exe	Memory has grown: Private usage: 1MB later: 95MB

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	URLs: impend-differ.biz
Source: Malware configuration extractor	URLs: dare-curbys.biz
Source: Malware configuration extractor	URLs: atten-supporse.biz
Source: Malware configuration extractor	URLs: formy-spill.biz
Source: Malware configuration extractor	URLs: se-blurry.biz
Source: Malware configuration extractor	URLs: covery-mover.biz
Source: Malware configuration extractor	URLs: print-vexer.biz
Source: Malware configuration extractor	URLs: dwell-exclaim.biz
Source: Malware configuration extractor	URLs: zinc-sneark.biz
Source: Malware configuration extractor	IPs: 185.215.113.43

IP address seen in connection with other malware

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 1.1.1.1 1.1.1.1
Source: Joe Sandbox View	IP Address: 1.1.1.1 1.1.1.1

Internet Provider seen in connection with other malware

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C56CC60 PR_Recv,

0_2_6C56CC60

Source: firefox.exe, 00000020.00000002.2914904234.0000017CD7978000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD6757000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD6703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "url": "https://www.facebook.com/", equals www.facebook.com (Facebook)
Source: firefox.exe, 00000020.00000002.2914904234.0000017CD7978000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD6757000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD6703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "url": "https://www.youtube.com/", equals www.youtube.com (Youtube)
Source: firefox.exe, 00000020.00000002.2914904234.0000017CD7978000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD6703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.facebook.com (Facebook)
Source: firefox.exe, 00000020.00000002.2914904234.0000017CD7978000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD6703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.twitter.com (Twitter)
Source: firefox.exe, 00000020.00000002.2914904234.0000017CD7978000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD6703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.youtube.com (Youtube)
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: BETWEEN 'www.' \|\| :strippedURL AND 'www.' \|\| :strippedURL \|\| X'FFFF'The timing of the exposure event depends on the experiment, but generally the event is recorded when the user first encounters onboarding UI for the shopping feature.[{incognito:null, tabId:null, types:["image"], urls:["https://smartblock.firefox.etp/facebook.svg", "https://smartblock.firefox.etp/play.svg"], windowId:null}, ["blocking"]][{incognito:null, tabId:null, types:["image"], urls:["https://smartblock.firefox.etp/facebook.svg", "https://smartblock.firefox.etp/play.svg"], windowId:null}, ["blocking"]]X!p equals www.facebook.com (Facebook)
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5AE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "://.adsafeprotected.com//Serving/""://.adsafeprotected.com/jload""://pubads.g.doubleclick.net/gampad/ad""://vast.adsafeprotected.com/vast""://.adsafeprotected.com/jsvid?""://.adsafeprotected.com/jsvid?""://.adsafeprotected.com/jsvid""://.adsafeprotected.com/tpl?""://cdn.cmp.advertising.com/firefox-etp""://pubads.g.doubleclick.net/gampad/ad-blk""://pixel.advertising.com/firefox-etp""://vast.adsafeprotected.com/vast""://.adsafeprotected.com/services/pub""://track.adform.net/Serving/TrackPoint/""://securepubads.g.doubleclick.net/gampad/ad""://securepubads.g.doubleclick.net/gampad/ad""https://ads.stickyadstv.com/firefox-etp""://ads.stickyadstv.com/user-matching""://.adsafeprotected.com//adj""://.adsafeprotected.com//unit/""://.adsafeprotected.com/.png""://.adsafeprotected.com/jload?""://pubads.g.doubleclick.net/gampad/ad-blk""://pixel.advertising.com/firefox-etp""://.adsafeprotected.com/.gif""://.adsafeprotected.com/services/pub""://track.adform.net/Serving/TrackPoint/""://.adsafeprotected.com/.js""://.adsafeprotected.com//imp/""://.adsafeprotected.com/tpl?""://www.facebook.com/platform/impression.php""://ads.stickyadstv.com/auto-user-sync"Invalid argument passed to defaultEngine setterWebExtension engine check completegetDefaultEngineInfo: No default engineaddEnginesFromExtension: installing:nimbusPrivateDefaultUrlbarResultEnabledCan't find engine to remove in _sortedEngines!["://trends.google.com/trends/embed"]"://.adsafeprotected.com/.js""://pubads.g.doubleclick.net/gampad/ad""://.adsafeprotected.com//Serving/""://ads.stickyadstv.com/user-matching""://.adsafeprotected.com/jload?"#buildSortedEngineList: using saved order"://.adsafeprotected.com//unit/""://trends.google.com/trends/embed"#buildSortedEngineList: using default orders"://.adsafeprotected.com/tpl?""://.adsafeprotected.com//adj""://.adsafeprotected.com//imp/""://.adsafeprotected.com/jload""://trends.google.com/trends/embed"["://trends.google.com/trends/embed"]"://.adsafeprotected.com/.png""://.adsafeprotected.com/jsvid""://ads.stickyadstv.com/auto-user-sync""://.adsafeprotected.com/jsvid?""https://ads.stickyadstv.com/firefox-etp""://.adsafeprotected.com/services/pub"Running check on WebExtension enginesCould not find a replacement default engine."://www.facebook.com/platform/impression.php""://.adsafeprotected.com/.gif"@mozilla.org/widget/useridleservice;1addEnginesFromExtension/inConfig<Engine with updates found, setting update timer_sortEnginesByDefaults/remainingEngines<#findAndSetNewDefaultEngine/firstVisible<resource://gre/modules/DeferredTask.sys.mjsresource://gre/modules/ObjectUtils.sys.mjs#upgradeExtensionEngine/configuration<resource://gre/modules/SearchUtils.sys.mjsget: No settings file exists, new profile?batchTask: Invalidating engine settingsseperatePrivateDefaultUrlbarResultEnabled#buildSortedEngineList/filteredEngines<write-preve
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5AE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "://securepubads.g.doubleclick.net/gampad/ad-blk""https://static.adsafeprotected.com/firefox-etp-pixel""://tpc.googlesyndication.com/safeframe//html/container.html""://pagead2.googlesyndication.com/pagead/.jsfcd=true""://pagead2.googlesyndication.com/pagead/js/.jsfcd=true""://pubads.g.doubleclick.net/gampad/xml_vmap2""://pubads.g.doubleclick.net/gampad/xml_vmap1"resource://gre/modules/SearchSuggestionController.sys.mjs"://id.rambler.ru/rambler-id-helper/auth_events.js""://pubads.g.doubleclick.net/gampad/xml_vmap2""https://static.adsafeprotected.com/firefox-etp-pixel""://securepubads.g.doubleclick.net/gampad/xml_vmap2""https://static.adsafeprotected.com/firefox-etp-js""://www.gstatic.com/firebasejs//firebase-messaging.js""://securepubads.g.doubleclick.net/gampad/xml_vmap2""://securepubads.g.doubleclick.net/gampad/xml_vmap1""://media.richrelevance.com/rrserver/js/1.2/p13n.js""://vdb-cdn-files.s3.amazonaws.com//vidible-min.js""://securepubads.g.doubleclick.net/gampad/ad-blk""://securepubads.g.doubleclick.net/gampad/xml_vmap2""://securepubads.g.doubleclick.net/gpt/pubads_impl_.js""://pagead2.googlesyndication.com/gpt/pubads_impl_.js""://pubads.g.doubleclick.net/gampad/xml_vmap1""://pagead2.googlesyndication.com/tag/js/gpt.js""://securepubads.g.doubleclick.net/gampad/xml_vmap1""://pubads.g.doubleclick.net/gampad/xml_vmap1""://pubads.g.doubleclick.net/gampad/xml_vmap2""https://static.adsafeprotected.com/firefox-etp-pixel""://www.googleadservices.com/pagead/conversion_async.js""://securepubads.g.doubleclick.net/tag/js/gpt.js""://securepubads.g.doubleclick.net/gampad/ad-blk""://securepubads.g.doubleclick.net/gampad/xml_vmap1"ifnull(b.title, iif(h.frecency <> 0, h.title, NULL)) AS title, equals www.rambler.ru (Rambler)
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5AE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "://www.facebook.com/platform/impression.php" equals www.facebook.com (Facebook)
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://pubads.g.doubleclick.net/gampad/xml_vmap2://www.facebook.com/platform/impression.php://pubads.g.doubleclick.net/gampad/ad://.adsafeprotected.com//unit/--panel-banner-item-update-supported-bgcolor--panel-banner-item-info-icon-bgcolor://cdn.cmp.advertising.com/firefox-etp://.adsafeprotected.com/services/pubexecuteIDB/promise</transaction.onerror equals www.facebook.com (Facebook)
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://www.facebook.com/platform/impression.php equals www.facebook.com (Facebook)
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://www.gstatic.com/firebasejs//firebase-messaging.js*://pagead2.googlesyndication.com/pagead/.jsfcd=true://pagead2.googlesyndication.com/pagead/js/.jsfcd=true://securepubads.g.doubleclick.net/gampad/ad-blk*://securepubads.g.doubleclick.net/gampad/xml_vmap1*://tpc.googlesyndication.com/safeframe//html/container.htmlcolor-mix(in srgb, currentColor 14%, transparent)color-mix(in srgb, currentColor 25%, transparent)://securepubads.g.doubleclick.net/tag/js/gpt.js*://id.rambler.ru/rambler-id-helper/auth_events.jsopenIDB/</request.onupgradeneeded/transaction.onabort equals www.rambler.ru (Rambler)
Source: firefox.exe, 00000020.00000002.2910130082.0000017CD677D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: -l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"Wikipedia"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.reddit.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="R"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/reddit-com@2x.png)"></div></div></div><div class="title"><span dir="auto">Reddit<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"Reddit"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer hide-for-narrow"><div class="top-site-inner"><a class="top-site-button" href="https://twitter.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="T"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/twitter-com@2x.png)"></div></div></div><div class="title"><span dir="auto">Twitter<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"Twitter"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer placeholder hide-for-narrow"><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li></ul><div class="edit-topsites-wrapper"></div></div></section></div></div></div></div><style data-styles="[[null]]"></style></div><div class="discovery-stream ds-layout"><div class="ds-column ds-column-12"><div class="ds-column-grid"><div></div></div></div><style data-styles="[[null]]"></style></div></div></main></div></div> equals www.twitter.com (Twitter)
Source: firefox.exe, 00000020.00000002.2933948328.0000017CDA0BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2931947413.0000017CD9EF7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2933948328.0000017CDA07C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: FileUtils_closeSafeFileOutputStreamFileUtils_openSafeFileOutputStreamresource://gre/modules/addons/XPIProvider.jsmFileUtils_openAtomicFileOutputStreamwebcompat-reporter@mozilla.org.xpi@mozilla.org/network/atomic-file-output-stream;1webcompat-reporter%40mozilla.org:1.5.1https://smartblock.firefox.etp/facebook.svg@mozilla.org/addons/addon-manager-startup;1://cdn.branch.io/branch-latest.min.js@mozilla.org/network/safe-file-output-stream;1@mozilla.org/network/file-output-stream;1://pub.doubleverify.com/signals/pub.js://www.google-analytics.com/analytics.js://www.google-analytics.com/gtm/js://www.googletagmanager.com/gtm.js://ssl.google-analytics.com/ga.js://pagead2.googlesyndication.com/tag/js/gpt.js*://cdn.adsafeprotected.com/iasPET.1.js://static.adsafeprotected.com/iasPET.1.js://.moatads.com//moatheader.js://cdn.optimizely.com/public/.js://js.maxmind.com/js/apis/geoip2//geoip2.js://imasdk.googleapis.com/js/sdkloader/ima3.js://s.webtrends.com/js/advancedLinkTracking.js*://s.webtrends.com/js/webtrends.jsresource://gre/modules/ConduitsParent.sys.mjs equals www.facebook.com (Facebook)
Source: firefox.exe, 00000020.00000002.2933675468.0000017CD9F08000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ["://track.adform.net/Serving/TrackPoint/", "://pagead2.googlesyndication.com/pagead/.jsfcd=true", "://pagead2.googlesyndication.com/pagead/js/.jsfcd=true", "://pixel.advertising.com/firefox-etp", "://cdn.cmp.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "https://static.adsafeprotected.com/firefox-etp-js", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/*"] equals www.facebook.com (Facebook)
Source: firefox.exe, 00000020.00000002.2933675468.0000017CD9F08000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ["://track.adform.net/Serving/TrackPoint/", "://pixel.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/"] equals www.facebook.com (Facebook)
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A46000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ["://webcompat-addon-testbed.herokuapp.com/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js", "://track.adform.net/serving/scripts/trackpoint/", "://track.adform.net/serving/scripts/trackpoint/async/", "://.adnxs.com//ast.js", "://.adnxs.com//pb.js", "://.adnxs.com//prebid", "://www.everestjs.net/static/st.v3.js", "://static.adsafeprotected.com/vans-adapter-google-ima.js", "://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "://cdn.branch.io/branch-latest.min.js", "://pub.doubleverify.com/signals/pub.js", "://c.amazon-adsystem.com/aax2/apstag.js", "://auth.9c9media.ca/auth/main.js", "://static.chartbeat.com/js/chartbeat.js", "://static.chartbeat.com/js/chartbeat_video.js", "://static.criteo.net/js/ld/publishertag.js", "://.imgur.com/js/vendor..bundle.js", "://.imgur.io/js/vendor..bundle.js", "://www.rva311.com/static/js/main..chunk.js", "://web-assets.toggl.com/app/assets/scripts/.js", "://libs.coremetrics.com/eluminate.js", "://connect.facebook.net//sdk.js", "://connect.facebook.net//all.js", "://secure.cdn.fastclick.net/js/cnvr-launcher//launcher-stub.min.js", "://www.google-analytics.com/analytics.js", "://www.google-analytics.com/gtm/js", "://www.googletagmanager.com/gtm.js", "://www.google-analytics.com/plugins/ua/ec.js", "://ssl.google-analytics.com/ga.js", "://s0.2mdn.net/instream/html5/ima3.js", "://imasdk.googleapis.com/js/sdkloader/ima3.js", "://www.googleadservices.com/pagead/conversion_async.js", "://www.googletagservices.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/gpt/pubads_impl_.js", "://securepubads.g.doubleclick.net/tag/js/gpt.js", "://securepubads.g.doubleclick.net/gpt/pubads_impl_.js", "://script.ioam.de/iam.js", "://cdn.adsafeprotected.com/iasPET.1.js", "://static.adsafeprotected.com/iasPET.1.js", "://adservex.media.net/videoAds.js", "://.moatads.com//moatad.js", "://.moatads.com//moatapi.js", "://.moatads.com//moatheader.js", "://.moatads.com//yi.js", "://.imrworldwide.com/v60.js", "://cdn.optimizely.com/js/.js", "://cdn.optimizely.com/public/.js", "://id.rambler.ru/rambler-id-helper/auth_events.js", "://media.richrelevance.com/rrserver/js/1.2/p13n.js", "://www.gstatic.com/firebasejs//firebase-messaging.js", "://.vidible.tv//vidible-min.js", "://vdb-cdn-files.s3.amazonaws.com//vidible-min.js", "://js.maxmind.com/js/apis/geoip2//geoip2.js", "://s.webtrends.com/js/advancedLinkTracking.js", "://s.webtrends.com/js/webtrends.js", "://s.webtrends.com/js/webtrends.min.js"] equals www.facebook.com (Facebook)
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A46000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ["://webcompat-addon-testbed.herokuapp.com/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js", "://track.adform.net/serving/scripts/trackpoint/", "://track.adform.net/serving/scripts/trackpoint/async/", "://.adnxs.com//ast.js", "://.adnxs.com//pb.js", "://.adnxs.com//prebid", "://www.everestjs.net/static/st.v3.js", "://static.adsafeprotected.com/vans-adapter-google-ima.js", "://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "://cdn.branch.io/branch-latest.min.js", "://pub.doubleverify.com/signals/pub.js", "://c.amazon-adsystem.com/aax2/apstag.js", "://auth.9c9media.ca/auth/main.js", "://static.chartbeat.com/js/chartbeat.js", "://static.chartbeat.com/js/chartbeat_video.js", "://static.criteo.net/js/ld/publishertag.js", "://.imgur.com/js/vendor..bundle.js", "://.imgur.io/js/vendor..bundle.js", "://www.rva311.com/static/js/main..chunk.js", "://web-assets.toggl.com/app/assets/scripts/.js", "://libs.coremetrics.com/eluminate.js", "://connect.facebook.net//sdk.js", "://connect.facebook.net//all.js", "://secure.cdn.fastclick.net/js/cnvr-launcher//launcher-stub.min.js", "://www.google-analytics.com/analytics.js", "://www.google-analytics.com/gtm/js", "://www.googletagmanager.com/gtm.js", "://www.google-analytics.com/plugins/ua/ec.js", "://ssl.google-analytics.com/ga.js", "://s0.2mdn.net/instream/html5/ima3.js", "://imasdk.googleapis.com/js/sdkloader/ima3.js", "://www.googleadservices.com/pagead/conversion_async.js", "://www.googletagservices.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/gpt/pubads_impl_.js", "://securepubads.g.doubleclick.net/tag/js/gpt.js", "://securepubads.g.doubleclick.net/gpt/pubads_impl_.js", "://script.ioam.de/iam.js", "://cdn.adsafeprotected.com/iasPET.1.js", "://static.adsafeprotected.com/iasPET.1.js", "://adservex.media.net/videoAds.js", "://.moatads.com//moatad.js", "://.moatads.com//moatapi.js", "://.moatads.com//moatheader.js", "://.moatads.com//yi.js", "://.imrworldwide.com/v60.js", "://cdn.optimizely.com/js/.js", "://cdn.optimizely.com/public/.js", "://id.rambler.ru/rambler-id-helper/auth_events.js", "://media.richrelevance.com/rrserver/js/1.2/p13n.js", "://www.gstatic.com/firebasejs//firebase-messaging.js", "://.vidible.tv//vidible-min.js", "://vdb-cdn-files.s3.amazonaws.com//vidible-min.js", "://js.maxmind.com/js/apis/geoip2//geoip2.js", "://s.webtrends.com/js/advancedLinkTracking.js", "://s.webtrends.com/js/webtrends.js", "://s.webtrends.com/js/webtrends.min.js"] equals www.rambler.ru (Rambler)
Source: firefox.exe, 00000020.00000002.2933675468.0000017CD9F03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["image"], urls:["://track.adform.net/Serving/TrackPoint/", "://pixel.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 00000020.00000002.2933675468.0000017CD9F08000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2933675468.0000017CD9F03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["imageset"], urls:["://track.adform.net/Serving/TrackPoint/", "://pixel.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["script"], urls:["://webcompat-addon-testbed.herokuapp.com/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js", "://track.adform.net/serving/scripts/trackpoint/", "://track.adform.net/serving/scripts/trackpoint/async/", "://.adnxs.com//ast.js", "://.adnxs.com//pb.js", "://.adnxs.com//prebid", "://www.everestjs.net/static/st.v3.js", "://static.adsafeprotected.com/vans-adapter-google-ima.js", "://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "://cdn.branch.io/branch-latest.min.js", "://pub.doubleverify.com/signals/pub.js", "://c.amazon-adsystem.com/aax2/apstag.js", "://auth.9c9media.ca/auth/main.js", "://static.chartbeat.com/js/chartbeat.js", "://static.chartbeat.com/js/chartbeat_video.js", "://static.criteo.net/js/ld/publishertag.js", "://.imgur.com/js/vendor..bundle.js", "://.imgur.io/js/vendor..bundle.js", "://www.rva311.com/static/js/main..chunk.js", "://web-assets.toggl.com/app/assets/scripts/.js", "://libs.coremetrics.com/eluminate.js", "://connect.facebook.net//sdk.js", "://connect.facebook.net//all.js", "://secure.cdn.fastclick.net/js/cnvr-launcher//launcher-stub.min.js", "://www.google-analytics.com/analytics.js", "://www.google-analytics.com/gtm/js", "://www.googletagmanager.com/gtm.js", "://www.google-analytics.com/plugins/ua/ec.js", "://ssl.google-analytics.com/ga.js", "://s0.2mdn.net/instream/html5/ima3.js", "://imasdk.googleapis.com/js/sdkloader/ima3.js", "://www.googleadservices.com/pagead/conversion_async.js", "://www.googletagservices.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/gpt/pubads_impl_.js", "://securepubads.g.doubleclick.net/tag/js/gpt.js", "://securepubads.g.doubleclick.net/gpt/pubads_impl_.js", "://script.ioam.de/iam.js", "://cdn.adsafeprotected.com/iasPET.1.js", "://static.adsafeprotected.com/iasPET.1.js", "://adservex.media.net/videoAds.js", "://.moatads.com//moatad.js", "://.moatads.com//moatapi.js", "://.moatads.com//moatheader.js", "://.moatads.com//yi.js", "://.imrworldwide.com/v60.js", "://cdn.optimizely.com/js/.js", "://cdn.optimizely.com/public/.js", "://id.rambler.ru/rambler-id-helper/auth_events.js", "://media.richrelevance.com/rrserver/js/1.2/p13n.js", "://www.gstatic.com/firebasejs//firebase-messaging.js", "://.vidible.tv//vidible-min.js", "://vdb-cdn-files.s3.amazonaws.com//vidible-min.js", "://js.maxmind.com/js/apis/geoip2//geoip2.js", "://s.webtrends.com/js/advancedLinkTracking.js", "://s.webtrends.com/js/webtrends.js", "://s.webtrends.com/js/webtrends.min.js"], windowId
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A46000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2908457770.0000017CD5A61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["script"], urls:["://webcompat-addon-testbed.herokuapp.com/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js", "://track.adform.net/serving/scripts/trackpoint/", "://track.adform.net/serving/scripts/trackpoint/async/", "://.adnxs.com//ast.js", "://.adnxs.com//pb.js", "://.adnxs.com//prebid", "://www.everestjs.net/static/st.v3.js", "://static.adsafeprotected.com/vans-adapter-google-ima.js", "://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "://cdn.branch.io/branch-latest.min.js", "://pub.doubleverify.com/signals/pub.js", "://c.amazon-adsystem.com/aax2/apstag.js", "://auth.9c9media.ca/auth/main.js", "://static.chartbeat.com/js/chartbeat.js", "://static.chartbeat.com/js/chartbeat_video.js", "://static.criteo.net/js/ld/publishertag.js", "://.imgur.com/js/vendor..bundle.js", "://.imgur.io/js/vendor..bundle.js", "://www.rva311.com/static/js/main..chunk.js", "://web-assets.toggl.com/app/assets/scripts/.js", "://libs.coremetrics.com/eluminate.js", "://connect.facebook.net//sdk.js", "://connect.facebook.net//all.js", "://secure.cdn.fastclick.net/js/cnvr-launcher//launcher-stub.min.js", "://www.google-analytics.com/analytics.js", "://www.google-analytics.com/gtm/js", "://www.googletagmanager.com/gtm.js", "://www.google-analytics.com/plugins/ua/ec.js", "://ssl.google-analytics.com/ga.js", "://s0.2mdn.net/instream/html5/ima3.js", "://imasdk.googleapis.com/js/sdkloader/ima3.js", "://www.googleadservices.com/pagead/conversion_async.js", "://www.googletagservices.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/gpt/pubads_impl_.js", "://securepubads.g.doubleclick.net/tag/js/gpt.js", "://securepubads.g.doubleclick.net/gpt/pubads_impl_.js", "://script.ioam.de/iam.js", "://cdn.adsafeprotected.com/iasPET.1.js", "://static.adsafeprotected.com/iasPET.1.js", "://adservex.media.net/videoAds.js", "://.moatads.com//moatad.js", "://.moatads.com//moatapi.js", "://.moatads.com//moatheader.js", "://.moatads.com//yi.js", "://.imrworldwide.com/v60.js", "://cdn.optimizely.com/js/.js", "://cdn.optimizely.com/public/.js", "://id.rambler.ru/rambler-id-helper/auth_events.js", "://media.richrelevance.com/rrserver/js/1.2/p13n.js", "://www.gstatic.com/firebasejs//firebase-messaging.js", "://.vidible.tv//vidible-min.js", "://vdb-cdn-files.s3.amazonaws.com//vidible-min.js", "://js.maxmind.com/js/apis/geoip2//geoip2.js", "://s.webtrends.com/js/advancedLinkTracking.js", "://s.webtrends.com/js/webtrends.js", "://s.webtrends.com/js/webtrends.min.js"], windowId
Source: firefox.exe, 00000020.00000002.2933675468.0000017CD9F08000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["xmlhttprequest"], urls:["://track.adform.net/Serving/TrackPoint/", "://pagead2.googlesyndication.com/pagead/.jsfcd=true", "://pagead2.googlesyndication.com/pagead/js/.jsfcd=true", "://pixel.advertising.com/firefox-etp", "://cdn.cmp.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "https://static.adsafeprotected.com/firefox-etp-js", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/*"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 00000020.00000002.2910130082.0000017CD6725000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: doff-text" data-l10n-args="{"engine": "Google"}"></div><input type="search" class="fake-editable" tabindex="-1" aria-hidden="true"/><div class="fake-caret"></div></button></div></div></div><div class="body-wrapper on"><div class="discovery-stream ds-layout"><div class="ds-column ds-column-12"><div class="ds-column-grid"><div><div class="ds-top-sites"><section class="collapsible-section top-sites" data-section-id="topsites"><div class="section-top-bar"><h3 class="section-title-container " style="visibility:hidden"><span class="section-title"><span data-l10n-id="newtab-section-header-topsites"></span></span><span class="learn-more-link-wrapper"></span></h3></div><div><ul class="top-sites-list"><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.youtube.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="Y"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/youtube-com@2x.png)"></div></div></div><div class="title"><span dir="auto">YouTube<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"YouTube"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.facebook.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="F"><div class="top-site-icon rich-icon" style="backgroun
Source: firefox.exe, 00000020.00000002.2910130082.0000017CD6725000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: doff-text" data-l10n-args="{"engine": "Google"}"></div><input type="search" class="fake-editable" tabindex="-1" aria-hidden="true"/><div class="fake-caret"></div></button></div></div></div><div class="body-wrapper on"><div class="discovery-stream ds-layout"><div class="ds-column ds-column-12"><div class="ds-column-grid"><div><div class="ds-top-sites"><section class="collapsible-section top-sites" data-section-id="topsites"><div class="section-top-bar"><h3 class="section-title-container " style="visibility:hidden"><span class="section-title"><span data-l10n-id="newtab-section-header-topsites"></span></span><span class="learn-more-link-wrapper"></span></h3></div><div><ul class="top-sites-list"><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.youtube.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="Y"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/youtube-com@2x.png)"></div></div></div><div class="title"><span dir="auto">YouTube<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"YouTube"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.facebook.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="F"><div class="top-site-icon rich-icon" style="backgroun
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: startup - adding clearkey CDM failedmedia.{0}.allow-x64-plugin-on-arm64media.gmp-manager.cert.checkAttributesstartup - adding clearkey CDM directory onPrefEMEGlobalEnabledChanged() id=media.gmp-manager.checkContentSignatureresource://gre/modules/UpdateUtils.sys.mjsdom.sitepermsaddon-provider.enabledfindUpdates() - updateTask succeeded for uninstallPlugin() - unregistering gmp directory ://static.chartbeat.com/js/chartbeat.js://static.chartbeat.com/js/chartbeat_video.jspictureinpicture%40mozilla.org:1.0.0://track.adform.net/serving/scripts/trackpoint/FileUtils_closeAtomicFileOutputStreamresource://gre/modules/FileUtils.sys.mjshttps://smartblock.firefox.etp/play.svg://auth.9c9media.ca/auth/main.js://.imgur.com/js/vendor..bundle.js://.imgur.io/js/vendor..bundle.js://static.criteo.net/js/ld/publishertag.js://www.rva311.com/static/js/main..chunk.js://web-assets.toggl.com/app/assets/scripts/.js://libs.coremetrics.com/eluminate.js://connect.facebook.net//sdk.js://www.everestjs.net/static/st.v3.js://connect.facebook.net//all.js*://c.amazon-adsystem.com/aax2/apstag.jsresource://gre/modules/AsyncShutdown.sys.mjs equals www.facebook.com (Facebook)
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5AE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: webRequest asyncPromptAuth failure resource://gre/modules/SecurityInfo.sys.mjsresource://gre/modules/ExtensionDNR.sys.mjsUnable to set host header to restricted url.resource://gre/modules/WebRequestUpload.sys.mjsresource://gre/modules/WebRequest.sys.mjsDisallowed change restricted response header 115062f8-92f1-11e5-8b7f-080027b0f7ecresource://gre/modules/ExtensionParent.sys.mjswebRequestFilterResponse.serviceWorkerScriptwebRequest onAuthCancelled failure @mozilla.org/network/http-activity-distributor;1ACTIVITY_SUBTYPE_RESPONSE_COMPLETEACTIVITY_SUBTYPE_TRANSACTION_CLOSEasyncPromptAuth/wrapper.authPromptForwardasyncPromptAuth/wrapper.authPromptCallbackwebRequestBlockingPermissionRequired"://login.microsoftonline.com/""://www.everestjs.net/static/st.v3.js"resource://gre/modules/ExtensionUtils.sys.mjs on service worker imported script removeBootstrappedManifestLocationwebRequestBlockingPermissionRequired@mozilla.org/webrequest/channel-event-sink;1webRequestBlockingPermissionRequiredwebRequest onAuthAvailable failure "https://smartblock.firefox.etp/facebook.svg"BLOCKING_REASON_EXTENSION_WEBREQUEST"https://smartblock.firefox.etp/play.svg"TYPE_INTERNAL_WORKER_IMPORT_SCRIPTSwebRequestBlockingPermissionRequiredTYPE_INTERNAL_WORKER_STATIC_MODULE"://.vidible.tv//vidible-min.js""://www.rva311.com/static/js/main..chunk.js""://js.maxmind.com/js/apis/geoip2//geoip2.js""://s.webtrends.com/js/webtrends.js""://libs.coremetrics.com/eluminate.js""://s.webtrends.com/js/webtrends.min.js""://cdn.branch.io/branch-latest.min.js""://static.criteo.net/js/ld/publishertag.js""://ssl.google-analytics.com/ga.js""://cdn.optimizely.com/public/.js""://static.adsafeprotected.com/iasPET.1.js""://.imgur.com/js/vendor..bundle.js""://www.google-analytics.com/gtm/js""://s0.2mdn.net/instream/html5/ima3.js""://cdn.adsafeprotected.com/iasPET.1.js""://connect.facebook.net//all.js""://c.amazon-adsystem.com/aax2/apstag.js""://.moatads.com//moatheader.js""://www.googletagservices.com/tag/js/gpt.js""://s.webtrends.com/js/advancedLinkTracking.js""://imasdk.googleapis.com/js/sdkloader/ima3.js""://auth.9c9media.ca/auth/main.js""://static.chartbeat.com/js/chartbeat.js""://pub.doubleverify.com/signals/pub.js""://.imgur.io/js/vendor..bundle.js""://connect.facebook.net//sdk.js""://www.google-analytics.com/plugins/ua/ec.js""://static.chartbeat.com/js/chartbeat_video.js""://www.google-analytics.com/analytics.js""://adservex.media.net/videoAds.js""://.moatads.com//moatapi.js""://www.googletagmanager.com/gtm.js""://track.adform.net/Serving/TrackPoint/""://pubads.g.doubleclick.net/gampad/ad-blk""://pubads.g.doubleclick.net/gampad/ad""://www.facebook.com/platform/impression.php""://ads.stickyadstv.com/auto-user-sync""://ads.stickyadstv.com/user-matching""://.adsafeprotected.com/.gif""://vast.adsafeprotected.com/vast""://securepubads.g.doubleclick.net/gampad/ad""://.adsafeprotected.com/.png""https://ads.stickyadstv.com
Source: firefox.exe, 00000020.00000002.2933948328.0000017CDA0BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2931947413.0000017CD9EF7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2933948328.0000017CDA07C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 00000020.00000002.2933948328.0000017CDA036000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2931947413.0000017CD9ECE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2933948328.0000017CDA07C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: x://www.facebook.com/platform/impression.php equals www.facebook.com (Facebook)
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: {9e9a9283-0ce9-4e4a-8f1c-ba129a032c32}Got invalid request to save JSON dataFailed to listen. Callback argument missing.@mozilla.org/network/protocol;1?name=default^([a-z][a-z0-9.+\t-])(:\|;)?(\/\/)?get FIXUP_FLAGS_MAKE_ALTERNATE_URI@mozilla.org/uriloader/handler-service;1Failed to listen. Listener already attached.@mozilla.org/network/protocol;1?name=filebrowser.urlbar.dnsResolveFullyQualifiedNamesdevtools.debugger.remote-websocketresource://devtools/shared/security/socket.jsJSON Viewer's onSave failed in startPersistencedevtools.performance.popup.feature-flagUnable to start devtools server on devtools.performance.recording.ui-base-urldevtools/client/framework/devtoolsresource://devtools/server/devtools-server.jsNo callback set for this channel.WebChannel/this._originCheckCallbackbrowser.fixup.dns_first_for_single_words^([a-z+.-]+:\/{0,3})([^\/@]+@).+DevToolsStartup.jsm:handleDebuggerFlagreleaseDistinctSystemPrincipalLoader^[a-z0-9-]+(\.[a-z0-9-]+)*:[0-9]{1,5}([/?#]\|$)Can't invoke URIFixup in the content processextractScheme/fixupChangedProtocol<https://mail.inbox.lv/compose?to=%sresource://gre/modules/DeferredTask.sys.mjsresource://gre/modules/FileUtils.sys.mjshttps://poczta.interia.pl/mh/?mailto=%shttp://poczta.interia.pl/mh/?mailto=%sresource://gre/modules/ExtHandlerService.sys.mjshttp://win.mail.ru/cgi-bin/sentmsg?mailto=%s@mozilla.org/network/file-input-stream;1{c6cf88b7-452e-47eb-bdc9-86e3561648ef}https://mail.yahoo.co.jp/compose/?To=%shttp://www.inbox.lv/rfc2368/?value=%sresource://gre/modules/URIFixup.sys.mjsScheme should be either http or https@mozilla.org/uriloader/dbus-handler-app;1resource://gre/modules/DeferredTask.sys.mjs@mozilla.org/network/async-stream-copier;1http://compose.mail.yahoo.co.jp/ym/Compose?To=%s_injectDefaultProtocolHandlersIfNeededisDownloadsImprovementsAlreadyMigratedhttps://e.mail.ru/cgi-bin/sentmsg?mailto=%sresource://gre/modules/NetUtil.sys.mjs{33d75835-722f-42c0-89cc-44f328e56a86}@mozilla.org/uriloader/local-handler-app;1resource://gre/modules/FileUtils.sys.mjs_finalizeInternal/this._finalizePromise<@mozilla.org/uriloader/web-handler-app;1resource://gre/modules/JSONFile.sys.mjsgecko.handlerService.defaultHandlersVersionresource://gre/modules/JSONFile.sys.mjshandlerSvc fillHandlerInfo: don't know this typeMust have a source and a callback@mozilla.org/network/input-stream-pump;1newChannel requires a single object argumentSEC_ALLOW_CROSS_ORIGIN_SEC_CONTEXT_IS_NULL@mozilla.org/scriptableinputstream;1https://mail.yahoo.co.jp/compose/?To=%sNon-zero amount of bytes must be specifiedhttps://mail.yandex.ru/compose?mailto=%shttps://e.mail.ru/cgi-bin/sentmsg?mailto=%spdfjs.previousHandler.preferredActionpdfjs.previousHandler.alwaysAskBeforeHandlinghttps://mail.inbox.lv/compose?to=%shttps://poczta.interia.pl/mh/?mailto=%s@mozilla.org/uriloader/handler-service;1VALIDATE_DONT_COLLAPSE_WHITESPACE@mozilla.org/network/simple-stream-listener;1@mozilla.org/intl/converter-input-stream;1First argument should be an nsIInputStream@mo
Source: firefox.exe, 00000020.00000002.2933675468.0000017CD9F08000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: {incognito:null, tabId:null, types:["image"], urls:["://track.adform.net/Serving/TrackPoint/", "://pixel.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/"], windowId:null} equals www.facebook.com (Facebook)
Source: firefox.exe, 00000020.00000002.2933675468.0000017CD9F06000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: {incognito:null, tabId:null, types:["imageset"], urls:["://track.adform.net/Serving/TrackPoint/", "://pixel.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/"], windowId:null} equals www.facebook.com (Facebook)
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A46000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: {incognito:null, tabId:null, types:["script"], urls:["://webcompat-addon-testbed.herokuapp.com/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js", "://track.adform.net/serving/scripts/trackpoint/", "://track.adform.net/serving/scripts/trackpoint/async/", "://.adnxs.com//ast.js", "://.adnxs.com//pb.js", "://.adnxs.com//prebid", "://www.everestjs.net/static/st.v3.js", "://static.adsafeprotected.com/vans-adapter-google-ima.js", "://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "://cdn.branch.io/branch-latest.min.js", "://pub.doubleverify.com/signals/pub.js", "://c.amazon-adsystem.com/aax2/apstag.js", "://auth.9c9media.ca/auth/main.js", "://static.chartbeat.com/js/chartbeat.js", "://static.chartbeat.com/js/chartbeat_video.js", "://static.criteo.net/js/ld/publishertag.js", "://.imgur.com/js/vendor..bundle.js", "://.imgur.io/js/vendor..bundle.js", "://www.rva311.com/static/js/main..chunk.js", "://web-assets.toggl.com/app/assets/scripts/.js", "://libs.coremetrics.com/eluminate.js", "://connect.facebook.net//sdk.js", "://connect.facebook.net//all.js", "://secure.cdn.fastclick.net/js/cnvr-launcher//launcher-stub.min.js", "://www.google-analytics.com/analytics.js", "://www.google-analytics.com/gtm/js", "://www.googletagmanager.com/gtm.js", "://www.google-analytics.com/plugins/ua/ec.js", "://ssl.google-analytics.com/ga.js", "://s0.2mdn.net/instream/html5/ima3.js", "://imasdk.googleapis.com/js/sdkloader/ima3.js", "://www.googleadservices.com/pagead/conversion_async.js", "://www.googletagservices.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/gpt/pubads_impl_.js", "://securepubads.g.doubleclick.net/tag/js/gpt.js", "://securepubads.g.doubleclick.net/gpt/pubads_impl_.js", "://script.ioam.de/iam.js", "://cdn.adsafeprotected.com/iasPET.1.js", "://static.adsafeprotected.com/iasPET.1.js", "://adservex.media.net/videoAds.js", "://.moatads.com//moatad.js", "://.moatads.com//moatapi.js", "://.moatads.com//moatheader.js", "://.moatads.com//yi.js", "://.imrworldwide.com/v60.js", "://cdn.optimizely.com/js/.js", "://cdn.optimizely.com/public/.js", "://id.rambler.ru/rambler-id-helper/auth_events.js", "://media.richrelevance.com/rrserver/js/1.2/p13n.js", "://www.gstatic.com/firebasejs//firebase-messaging.js", "://.vidible.tv//vidible-min.js", "://vdb-cdn-files.s3.amazonaws.com//vidible-min.js", "://js.maxmind.com/js/apis/geoip2//geoip2.js", "://s.webtrends.com/js/advancedLinkTracking.js", "://s.webtrends.com/js/webtrends.js", "://s.webtrends.com/js/webtrends.min.js"], windowId:
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A46000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: {incognito:null, tabId:null, types:["script"], urls:["://webcompat-addon-testbed.herokuapp.com/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js", "://track.adform.net/serving/scripts/trackpoint/", "://track.adform.net/serving/scripts/trackpoint/async/", "://.adnxs.com//ast.js", "://.adnxs.com//pb.js", "://.adnxs.com//prebid", "://www.everestjs.net/static/st.v3.js", "://static.adsafeprotected.com/vans-adapter-google-ima.js", "://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "://cdn.branch.io/branch-latest.min.js", "://pub.doubleverify.com/signals/pub.js", "://c.amazon-adsystem.com/aax2/apstag.js", "://auth.9c9media.ca/auth/main.js", "://static.chartbeat.com/js/chartbeat.js", "://static.chartbeat.com/js/chartbeat_video.js", "://static.criteo.net/js/ld/publishertag.js", "://.imgur.com/js/vendor..bundle.js", "://.imgur.io/js/vendor..bundle.js", "://www.rva311.com/static/js/main..chunk.js", "://web-assets.toggl.com/app/assets/scripts/.js", "://libs.coremetrics.com/eluminate.js", "://connect.facebook.net//sdk.js", "://connect.facebook.net//all.js", "://secure.cdn.fastclick.net/js/cnvr-launcher//launcher-stub.min.js", "://www.google-analytics.com/analytics.js", "://www.google-analytics.com/gtm/js", "://www.googletagmanager.com/gtm.js", "://www.google-analytics.com/plugins/ua/ec.js", "://ssl.google-analytics.com/ga.js", "://s0.2mdn.net/instream/html5/ima3.js", "://imasdk.googleapis.com/js/sdkloader/ima3.js", "://www.googleadservices.com/pagead/conversion_async.js", "://www.googletagservices.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/gpt/pubads_impl_.js", "://securepubads.g.doubleclick.net/tag/js/gpt.js", "://securepubads.g.doubleclick.net/gpt/pubads_impl_.js", "://script.ioam.de/iam.js", "://cdn.adsafeprotected.com/iasPET.1.js", "://static.adsafeprotected.com/iasPET.1.js", "://adservex.media.net/videoAds.js", "://.moatads.com//moatad.js", "://.moatads.com//moatapi.js", "://.moatads.com//moatheader.js", "://.moatads.com//yi.js", "://.imrworldwide.com/v60.js", "://cdn.optimizely.com/js/.js", "://cdn.optimizely.com/public/.js", "://id.rambler.ru/rambler-id-helper/auth_events.js", "://media.richrelevance.com/rrserver/js/1.2/p13n.js", "://www.gstatic.com/firebasejs//firebase-messaging.js", "://.vidible.tv//vidible-min.js", "://vdb-cdn-files.s3.amazonaws.com//vidible-min.js", "://js.maxmind.com/js/apis/geoip2//geoip2.js", "://s.webtrends.com/js/advancedLinkTracking.js", "://s.webtrends.com/js/webtrends.js", "://s.webtrends.com/js/webtrends.min.js"], windowId:
Source: firefox.exe, 00000020.00000002.2933675468.0000017CD9F08000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: {incognito:null, tabId:null, types:["xmlhttprequest"], urls:["://track.adform.net/Serving/TrackPoint/", "://pagead2.googlesyndication.com/pagead/.jsfcd=true", "://pagead2.googlesyndication.com/pagead/js/.jsfcd=true", "://pixel.advertising.com/firefox-etp", "://cdn.cmp.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "https://static.adsafeprotected.com/firefox-etp-js", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/*"], windowId:null} equals www.facebook.com (Facebook)

Source: firefox.exe, 00000020.00000002.2919639043.0000017CD92A2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.2900114787.0000017CC985D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:
Source: f039f524ee.exe, 0000000F.00000003.2837717203.0000000001029000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/
Source: f039f524ee.exe, 0000000F.00000003.2837717203.0000000001029000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/9t
Source: f039f524ee.exe, 0000000F.00000003.2837717203.0000000001029000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/k
Source: file.exe, 00000000.00000002.2107233640.0000000000E57000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2107233640.0000000000ED6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: file.exe, 00000000.00000002.2107233640.0000000000E57000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exeg
Source: f039f524ee.exe, 0000000F.00000003.2848661309.0000000000FE5000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2848661309.0000000000FB0000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2849666702.0000000001004000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.3084418747.00000000011F9000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.3072941768.00000000011F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe
Source: f039f524ee.exe, 0000000F.00000003.2848661309.0000000000FE5000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2849666702.0000000001004000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exee
Source: f039f524ee.exe, 0000000F.00000003.2848661309.0000000000FE5000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2849666702.0000000001004000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exeq
Source: f039f524ee.exe, 0000000F.00000003.2848661309.0000000000FE5000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2837717203.0000000001029000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2849666702.0000000001004000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.3084418747.00000000011F9000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.3072941768.00000000011F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe
Source: f039f524ee.exe, 0000000F.00000003.2837717203.0000000001029000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exet_
Source: f039f524ee.exe, 0000000F.00000003.2848661309.0000000000FE5000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2849666702.0000000001004000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16:80/off/def.exeCLSID
Source: file.exe, 00000000.00000002.2107422140.0000000001117000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2107233640.0000000000DFE000.00000004.00000020.00020000.00000000.sdmp, f377015f96.exe, 00000010.00000002.2681962698.000000000155E000.00000004.00000020.00020000.00000000.sdmp, f377015f96.exe, 00000019.00000002.2861247425.0000000001A6B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: f377015f96.exe, 00000019.00000002.2861247425.0000000001A6B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206(K
Source: f377015f96.exe, 00000010.00000002.2681962698.00000000015B7000.00000004.00000020.00020000.00000000.sdmp, f377015f96.exe, 00000019.00000002.2861247425.0000000001A6B000.00000004.00000020.00020000.00000000.sdmp, f377015f96.exe, 00000019.00000002.2861247425.0000000001ABE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000000.00000002.2107233640.0000000000E57000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/1
Source: file.exe, 00000000.00000002.2107233640.0000000000E71000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll
Source: file.exe, 00000000.00000002.2107233640.0000000000E71000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll0
Source: file.exe, 00000000.00000002.2107233640.0000000000E71000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dllH
Source: file.exe, 00000000.00000002.2107233640.0000000000E57000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll
Source: file.exe, 00000000.00000002.2107233640.0000000000E71000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll
Source: file.exe, 00000000.00000002.2107233640.0000000000E57000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll
Source: file.exe, 00000000.00000002.2107233640.0000000000E57000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dllG
Source: file.exe, 00000000.00000002.2107233640.0000000000E71000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll
Source: file.exe, 00000000.00000002.2107233640.0000000000E71000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dllt
Source: file.exe, 00000000.00000002.2107233640.0000000000DFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll
Source: f377015f96.exe, 00000019.00000002.2861247425.0000000001ABE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/?
Source: f377015f96.exe, 00000019.00000002.2861247425.0000000001ABE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/H
Source: f377015f96.exe, 00000019.00000002.2861247425.0000000001ABE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/L
Source: f377015f96.exe, 00000010.00000002.2681962698.00000000015B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/V
Source: f377015f96.exe, 00000019.00000002.2861247425.0000000001ABE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: file.exe, 00000000.00000002.2112319814.000000000BD1A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php-
Source: f377015f96.exe, 00000010.00000002.2681962698.00000000015B7000.00000004.00000020.00020000.00000000.sdmp, f377015f96.exe, 00000019.00000002.2861247425.0000000001ABE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php/
Source: f377015f96.exe, 00000010.00000002.2681962698.00000000015B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php2
Source: f377015f96.exe, 00000019.00000002.2861247425.0000000001ABE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpV
Source: f377015f96.exe, 00000010.00000002.2681962698.000000000155E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpa-7368302a1ad4
Source: file.exe, 00000000.00000002.2107233640.0000000000E45000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpbK
Source: file.exe, 00000000.00000002.2107233640.0000000000E71000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpd
Source: file.exe, 00000000.00000002.2107422140.0000000001117000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phper
Source: f377015f96.exe, 00000010.00000002.2681962698.00000000015B7000.00000004.00000020.00020000.00000000.sdmp, f377015f96.exe, 00000019.00000002.2861247425.0000000001ABE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpn
Source: file.exe, 00000000.00000002.2112319814.000000000BD1A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phppresolver.dll
Source: f377015f96.exe, 00000010.00000002.2681962698.00000000015B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpr
Source: file.exe, 00000000.00000002.2107233640.0000000000E57000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/i
Source: f377015f96.exe, 00000019.00000002.2861247425.0000000001ABE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/ocal
Source: f377015f96.exe, 00000010.00000002.2681962698.000000000155E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/~
Source: f377015f96.exe, 00000019.00000002.2861247425.0000000001A6B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206H
Source: file.exe, 00000000.00000002.2107233640.0000000000DFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206M
Source: file.exe, 00000000.00000002.2107422140.0000000001117000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206c4becf79229cb002.phpser
Source: f377015f96.exe, 00000010.00000002.2681962698.000000000155E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206y
Source: a17088d8c7.exe, 0000000D.00000003.3117232730.00000000055B2000.00000004.00000020.00020000.00000000.sdmp, a17088d8c7.exe, 0000000D.00000003.3117232730.00000000055D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/
Source: a17088d8c7.exe, 0000000D.00000003.3117232730.00000000055D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/b%_
Source: a17088d8c7.exe, 0000000D.00000003.3117232730.00000000055CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/cdb-53011b87bd06
Source: a17088d8c7.exe, 0000000D.00000003.3078884337.00000000055B2000.00000004.00000020.00020000.00000000.sdmp, a17088d8c7.exe, 0000000D.00000003.3117232730.00000000055B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/dll/downloadhqos.dll.mui
Source: a17088d8c7.exe, 0000000D.00000003.3117232730.00000000055D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/dll/key
Source: a17088d8c7.exe, 0000000D.00000003.3117232730.00000000055D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/files/download
Source: a17088d8c7.exe, 0000000D.00000003.3078884337.00000000055D4000.00000004.00000020.00020000.00000000.sdmp, a17088d8c7.exe, 0000000D.00000003.3117232730.00000000055D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/files/download3&l
Source: a17088d8c7.exe, 0000000D.00000003.3078884337.00000000055D4000.00000004.00000020.00020000.00000000.sdmp, a17088d8c7.exe, 0000000D.00000003.3117232730.00000000055D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/files/download=&b
Source: a17088d8c7.exe, 0000000D.00000003.3078884337.00000000055D4000.00000004.00000020.00020000.00000000.sdmp, a17088d8c7.exe, 0000000D.00000003.3117232730.00000000055D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/files/downloadi
Source: f039f524ee.exe, 0000000F.00000003.2647391727.000000000574A000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2771585453.00000000058D5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2937492782.0000017CDA7C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: f039f524ee.exe, 0000000F.00000003.2647391727.000000000574A000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2771585453.00000000058D5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2937492782.0000017CDA7C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: firefox.exe, 00000020.00000002.2907178707.0000017CD557D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%s
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%s_injectDefaultProtocolHandlersIfNeeded
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%s_injectDefaultProtocolHandlersIfNeededisDownloadsImp
Source: firefox.exe, 00000020.00000002.2914904234.0000017CD79B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%ss
Source: f039f524ee.exe, 0000000F.00000003.2647391727.000000000574A000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2771585453.00000000058D5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2937492782.0000017CDA7C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: f039f524ee.exe, 0000000F.00000003.2647391727.000000000574A000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2771585453.00000000058D5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2937492782.0000017CDA7C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: f039f524ee.exe, 0000000F.00000003.2647391727.000000000574A000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2771585453.00000000058D5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2937492782.0000017CDA7C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: f039f524ee.exe, 0000000F.00000003.2647391727.000000000574A000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2771585453.00000000058D5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2937492782.0000017CDA7C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: f039f524ee.exe, 0000000F.00000003.2647391727.000000000574A000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2771585453.00000000058D5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2937492782.0000017CDA7C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: firefox.exe, 00000020.00000002.2944247945.0000017CDBA28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/canonical.html
Source: firefox.exe, 00000020.00000002.2933675468.0000017CD9F17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/canonical.htmlACTIVITY_SUBTYPE_REQUEST_BODY_SENTACTIVITY_SUBTYPE_PRO
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv4
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv6
Source: firefox.exe, 00000020.00000002.2908012090.0000017CD5912000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2908012090.0000017CD592C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.addEventListener
Source: firefox.exe, 00000020.00000002.2908012090.0000017CD5912000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2908012090.0000017CD592C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.removeEventListener
Source: firefox.exe, 00000020.00000002.2904680065.0000017CD4F26000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/common
Source: firefox.exe, 00000020.00000002.2904680065.0000017CD4F61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/dates-and-times$
Source: firefox.exe, 00000020.00000002.2904680065.0000017CD4F26000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/math
Source: firefox.exe, 00000020.00000002.2904680065.0000017CD4F61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/regular-expressionsh
Source: firefox.exe, 00000020.00000002.2904680065.0000017CD4F26000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/sets
Source: firefox.exe, 00000020.00000002.2900114787.0000017CC9803000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/strings
Source: firefox.exe, 00000020.00000002.2951694809.0000017CDCB2F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2944247945.0000017CDBACF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2923664473.0000017CD98DD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2831846902.0000017CD98C1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2906223989.0000017CD50B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2944247945.0000017CDBA62000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2935328508.0000017CDA103000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2943062764.0000017CDB31B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2949018481.0000017CDC044000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2951694809.0000017CDCB40000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2919639043.0000017CD9203000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2944247945.0000017CDBA51000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2924396777.0000017CD9988000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2937492782.0000017CDA71D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/MPL/2.0/.
Source: f039f524ee.exe, 0000000F.00000003.2647391727.000000000574A000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2771585453.00000000058D5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2937492782.0000017CDA7C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: f039f524ee.exe, 0000000F.00000003.2647391727.000000000574A000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2771585453.00000000058D5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2937492782.0000017CDA7C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2907178707.0000017CD557D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 00000020.00000002.2914904234.0000017CD79B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://poczta.interia.pl/mh/?mailto=%sw
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2907178707.0000017CD557D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 00000020.00000002.2914904234.0000017CD79B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%sy
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2907178707.0000017CD557D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.inbox.lv/rfc2368/?value=%s
Source: firefox.exe, 00000020.00000002.2914904234.0000017CD79B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.inbox.lv/rfc2368/?value=%su
Source: file.exe, file.exe, 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: firefox.exe, 00000020.00000002.2924396777.0000017CD9988000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2908457770.0000017CD5A9E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5AAF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulchrome://browser/content/browser-tabsin
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A9E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulchrome://browser/content/places/browser
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulchrome://global/content/elements/moz-me
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A9E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulchrome://passwordmgr/locale/passwordmgr
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A9E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulhttp://www.mozilla.org/keymaster/gateke
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5AE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulresource:///modules/UrlbarProviderTopSi
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5AE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulresource:///modules/sessionstore/Sessio
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5AE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulresource://gre/modules/PrivateBrowsingU
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A46000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulresource://gre/modules/URLDecorationAnn
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5AE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulsrc=image
Source: file.exe, 00000000.00000002.2109410050.0000000005CE9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2115895916.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: f039f524ee.exe, 0000000F.00000003.2647391727.000000000574A000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2771585453.00000000058D5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2937492782.0000017CDA7C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: f039f524ee.exe, 0000000F.00000003.2647391727.000000000574A000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2771585453.00000000058D5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2937492782.0000017CDA7C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.malware-error.mozilla.com/?url=
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.phish-error.mozilla.com/?url=
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.phish-report.mozilla.com/?url=
Source: firefox.exe, 00000020.00000002.2916806678.0000017CD8B70000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000003.2818869675.0000017CD945A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2817374710.0000017CD9200000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2817893137.0000017CD941F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2819165160.0000017CD9477000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2818486632.0000017CD943C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.duckduckgo.com/ac/
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.duckduckgo.com/ac/defaultPreventedByContenthttps://www.google.com/searchget
Source: file.exe, 00000000.00000003.1863399988.0000000000ED0000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2589952496.000000000573F000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2590072407.0000000005728000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2713287494.00000000058EB000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2713694037.00000000058E9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: firefox.exe, 00000020.00000002.2951694809.0000017CDCB78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://account.bellmedia.c
Source: firefox.exe, 00000020.00000002.2949018481.0000017CDC0E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://account.bellmedia.ca
Source: firefox.exe, 00000020.00000002.2914904234.0000017CD7978000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD6703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com/
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com/settings/clients
Source: firefox.exe, 00000020.00000002.2918847879.0000017CD9133000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2908457770.0000017CD5A03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2914904234.0000017CD79F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/language-tools/
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search-engines/
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search?q=%TERMS%&platform=%OS%&appver=%VERSION%
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/themes
Source: firefox.exe, 00000020.00000002.2933675468.0000017CD9F03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ads.stickyadstv.com/firefox-etp
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ads.stickyadstv.com/firefox-etpresource://gre/modules/ShortcutUtils.sys.mjs
Source: firefox.exe, 00000020.00000002.2914904234.0000017CD7978000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD677D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://amazon.com
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://api.accounts.firefox.com/v1
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://apps.apple.com/app/firefox-private-safe-browser/id989804926
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://apps.apple.com/us/app/firefox-private-network-vpn/id1489407738
Source: f039f524ee.exe, 0000000F.00000003.2848661309.0000000000FE5000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2646499229.0000000001011000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2843200148.0000000001012000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2848661309.0000000000FA5000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2589842358.0000000001013000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2589686211.000000000100F000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2590354965.0000000001013000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2616118705.0000000001012000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2777000037.0000000001012000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2904185884.00000000011FA000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2803779137.00000000011DC000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2771485025.00000000011DD000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2862654694.00000000011DE000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2742444167.00000000011DB000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2742195555.00000000011D8000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2770447800.00000000011D8000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2776788243.00000000011DD000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2771976922.00000000011DD000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2847569257.00000000011DC000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2889643830.00000000011FA000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2775962014.00000000011DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/
Source: f039f524ee.exe, 00000011.00000003.2889643830.00000000011E5000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2816854374.00000000011E7000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.3072941768.00000000011E8000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2809295731.00000000011E3000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2803779137.00000000011DC000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2803011829.00000000011D8000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2903405613.00000000011E8000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2771485025.00000000011DD000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2742444167.00000000011DB000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2742195555.00000000011D8000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2845300625.00000000011E8000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2770447800.00000000011D8000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2713492473.00000000011D9000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2776788243.00000000011DD000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2771976922.00000000011DD000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2775962014.00000000011DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/#
Source: f039f524ee.exe, 0000000F.00000003.2707665355.0000000001011000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/#4
Source: f039f524ee.exe, 0000000F.00000003.2848661309.0000000000FE5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/0
Source: f039f524ee.exe, 00000011.00000003.2803011829.00000000011D8000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2742444167.00000000011DB000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2742195555.00000000011D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/T
Source: f039f524ee.exe, 00000011.00000003.2713156874.00000000011D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/U
Source: f039f524ee.exe, 00000011.00000003.2904185884.00000000011FA000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2889643830.00000000011FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/VV
Source: f039f524ee.exe, 0000000F.00000003.2646499229.0000000001011000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2678578144.0000000001018000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2673028661.0000000001017000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2675427284.0000000001018000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2682193338.000000000101A000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2680574921.0000000001018000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2678009352.0000000001018000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2776383187.0000000001032000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2681445195.0000000001018000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2678906552.0000000001018000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2679263353.0000000001018000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2678083034.0000000001018000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2675179858.0000000001018000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2679554542.0000000001018000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2678456559.0000000001018000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2678381424.0000000001018000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2680795575.0000000001018000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2680339133.0000000001018000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2679363395.0000000001018000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2837717203.0000000001029000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2646636082.0000000001017000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/api
Source: f039f524ee.exe, 0000000F.00000003.2672861730.0000000001028000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/api.a
Source: f039f524ee.exe, 0000000F.00000003.2848661309.0000000000FE5000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2849666702.0000000001004000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/apiC
Source: f039f524ee.exe, 00000011.00000003.2904185884.00000000011FA000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.3084418747.00000000011F9000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2809295731.00000000011E3000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2861815157.00000000011F2000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2803779137.00000000011DC000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2803011829.00000000011D8000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2809371493.00000000011F2000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.3072941768.00000000011F9000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2842457103.00000000011F9000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2809334415.00000000011EA000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2814773574.00000000011F3000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2889643830.00000000011FA000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2817596296.00000000011FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/apiEW
Source: f039f524ee.exe, 00000011.00000003.2742444167.00000000011DB000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2742195555.00000000011D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/apiR
Source: f039f524ee.exe, 0000000F.00000003.2714506979.0000000001037000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2713837367.000000000102A000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2708103066.0000000001037000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/apiluv
Source: f039f524ee.exe, 00000011.00000003.2904185884.00000000011FA000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2889643830.00000000011FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/nV
Source: f039f524ee.exe, 0000000F.00000003.2672861730.0000000001011000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/s4p6
Source: f039f524ee.exe, 0000000F.00000003.2671657527.000000000571C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz:443/api
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/3/GMP/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%OS_VER
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/3/SystemAddons/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL
Source: firefox.exe, 00000020.00000002.2900114787.0000017CC9811000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/6/%PRODUCT%/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://blocked.cdn.mozilla.net/
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://blocked.cdn.mozilla.net/%blockID%.html
Source: file.exe, 00000000.00000002.2112319814.000000000BD12000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2107233640.0000000000ED6000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2649157391.0000000001027000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2776788243.00000000011D8000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2914904234.0000017CD7978000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD6757000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2904680065.0000017CD4FAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD677D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: file.exe, 00000000.00000002.2112319814.000000000BD12000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2107233640.0000000000ED6000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2649157391.0000000001027000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2914904234.0000017CD7978000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD6757000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2904680065.0000017CD4FAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD677D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: firefox.exe, 00000020.00000002.2931947413.0000017CD9E8B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD6725000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2929235826.0000017CD9B64000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mo
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5AAF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1238180
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5AAF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1238180Required
Source: file.exe, 00000000.00000003.1863399988.0000000000ED0000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2589952496.000000000573F000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2590072407.0000000005728000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2713287494.00000000058EB000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2713694037.00000000058E9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.1863399988.0000000000ED0000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2589952496.000000000573F000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2590072407.0000000005728000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2713287494.00000000058EB000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2713694037.00000000058E9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.1863399988.0000000000ED0000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2589952496.000000000573F000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2590072407.0000000005728000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2713287494.00000000058EB000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2713694037.00000000058E9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2819165160.0000017CD9477000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2818486632.0000017CD943C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://completion.amazon.com/search/complete?q=
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://content.cdn.mozilla.net
Source: file.exe, 00000000.00000002.2112319814.000000000BD12000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2107233640.0000000000ED6000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2649157391.0000000001027000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2776788243.00000000011D8000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2914904234.0000017CD7978000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD6757000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD6703000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2904680065.0000017CD4FAD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: file.exe, 00000000.00000002.2112319814.000000000BD12000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2107233640.0000000000ED6000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2649157391.0000000001027000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2914904234.0000017CD7978000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD6757000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2904680065.0000017CD4FAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD677D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com/v1/tiles
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://coverage.mozilla.org
Source: firefox.exe, 00000020.00000002.2900114787.0000017CC9811000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2900114787.0000017CC9830000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://crash-reports.mozilla.com/submit?id=
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://crash-stats.mozilla.org/report/index/
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://dap-02.api.divviup.org
Source: firefox.exe, 00000020.00000002.2908012090.0000017CD5912000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2908012090.0000017CD592C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/tabs/captureTab
Source: firefox.exe, 00000020.00000002.2908012090.0000017CD592C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/releasePointerCapture
Source: firefox.exe, 00000020.00000002.2908012090.0000017CD5912000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2908012090.0000017CD592C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/setPointerCapture
Source: firefox.exe, 00000020.00000002.2908012090.0000017CD5912000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2908012090.0000017CD592C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Push_API/Using_the_Push_API#Encryption
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/Add-ons/WebExtensions/manifest.json/commands#Key_combinations
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/Add-ons/WebExtensions/manifest.json/commands#Key_combinationsbro
Source: firefox.exe, 00000020.00000002.2908012090.0000017CD5912000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2908012090.0000017CD592C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsing
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developers.google.com/safe-browsing/v4/advisory
Source: firefox.exe, 00000020.00000002.2914904234.0000017CD7978000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD677D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com
Source: firefox.exe, 00000020.00000002.2916806678.0000017CD8B70000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.2962001308.000033A27A704000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2818869675.0000017CD945A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2817374710.0000017CD9200000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2931947413.0000017CD9E75000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2817893137.0000017CD941F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2819165160.0000017CD9477000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2961160758.00000D1113504000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2961027699.00000C5949A04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2818486632.0000017CD943C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/
Source: firefox.exe, 00000020.00000002.2962001308.000033A27A704000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/Z
Source: file.exe, 00000000.00000003.1863399988.0000000000ED0000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2589952496.000000000573F000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2590072407.0000000005728000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2713287494.00000000058EB000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2713694037.00000000058E9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.1863399988.0000000000ED0000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2589952496.000000000573F000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2590072407.0000000005728000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2713287494.00000000058EB000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2713694037.00000000058E9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.1863399988.0000000000ED0000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2589952496.000000000573F000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2590072407.0000000005728000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2713287494.00000000058EB000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2713694037.00000000058E9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: firefox.exe, 00000020.00000003.2821382400.0000017CD7A33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2823903373.0000017CD7A28000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2914904234.0000017CD79B1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2916219970.0000017CD7A28000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2907178707.0000017CD557D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 00000020.00000002.2914904234.0000017CD79B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%sz
Source: firefox.exe, 00000020.00000002.2914904234.0000017CD79B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%szw
Source: firefox.exe, 00000020.00000003.2821382400.0000017CD7A33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2823903373.0000017CD7A28000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2914904234.0000017CD79B1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2916219970.0000017CD7A28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://email.seznam.cz/newMessageScreen?mailto=%s
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://email.seznam.cz/newMessageScreen?mailto=%sAttempted
Source: firefox.exe, 00000020.00000002.2908012090.0000017CD5912000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2908012090.0000017CD592C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://extensionworkshop.com/documentation/publish/self-distribution/
Source: firefox.exe, 00000020.00000002.2914904234.0000017CD7978000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD6703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-api-proxy.cdn.mozilla.net/
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://firefox-source-docs.mozilla.org/networking/dns/trr-skip-reasons.html#
Source: firefox.exe, 00000020.00000002.2908012090.0000017CD5912000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-source-docs.mozilla.org/performance/scroll-linked_effects.html
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A26000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-source-docs.mozilla.org/remote/Security.html
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.allizom.org/v1/buckets/main-preview/collections/search-config/reco
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/records
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main-preview/collections/search-config/reco
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/search-config/records
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1AIzaSyB2h2OuRcUgy5N-5hsZqiPW6sH3n_rptiQ
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1AIzaSyB2h2OuRcUgy5N-5hsZqiPW6sH3n_rptiQPopulating
Source: firefox.exe, 00000020.00000002.2910130082.0000017CD6757000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2962100177.0000360BFBE04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2900114787.0000017CC988F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fpn.firefox.com
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://fpn.firefox.com/browser?utm_source=firefox-desktop&utm_medium=referral&utm_campaign=about-pr
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://ftp.mozilla.org/pub/labs/devtools/adb-extension/#OS#/adb-extension-latest-#OS#.xpi
Source: firefox.exe, 00000020.00000002.2914904234.0000017CD7978000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD6703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/
Source: firefox.exe, 00000020.00000002.2910130082.0000017CD6703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=
Source: firefox.exe, 00000020.00000002.2910130082.0000017CD6703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_l
Source: firefox.exe, 00000020.00000002.2914904234.0000017CD7978000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD6703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=bas
Source: firefox.exe, 00000020.00000002.2914904234.0000017CD7978000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD6703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=40249-e88c401e1b1f2242d9e4
Source: firefox.exe, 00000020.00000002.2914904234.0000017CD7978000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD6703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/career?utm_source=pocket-newtab
Source: firefox.exe, 00000020.00000002.2914904234.0000017CD7978000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD6703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/entertainment?utm_source=pocket-newtab
Source: firefox.exe, 00000020.00000002.2914904234.0000017CD7978000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD6703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/food?utm_source=pocket-newtab
Source: firefox.exe, 00000020.00000002.2914904234.0000017CD7978000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD6703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/health?utm_source=pocket-newtab
Source: firefox.exe, 00000020.00000002.2914904234.0000017CD7978000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD6703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/science?utm_source=pocket-newtab
Source: firefox.exe, 00000020.00000002.2914904234.0000017CD7978000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD6703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/self-improvement?utm_source=pocket-newtab
Source: firefox.exe, 00000020.00000002.2914904234.0000017CD7978000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD6703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/technology?utm_source=pocket-newtab
Source: firefox.exe, 00000020.00000002.2910130082.0000017CD6703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tab
Source: firefox.exe, 00000020.00000002.2914904234.0000017CD7978000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD6703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore?utm_source=pocket-newtab
Source: firefox.exe, 00000020.00000002.2910130082.0000017CD6703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_more
Source: firefox.exe, 00000020.00000002.2910130082.0000017CD6703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendations
Source: firefox.exe, 00000020.00000002.2913093502.0000017CD6903000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/
Source: firefox.exe, 00000020.00000002.2916806678.0000017CD8B70000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000003.2818869675.0000017CD945A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2817374710.0000017CD9200000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2817893137.0000017CD941F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2819165160.0000017CD9477000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2818486632.0000017CD943C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mozilla-services/screenshots
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mozilla-services/screenshots/shims/google-analytics-ecommerce-plugin.jsasyncEmitM
Source: firefox.exe, 00000020.00000002.2914904234.0000017CD7978000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD677D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://helper1.dap.cloudflareresearch.com/v02
Source: firefox.exe, 00000020.00000002.2900114787.0000017CC9811000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2908457770.0000017CD5A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881No
Source: firefox.exe, 00000020.00000002.2900114787.0000017CC9811000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881w
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://ideas.mozilla.org/
Source: firefox.exe, 00000020.00000002.2910130082.0000017CD677D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: firefox.exe, 00000020.00000002.2906223989.0000017CD50FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org
Source: firefox.exe, 00000020.00000002.2914904234.0000017CD7978000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD6703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submit
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://install.mozilla.org
Source: firefox.exe, 00000020.00000002.2929235826.0000017CD9B64000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com
Source: firefox.exe, 00000020.00000002.2937492782.0000017CDA71D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.2908457770.0000017CD5AE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/v1/country?key=%MOZILLA_API_KEY%
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5AE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/v1/country?key=%MOZILLA_API_KEY%primeBackground/extension.term
Source: firefox.exe, 00000020.00000002.2937492782.0000017CDA71D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/v1/country?key=7e40f68c-7938-4c5d-9f95-e61647c213eb
Source: firefox.exe, 00000020.00000002.2894411295.0000001882C3B000.00000004.00000010.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2949018481.0000017CDC0E4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2951694809.0000017CDCB78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: firefox.exe, 00000020.00000002.2949018481.0000017CDC0E4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2949018481.0000017CDC01C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2951694809.0000017CDCB78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com
Source: firefox.exe, 00000020.00000003.2821382400.0000017CD7A33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD67C8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2913093502.0000017CD6921000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2823903373.0000017CD7A28000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2914904234.0000017CD79B1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2916219970.0000017CD7A28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%s
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%sMicrosoft
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%shttps://outlook.live.com/default.aspx?rru=compose&
Source: firefox.exe, 00000020.00000003.2821382400.0000017CD7A33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2823903373.0000017CD7A28000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2914904234.0000017CD79B1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2916219970.0000017CD7A28000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2907178707.0000017CD557D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.inbox.lv/compose?to=%s
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.inbox.lv/compose?to=%sresource://gre/modules/DeferredTask.sys.mjsresource://gre/modules
Source: firefox.exe, 00000020.00000002.2914904234.0000017CD79B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.inbox.lv/compose?to=%sv
Source: firefox.exe, 00000020.00000003.2821382400.0000017CD7A33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2823903373.0000017CD7A28000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2914904234.0000017CD79B1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2916219970.0000017CD7A28000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2907178707.0000017CD557D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%s
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%sNon-zero
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%shttp://www.inbox.lv/rfc2368/?value=%sresource://gre/modules/U
Source: firefox.exe, 00000020.00000002.2914904234.0000017CD79B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%st
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2900114787.0000017CC98D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://merino.services.mozilla.com/api/v1/suggest
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://mitmdetection.services.mozilla.com/
Source: firefox.exe, 00000020.00000002.2918847879.0000017CD9133000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2908457770.0000017CD5A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/?entrypoint=protection_report_monitor&utm_source=about-protections
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/about
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/breach-details/
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/oauth/init?entrypoint=protection_report_monitor&utm_source=about-protect
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/breach-stats?includeResolved=true
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/dashboard
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/preferences
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://mozilla-ohttp-fakespot.fastly-edge.com/
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://mozilla.cloudflare-dns.com/dns-query
Source: firefox.exe, 00000020.00000002.2960702471.0000041B45E04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mozilla.org/
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mzl.la/3NS9KJd
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://normandy.cdn.mozilla.net/api/v1
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://oauth.accounts.firefox.com/v1
Source: firefox.exe, 00000020.00000003.2821382400.0000017CD7A33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2823903373.0000017CD7A28000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2914904234.0000017CD79B1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2916219970.0000017CD7A28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://outlook.live.com/default.aspx?rru=compose&to=%s
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox&referrer=utm_source%3Dprotection_r
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-
Source: firefox.exe, 00000020.00000003.2821382400.0000017CD7A33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2823903373.0000017CD7A28000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2914904234.0000017CD79B1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2916219970.0000017CD7A28000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2907178707.0000017CD557D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 00000020.00000002.2914904234.0000017CD79B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%sx
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://prod.ohttp-gateway.prod.webservices.mozgcp.net/ohttp-configs
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://profile.accounts.firefox.com/v1
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://profiler.firefox.com
Source: firefox.exe, 00000020.00000002.2914904234.0000017CD7978000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://profiler.firefox.com/
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://profiler.firefox.comFound
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://relay.firefox.com/accounts/profile/?utm_medium=firefox-desktop&utm_source=modal&utm_campaign
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://relay.firefox.com/api/v1/
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/diagnostic?site=
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&p
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/fullHashes:find?$ct=application/x-protobuf&key=%GOOGLE_SAFEBR
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatHits?$ct=application/x-protobuf&key=%GOOGLE_SAFEBROWSIN
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=%GOOGL
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://sb-ssl.google.com/safebrowsing/clientreport/download?key=%GOOGLE_SAFEBROWSING_API_KEY%
Source: firefox.exe, 00000020.00000002.2918847879.0000017CD9133000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2908457770.0000017CD5A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com
Source: firefox.exe, 00000020.00000003.2818486632.0000017CD943C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com/
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com/defineCursorUpdateMethods
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.comError:
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/abuse/report/addon/
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/addon/
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/language-tools/?app=firefox&type=language&appversi
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/discovery/?lang=%LOCALE%&edition=%DISTRIBUTION%
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5AE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://smartblock.firefox.etp/facebook.svg
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5AE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://smartblock.firefox.etp/play.svg
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://snippets.cdn.mozilla.net/%STARTPAGE_VERSION%/%NAME%/%VERSION%/%APPBUILDID%/%BUILD_TARGET%/%L
Source: firefox.exe, 00000020.00000002.2914904234.0000017CD7978000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD6703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/
Source: firefox.exe, 00000020.00000002.2914904234.0000017CD7978000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD6703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/spocs
Source: firefox.exe, 00000020.00000002.2914904234.0000017CD7978000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD6703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/user
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5AE0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2933948328.0000017CDA07C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-js
Source: firefox.exe, 00000020.00000002.2933675468.0000017CD9F03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-pixel
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-pixelhttps://static.adsafeprotected.com/firefox-etp-j
Source: f039f524ee.exe, 0000000F.00000003.2590447061.000000000576E000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2714415572.0000000005945000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.microsof
Source: firefox.exe, 00000020.00000002.2918847879.0000017CD9133000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2908457770.0000017CD5A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org
Source: firefox.exe, 00000020.00000002.2933675468.0000017CD9F17000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/
Source: firefox.exe, 00000020.00000002.2933675468.0000017CD9F17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/Master
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cryptominers-report
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/firefox-relay-integration
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/password-manager-report
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/search-engine-removal
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/send-tab
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/shield
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/social-media-tracking-report
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/tracking-content-report
Source: firefox.exe, 00000020.00000002.2933675468.0000017CD9F17000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2945286285.0000017CDBBA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/118.0.1/WINNT/en-US/
Source: firefox.exe, 00000020.00000002.2933675468.0000017CD9F17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/118.0.1/WINNT/en-US/browser.newtabpage.activity-stream.feeds.s
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5AE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/captive-portal
Source: f039f524ee.exe, 00000011.00000003.2776079766.00000000059C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: firefox.exe, 00000020.00000002.2908012090.0000017CD592C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windows
Source: firefox.exe, 00000020.00000002.2933675468.0000017CD9F17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/website-translation
Source: firefox.exe, 00000020.00000002.2933675468.0000017CD9F17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/website-translationtranslations-panel-settings-always-translate-langu
Source: f039f524ee.exe, 00000011.00000003.2776079766.00000000059C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: file.exe, 00000000.00000003.1990378087.000000000C0AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.orgbookmarksToolbarWasVisiblehttps://monitor.firefox.comnetwork.proxy.backup
Source: file.exe, 00000000.00000002.2107422140.0000000001034000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1850065167.0000000005BDD000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2590447061.000000000576C000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2615864764.0000000005765000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2590570427.0000000005765000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2615626694.0000000005765000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2714885498.00000000058F7000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2714415572.0000000005943000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2741888141.00000000058F7000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2742266532.00000000058F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: f039f524ee.exe, 0000000F.00000003.2590570427.0000000005740000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2714885498.00000000058D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: file.exe, 00000000.00000002.2107422140.0000000001034000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1850065167.0000000005BDD000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2590447061.000000000576C000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2615864764.0000000005765000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2590570427.0000000005765000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2615626694.0000000005765000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2714885498.00000000058F7000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2714415572.0000000005943000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2741888141.00000000058F7000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2742266532.00000000058F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: f039f524ee.exe, 0000000F.00000003.2590570427.0000000005740000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2714885498.00000000058D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://token.services.mozilla.com/1.0/sync/1.5
Source: firefox.exe, 00000020.00000002.2908012090.0000017CD592C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-2
Source: firefox.exe, 00000020.00000002.2908012090.0000017CD592C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-3.1
Source: firefox.exe, 00000020.00000002.2908012090.0000017CD592C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-4
Source: firefox.exe, 00000020.00000002.2908012090.0000017CD592C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc7515#appendix-C)
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://topsites.services.mozilla.com/cid/
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://tracking-protection-issues.herokuapp.com/new
Source: firefox.exe, 00000020.00000002.2918847879.0000017CD9133000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2908457770.0000017CD5A03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2914904234.0000017CD79F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://truecolors.firefox.com
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://truecolors.firefox.comhttps://addons.mozilla.orgpictureinpicture.settingsaccount-connection-
Source: firefox.exe, 00000020.00000002.2914904234.0000017CD7978000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD6757000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD6703000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD677D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://versioncheck.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM_ID
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-%CHANNEL%-browser&utm_campaig
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campaign=about-pr
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://webcompat.com/issues/new
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://webextensions.settings.services.mozilla.com/v1
Source: file.exe, 00000000.00000002.2112319814.000000000BD12000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2107233640.0000000000ED6000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2649157391.0000000001027000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2914904234.0000017CD7978000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD6757000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2904680065.0000017CD4FAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD677D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2819165160.0000017CD9477000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2818486632.0000017CD943C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/moz-extension://e2beb7c2-ef50-4ddd-9210-92a40514d
Source: firefox.exe, 00000020.00000002.2910130082.0000017CD6725000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.de/
Source: file.exe, 00000000.00000003.1863399988.0000000000ED0000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2589952496.000000000573F000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2590072407.0000000005728000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2713287494.00000000058EB000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2713694037.00000000058E9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe, 00000000.00000002.2112319814.000000000BD12000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2107233640.0000000000ED6000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2649157391.0000000001027000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2776788243.00000000011D8000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2914904234.0000017CD7978000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD6757000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2904680065.0000017CD4FAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD677D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2819165160.0000017CD9477000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2818486632.0000017CD943C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/search?client=firefox&q=
Source: file.exe, 00000000.00000003.1863399988.0000000000ED0000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2589952496.000000000573F000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2590072407.0000000005728000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2713287494.00000000058EB000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2713694037.00000000058E9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/policies/privacy/
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2819165160.0000017CD9477000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2818486632.0000017CD943C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/geolocation/v1/geolocate?key=%GOOGLE_LOCATION_SERVICE_API_KEY%
Source: firefox.exe, 00000020.00000002.2910130082.0000017CD679E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2962100177.0000360BFBE04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2900114787.0000017CC988F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2896531875.0000001889D3C000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/about/legal/terms/subscription-services/
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/releasenotes/?utm_source=firefox-browser&utm_medi
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/tour/
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/geolocation/
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/new?reason=manual-update
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/notes
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/set-as-default/thanks/
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/xr/
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/privacy/subscription-services/
Source: file.exe, 00000000.00000002.2107422140.0000000001117000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: f039f524ee.exe, 00000011.00000003.2776079766.00000000059C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: file.exe, 00000000.00000002.2107422140.0000000001117000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/t.exe
Source: file.exe, 00000000.00000002.2107422140.0000000001117000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: f039f524ee.exe, 00000011.00000003.2776079766.00000000059C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: file.exe, 00000000.00000002.2107422140.0000000001117000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: file.exe, 00000000.00000003.1990378087.000000000C0AA000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2648581024.0000000005834000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2776079766.00000000059C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: f039f524ee.exe, 00000011.00000003.2776079766.00000000059C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/android/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/ios/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campa
Source: firefox.exe, 00000020.00000002.2933675468.0000017CD9F17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/new/
Source: firefox.exe, 00000020.00000002.2933675468.0000017CD9F17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/new/resource:///modules/UrlbarPrefs.sys.mjsdelete-browsing-search-do
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#crash-reporter
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#health-report
Source: file.exe, 00000000.00000002.2107422140.0000000001117000.00000040.00000001.01000000.00000003.sdmp, firefox.exe, 00000020.00000002.2904680065.0000017CD4F5F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: firefox.exe, 00000020.00000002.2914904234.0000017CD7978000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD6703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/#suggest-relevant-content
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: file.exe, 00000000.00000003.1990378087.000000000C0AA000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2648581024.0000000005834000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2776079766.00000000059C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: file.exe, 00000000.00000002.2107422140.0000000001117000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/host.exe
Source: firefox.exe, 00000020.00000002.2896531875.0000001889D3C000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.orgo
Source: firefox.exe, 00000020.00000002.2918847879.0000017CD9176000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2894411295.0000001882C3B000.00000004.00000010.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2949018481.0000017CDC0E4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2951694809.0000017CDCB78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5AAF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2908457770.0000017CD5A03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2906223989.0000017CD50B5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.openh264.org/
Source: firefox.exe, 00000020.00000002.2914904234.0000017CD7978000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD6757000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD6703000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD677D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.reddit.com/
Source: firefox.exe, 00000020.00000002.2949018481.0000017CDC0E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.tsn.ca
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.widevine.com/
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.widevine.com/cleanupTemporaryAddons/existing
Source: firefox.exe, 00000020.00000002.2910130082.0000017CD6703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/
Source: firefox.exe, 00000020.00000002.2908012090.0000017CD5912000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2908012090.0000017CD592C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://xhr.spec.whatwg.org/#sync-warning
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5AE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com
Source: firefox.exe, 00000020.00000002.2943062764.0000017CDB3A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/
Source: firefox.exe, 00000020.00000002.2933675468.0000017CD9F17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5AE0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2899835765.0000017CC9630000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd#PlacesToolbarItems
Source: firefox.exe, 0000001E.00000002.2771235389.0000022DFE241000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2797673549.0000029CCDEEF000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2899622099.0000017CC9529000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd--no-default-browser
Source: 18d00389b3.exe, 00000012.00000003.2823899502.00000000017C2000.00000004.00000020.00020000.00000000.sdmp, 18d00389b3.exe, 00000012.00000002.2848331214.00000000017C6000.00000004.00000020.00020000.00000000.sdmp, 18d00389b3.exe, 00000012.00000003.2820838942.00000000017C1000.00000004.00000020.00020000.00000000.sdmp, 18d00389b3.exe, 00000012.00000003.2820621960.00000000017BC000.00000004.00000020.00020000.00000000.sdmp, 18d00389b3.exe, 00000012.00000003.2831596841.00000000017C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdBx
Source: firefox.exe, 00000020.00000002.2902487228.0000017CCB47F000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2902487228.0000017CCB43A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdMOZ_CRASHREPORTER_RE
Source: firefox.exe, 00000020.00000002.2900114787.0000017CC9803000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdg
Source: firefox.exe, 00000020.00000002.2900114787.0000017CC9811000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdhttps://crash-report
Source: firefox.exe, 00000020.00000002.2900114787.0000017CC985D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdx
Source: firefox.exe, 00000020.00000002.2933675468.0000017CD9F17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/accountgWindowsWithUnloadHandlerensureUnloadHandlerRegisteredstrippedUrlToTopPre
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5AE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.comFirefoxViewNotificationManager
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5AE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.comLOAD_FLAGS_FORCE_ALLOW_COOKIES
Source: firefox.exe, 00000020.00000002.2961359117.00000F1AEFE00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.comZ

System Summary

Binary is likely a compiled AutoIt script file

Source: 18d00389b3.exe, 00000012.00000000.2682081483.00000000008E2000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.		memstr_2b9b1b8b-e
Source: 18d00389b3.exe, 00000012.00000000.2682081483.00000000008E2000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer		memstr_8d194914-e

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: BAKFCBFHJD.exe.0.dr	Static PE information: section name:
Source: BAKFCBFHJD.exe.0.dr	Static PE information: section name: .idata
Source: skotes.exe.9.dr	Static PE information: section name:
Source: skotes.exe.9.dr	Static PE information: section name: .idata
Source: random[1].exe.12.dr	Static PE information: section name:
Source: random[1].exe.12.dr	Static PE information: section name: .idata
Source: random[1].exe.12.dr	Static PE information: section name:
Source: a17088d8c7.exe.12.dr	Static PE information: section name:
Source: a17088d8c7.exe.12.dr	Static PE information: section name: .idata
Source: a17088d8c7.exe.12.dr	Static PE information: section name:
Source: random[1].exe0.12.dr	Static PE information: section name:
Source: random[1].exe0.12.dr	Static PE information: section name: .idata
Source: random[1].exe0.12.dr	Static PE information: section name:
Source: f039f524ee.exe.12.dr	Static PE information: section name:
Source: f039f524ee.exe.12.dr	Static PE information: section name: .idata
Source: f039f524ee.exe.12.dr	Static PE information: section name:
Source: random[1].exe1.12.dr	Static PE information: section name:
Source: random[1].exe1.12.dr	Static PE information: section name: .idata
Source: random[1].exe1.12.dr	Static PE information: section name:
Source: f377015f96.exe.12.dr	Static PE information: section name:
Source: f377015f96.exe.12.dr	Static PE information: section name: .idata
Source: f377015f96.exe.12.dr	Static PE information: section name:
Source: random[2].exe0.12.dr	Static PE information: section name:
Source: random[2].exe0.12.dr	Static PE information: section name: .idata
Source: 9f6ad733e2.exe.12.dr	Static PE information: section name:
Source: 9f6ad733e2.exe.12.dr	Static PE information: section name: .idata

Abnormal high CPU Usage

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Process Stats: CPU usage > 49%

Contains functionality to call native functions

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C47ED10 malloc,NtFlushVirtualMemory,memset,memset,memset,memset,memset,memcpy,free,memset,memset,memcpy,memset,memset,memset,memset,memset,	0_2_6C47ED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4BB700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C4BB700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4BB8C0 rand_s,NtQueryVirtualMemory,	0_2_6C4BB8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4BB910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6C4BB910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C45F280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C45F280
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6862C0 PR_dtoa,PR_GetCurrentThread,strlen,NtFlushVirtualMemory,PR_GetCurrentThread,memcpy,memcpy,	0_2_6C6862C0

Creates files inside the system directory

Source: C:\Users\user\Documents\BAKFCBFHJD.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Detected potential crypto function

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4535A0	0_2_6C4535A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C465440	0_2_6C465440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4C545C	0_2_6C4C545C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4CAC00	0_2_6C4CAC00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C495C10	0_2_6C495C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4A2C10	0_2_6C4A2C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4C542B	0_2_6C4C542B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4664C0	0_2_6C4664C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C47D4D0	0_2_6C47D4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C45D4E0	0_2_6C45D4E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C496CF0	0_2_6C496CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C466C80	0_2_6C466C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4B34A0	0_2_6C4B34A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4BC4A0	0_2_6C4BC4A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C46FD00	0_2_6C46FD00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C47ED10	0_2_6C47ED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C480512	0_2_6C480512
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C490DD0	0_2_6C490DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4B85F0	0_2_6C4B85F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4A2E4E	0_2_6C4A2E4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C474640	0_2_6C474640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C479E50	0_2_6C479E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C493E50	0_2_6C493E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4C6E63	0_2_6C4C6E63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C45C670	0_2_6C45C670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4A5600	0_2_6C4A5600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C497E10	0_2_6C497E10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4B9E30	0_2_6C4B9E30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4C76E3	0_2_6C4C76E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C45BEF0	0_2_6C45BEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C46FEF0	0_2_6C46FEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4BE680	0_2_6C4BE680
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C475E90	0_2_6C475E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4B4EA0	0_2_6C4B4EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C469F00	0_2_6C469F00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C497710	0_2_6C497710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C45DFE0	0_2_6C45DFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C486FF0	0_2_6C486FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4A77A0	0_2_6C4A77A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C478850	0_2_6C478850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C47D850	0_2_6C47D850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C49F070	0_2_6C49F070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C467810	0_2_6C467810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C49B820	0_2_6C49B820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4A4820	0_2_6C4A4820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4C50C7	0_2_6C4C50C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C47C0E0	0_2_6C47C0E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4958E0	0_2_6C4958E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4860A0	0_2_6C4860A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C47A940	0_2_6C47A940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C46D960	0_2_6C46D960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4AB970	0_2_6C4AB970
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4CB170	0_2_6C4CB170
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C495190	0_2_6C495190
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4B2990	0_2_6C4B2990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C45C9A0	0_2_6C45C9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C48D9B0	0_2_6C48D9B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C499A60	0_2_6C499A60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C498AC0	0_2_6C498AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C471AF0	0_2_6C471AF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C49E2F0	0_2_6C49E2F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4CBA90	0_2_6C4CBA90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4522A0	0_2_6C4522A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C484AA0	0_2_6C484AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C46CAB0	0_2_6C46CAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4C2AB0	0_2_6C4C2AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C455340	0_2_6C455340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C46C370	0_2_6C46C370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C49D320	0_2_6C49D320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4C53C8	0_2_6C4C53C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C45F380	0_2_6C45F380
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C50AC60	0_2_6C50AC60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5C6C00	0_2_6C5C6C00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5DAC30	0_2_6C5DAC30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C55ECD0	0_2_6C55ECD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4FECC0	0_2_6C4FECC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5CED70	0_2_6C5CED70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C62AD50	0_2_6C62AD50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C688D20	0_2_6C688D20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68CDC0	0_2_6C68CDC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C596D90	0_2_6C596D90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C504DB0	0_2_6C504DB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C59EE70	0_2_6C59EE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E0E20	0_2_6C5E0E20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C50AEC0	0_2_6C50AEC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5A0EC0	0_2_6C5A0EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C586E90	0_2_6C586E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C56EF40	0_2_6C56EF40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5C2F70	0_2_6C5C2F70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C506F10	0_2_6C506F10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C640F20	0_2_6C640F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5DEFF0	0_2_6C5DEFF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C500FE0	0_2_6C500FE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C648FB0	0_2_6C648FB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C50EFB0	0_2_6C50EFB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D4840	0_2_6C5D4840
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C550820	0_2_6C550820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C58A820	0_2_6C58A820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6068E0	0_2_6C6068E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C538960	0_2_6C538960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C556900	0_2_6C556900
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C61C9E0	0_2_6C61C9E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5349F0	0_2_6C5349F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5C09B0	0_2_6C5C09B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5909A0	0_2_6C5909A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5BA9A0	0_2_6C5BA9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C57CA70	0_2_6C57CA70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5AEA00	0_2_6C5AEA00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5B8A30	0_2_6C5B8A30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C57EA80	0_2_6C57EA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C606BE0	0_2_6C606BE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5A0BA0	0_2_6C5A0BA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C518460	0_2_6C518460
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C58A430	0_2_6C58A430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C564420	0_2_6C564420
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5464D0	0_2_6C5464D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C59A4D0	0_2_6C59A4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C62A480	0_2_6C62A480
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C558540	0_2_6C558540
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C604540	0_2_6C604540
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5A0570	0_2_6C5A0570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C648550	0_2_6C648550
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C562560	0_2_6C562560
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C58E5F0	0_2_6C58E5F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5CA5E0	0_2_6C5CA5E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4F45B0	0_2_6C4F45B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C55C650	0_2_6C55C650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5246D0	0_2_6C5246D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C55E6E0	0_2_6C55E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C59E6E0	0_2_6C59E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C580700	0_2_6C580700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C52A7D0	0_2_6C52A7D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C54E070	0_2_6C54E070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5C8010	0_2_6C5C8010
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5CC000	0_2_6C5CC000
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4F8090	0_2_6C4F8090
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5100B0	0_2_6C5100B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5DC0B0	0_2_6C5DC0B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C568140	0_2_6C568140
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C576130	0_2_6C576130
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E4130	0_2_6C5E4130
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5001E0	0_2_6C5001E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C598250	0_2_6C598250
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C588260	0_2_6C588260
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5CA210	0_2_6C5CA210
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D8220	0_2_6C5D8220
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6862C0	0_2_6C6862C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5CE2B0	0_2_6C5CE2B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D22A0	0_2_6C5D22A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C61C360	0_2_6C61C360
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C508340	0_2_6C508340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C642370	0_2_6C642370
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Code function: 9_2_004C7049	9_2_004C7049
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Code function: 9_2_004C8860	9_2_004C8860
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Code function: 9_2_004C78BB	9_2_004C78BB
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Code function: 9_2_00598101	9_2_00598101
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Code function: 9_2_004C31A8	9_2_004C31A8
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Code function: 9_2_00484B30	9_2_00484B30
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Code function: 9_2_004C2D10	9_2_004C2D10
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Code function: 9_2_00484DE0	9_2_00484DE0
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Code function: 9_2_004B7F36	9_2_004B7F36
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Code function: 9_2_004C779B	9_2_004C779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 10_2_00F878BB	10_2_00F878BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 10_2_00F88860	10_2_00F88860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 10_2_00F87049	10_2_00F87049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 10_2_00F831A8	10_2_00F831A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 10_2_00F44B30	10_2_00F44B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 10_2_00F44DE0	10_2_00F44DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 10_2_00F82D10	10_2_00F82D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 10_2_00F8779B	10_2_00F8779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 10_2_00F77F36	10_2_00F77F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 11_2_00F878BB	11_2_00F878BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 11_2_00F88860	11_2_00F88860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 11_2_00F87049	11_2_00F87049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 11_2_00F831A8	11_2_00F831A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 11_2_00F44B30	11_2_00F44B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 11_2_00F44DE0	11_2_00F44DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 11_2_00F82D10	11_2_00F82D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 11_2_00F8779B	11_2_00F8779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 11_2_00F77F36	11_2_00F77F36

Dropped file seen in connection with other malware

Source: Joe Sandbox View

Dropped File: C:\ProgramData\freebl3.dll EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA

Found potential string decryption / allocating functions

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C523620 appears 52 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C6809D0 appears 203 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C529B10 appears 46 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C4994D0 appears 90 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C48CBE8 appears 134 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C68D930 appears 38 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C68DAE0 appears 47 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00F580C0 appears 260 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00F5DF80 appears 36 times
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Code function: String function: 004980C0 appears 130 times

PE file contains executable resources (Code or Archives)

Source: random[1].exe.12.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: a17088d8c7.exe.12.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Sample file is different than original file name gathered from version info

Source: file.exe, 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2116507763.000000006C6D5000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2112319814.000000000BD1A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs file.exe

Uses 32bit PE files

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: ipnqzgkg ZLIB complexity 0.9949173823395884
Source: random[1].exe0.12.dr	Static PE information: Section: ZLIB complexity 0.997627865484429
Source: random[1].exe0.12.dr	Static PE information: Section: xyjapqsh ZLIB complexity 0.9942076156859846
Source: f039f524ee.exe.12.dr	Static PE information: Section: ZLIB complexity 0.997627865484429
Source: f039f524ee.exe.12.dr	Static PE information: Section: xyjapqsh ZLIB complexity 0.9942076156859846
Source: random[1].exe1.12.dr	Static PE information: Section: ipnqzgkg ZLIB complexity 0.9949173823395884
Source: f377015f96.exe.12.dr	Static PE information: Section: ipnqzgkg ZLIB complexity 0.9949173823395884

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@135/49@0/23

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C4B7030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6C4B7030

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\EQMKVR6S.htm

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5664:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3752:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4428:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7724:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3964:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3588:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:980:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5472:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4556:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3192:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3848:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7624:64:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5904:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8148:120:WilError_03

Source: C:\Users\user\Documents\BAKFCBFHJD.exe

File created: C:\Users\user\AppData\Local\Temp\abc3bc1985

Jump to behavior

Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe, 00000000.00000002.2109410050.0000000005CE9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2115820620.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2116362437.000000006C68F000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: file.exe, 00000000.00000002.2109410050.0000000005CE9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2115820620.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2116362437.000000006C68F000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2109410050.0000000005CE9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2115820620.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2116362437.000000006C68F000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2109410050.0000000005CE9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2115820620.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2116362437.000000006C68F000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: file.exe, file.exe, 00000000.00000002.2109410050.0000000005CE9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2115820620.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2116362437.000000006C68F000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2109410050.0000000005CE9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2115820620.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000000.00000002.2109410050.0000000005CE9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2115820620.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2116362437.000000006C68F000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: file.exe, 00000000.00000003.1863137759.0000000005BD5000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2590687838.0000000005720000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2741888141.00000000058B9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2109410050.0000000005CE9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2115820620.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: file.exe, 00000000.00000002.2109410050.0000000005CE9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2115820620.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);

Source: file.exe

ReversingLabs: Detection: 44%

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2588 --field-trial-handle=2076,i,11101187424602966218,1363370709843346949,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\BAKFCBFHJD.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Documents\BAKFCBFHJD.exe "C:\Users\user\Documents\BAKFCBFHJD.exe"
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe "C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe "C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe "C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe "C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe "C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe"
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe "C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe"
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: unknown	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe "C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe"
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2272 -parentBuildID 20230927232528 -prefsHandle 2196 -prefMapHandle 2176 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0e2b88bc-fb1b-4ee6-b399-2d0b61fdaa7d} 7196 "\\.\pipe\gecko-crash-server-pipe.7196" 17cc9869f10 socket
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe "C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe"
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4500 -parentBuildID 20230927232528 -prefsHandle 4492 -prefMapHandle 4488 -prefsLen 26374 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {91de2f66-b71a-414e-a97d-01546071d5ac} 7196 "\\.\pipe\gecko-crash-server-pipe.7196" 17cc987e310 rdd
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe "C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe"
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe "C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe"
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=f039f524ee.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2448 --field-trial-handle=2280,i,510515106440553161,2480043565169282240,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2320 -parentBuildID 20230927232528 -prefsHandle 2264 -prefMapHandle 2260 -prefsLen 25359 -prefMapSize 238769 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2b17f485-0e86-472e-88cf-afe23e104bea} 280 "\\.\pipe\gecko-crash-server-pipe.280" 234f4b6a910 socket
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=f039f524ee.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2084 --field-trial-handle=1932,i,2083666299261817870,13908559142850350553,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe "C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe"
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=f039f524ee.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1956 --field-trial-handle=1860,i,10040747374664479283,16727769951129841397,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=f039f524ee.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\BAKFCBFHJD.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2588 --field-trial-handle=2076,i,11101187424602966218,1363370709843346949,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Documents\BAKFCBFHJD.exe "C:\Users\user\Documents\BAKFCBFHJD.exe"	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe "C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe "C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe "C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe "C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe "C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=f039f524ee.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=f039f524ee.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=f039f524ee.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=f039f524ee.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2272 -parentBuildID 20230927232528 -prefsHandle 2196 -prefMapHandle 2176 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0e2b88bc-fb1b-4ee6-b399-2d0b61fdaa7d} 7196 "\\.\pipe\gecko-crash-server-pipe.7196" 17cc9869f10 socket
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4500 -parentBuildID 20230927232528 -prefsHandle 4492 -prefMapHandle 4488 -prefsLen 26374 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {91de2f66-b71a-414e-a97d-01546071d5ac} 7196 "\\.\pipe\gecko-crash-server-pipe.7196" 17cc987e310 rdd
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2320 -parentBuildID 20230927232528 -prefsHandle 2264 -prefMapHandle 2260 -prefsLen 25359 -prefMapSize 238769 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2b17f485-0e86-472e-88cf-afe23e104bea} 280 "\\.\pipe\gecko-crash-server-pipe.280" 234f4b6a910 socket
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2448 --field-trial-handle=2280,i,510515106440553161,2480043565169282240,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2084 --field-trial-handle=1932,i,2083666299261817870,13908559142850350553,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1956 --field-trial-handle=1860,i,10040747374664479283,16727769951129841397,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: windows.shell.servicehostbuilder.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: ieframe.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: wkscli.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: mlang.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: policymanager.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: msvcp110_win.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: ieframe.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: wkscli.dll
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: windows.shell.servicehostbuilder.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: ieframe.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: wkscli.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: mlang.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: policymanager.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: msvcp110_win.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: ieframe.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: wkscli.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Program Files\Mozilla Firefox\firefox.exe

File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\compatibility.ini

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1799168 > 1048576

Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: file.exe

Static PE information: Raw size of ipnqzgkg is bigger than: 0x100000 < 0x19d000

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2116362437.000000006C68F000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2116362437.000000006C68F000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: f039f524ee.exe, 00000011.00000003.3081089288.0000000008320000.00000004.00001000.00020000.00000000.sdmp, 9f6ad733e2.exe, 00000021.00000003.2802037515.0000000005190000.00000004.00001000.00020000.00000000.sdmp, 9f6ad733e2.exe, 00000021.00000002.2937994456.0000000000EF2000.00000040.00000001.01000000.00000014.sdmp
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.fb0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ipnqzgkg:EW;equqovlh:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;ipnqzgkg:EW;equqovlh:EW;.taggant:EW;
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Unpacked PE file: 9.2.BAKFCBFHJD.exe.480000.0.unpack :EW;.rsrc:W;.idata :W;nnwaoodm:EW;ocwkoyql:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;nnwaoodm:EW;ocwkoyql:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 10.2.skotes.exe.f40000.0.unpack :EW;.rsrc:W;.idata :W;nnwaoodm:EW;ocwkoyql:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;nnwaoodm:EW;ocwkoyql:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 11.2.skotes.exe.f40000.0.unpack :EW;.rsrc:W;.idata :W;nnwaoodm:EW;ocwkoyql:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;nnwaoodm:EW;ocwkoyql:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Unpacked PE file: 16.2.f377015f96.exe.db0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ipnqzgkg:EW;equqovlh:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;ipnqzgkg:EW;equqovlh:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Unpacked PE file: 25.2.f377015f96.exe.db0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ipnqzgkg:EW;equqovlh:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;ipnqzgkg:EW;equqovlh:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Unpacked PE file: 33.2.9f6ad733e2.exe.ef0000.0.unpack :EW;.rsrc:W;.idata :W;cdtvwakf:EW;qjmihuav:EW;.taggant:EW; vs :ER;.rsrc:W;
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Unpacked PE file: 49.2.f377015f96.exe.db0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ipnqzgkg:EW;equqovlh:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;ipnqzgkg:EW;equqovlh:EW;.taggant:EW;

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C4BC410 LoadLibraryW,GetProcAddress,FreeLibrary,

0_2_6C4BC410

Entry point lies outside standard sections

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

PE file contains an invalid checksum

Source: random[1].exe.12.dr	Static PE information: real checksum: 0x1eebf3 should be: 0x1f2626
Source: a17088d8c7.exe.12.dr	Static PE information: real checksum: 0x1eebf3 should be: 0x1f2626
Source: random[1].exe.0.dr	Static PE information: real checksum: 0x31c073 should be: 0x31a034
Source: 9f6ad733e2.exe.12.dr	Static PE information: real checksum: 0x2cb988 should be: 0x2ccccb
Source: BAKFCBFHJD.exe.0.dr	Static PE information: real checksum: 0x31c073 should be: 0x31a034
Source: f377015f96.exe.12.dr	Static PE information: real checksum: 0x1bd78b should be: 0x1bf97a
Source: f039f524ee.exe.12.dr	Static PE information: real checksum: 0x1de5a6 should be: 0x1de476
Source: random[2].exe0.12.dr	Static PE information: real checksum: 0x2cb988 should be: 0x2ccccb
Source: random[1].exe0.12.dr	Static PE information: real checksum: 0x1de5a6 should be: 0x1de476
Source: random[1].exe1.12.dr	Static PE information: real checksum: 0x1bd78b should be: 0x1bf97a
Source: file.exe	Static PE information: real checksum: 0x1bd78b should be: 0x1bf97a
Source: skotes.exe.9.dr	Static PE information: real checksum: 0x31c073 should be: 0x31a034

PE file contains sections with non-standard names

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: ipnqzgkg
Source: file.exe	Static PE information: section name: equqovlh
Source: file.exe	Static PE information: section name: .taggant
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name: nnwaoodm
Source: random[1].exe.0.dr	Static PE information: section name: ocwkoyql
Source: random[1].exe.0.dr	Static PE information: section name: .taggant
Source: BAKFCBFHJD.exe.0.dr	Static PE information: section name:
Source: BAKFCBFHJD.exe.0.dr	Static PE information: section name: .idata
Source: BAKFCBFHJD.exe.0.dr	Static PE information: section name: nnwaoodm
Source: BAKFCBFHJD.exe.0.dr	Static PE information: section name: ocwkoyql
Source: BAKFCBFHJD.exe.0.dr	Static PE information: section name: .taggant
Source: skotes.exe.9.dr	Static PE information: section name:
Source: skotes.exe.9.dr	Static PE information: section name: .idata
Source: skotes.exe.9.dr	Static PE information: section name: nnwaoodm
Source: skotes.exe.9.dr	Static PE information: section name: ocwkoyql
Source: skotes.exe.9.dr	Static PE information: section name: .taggant
Source: random[1].exe.12.dr	Static PE information: section name:
Source: random[1].exe.12.dr	Static PE information: section name: .idata
Source: random[1].exe.12.dr	Static PE information: section name:
Source: random[1].exe.12.dr	Static PE information: section name: mkxflzam
Source: random[1].exe.12.dr	Static PE information: section name: ntycqcrd
Source: random[1].exe.12.dr	Static PE information: section name: .taggant
Source: a17088d8c7.exe.12.dr	Static PE information: section name:
Source: a17088d8c7.exe.12.dr	Static PE information: section name: .idata
Source: a17088d8c7.exe.12.dr	Static PE information: section name:
Source: a17088d8c7.exe.12.dr	Static PE information: section name: mkxflzam
Source: a17088d8c7.exe.12.dr	Static PE information: section name: ntycqcrd
Source: a17088d8c7.exe.12.dr	Static PE information: section name: .taggant
Source: random[1].exe0.12.dr	Static PE information: section name:
Source: random[1].exe0.12.dr	Static PE information: section name: .idata
Source: random[1].exe0.12.dr	Static PE information: section name:
Source: random[1].exe0.12.dr	Static PE information: section name: xyjapqsh
Source: random[1].exe0.12.dr	Static PE information: section name: fjnsenoe
Source: random[1].exe0.12.dr	Static PE information: section name: .taggant
Source: f039f524ee.exe.12.dr	Static PE information: section name:
Source: f039f524ee.exe.12.dr	Static PE information: section name: .idata
Source: f039f524ee.exe.12.dr	Static PE information: section name:
Source: f039f524ee.exe.12.dr	Static PE information: section name: xyjapqsh
Source: f039f524ee.exe.12.dr	Static PE information: section name: fjnsenoe
Source: f039f524ee.exe.12.dr	Static PE information: section name: .taggant
Source: random[1].exe1.12.dr	Static PE information: section name:
Source: random[1].exe1.12.dr	Static PE information: section name: .idata
Source: random[1].exe1.12.dr	Static PE information: section name:
Source: random[1].exe1.12.dr	Static PE information: section name: ipnqzgkg
Source: random[1].exe1.12.dr	Static PE information: section name: equqovlh
Source: random[1].exe1.12.dr	Static PE information: section name: .taggant
Source: f377015f96.exe.12.dr	Static PE information: section name:
Source: f377015f96.exe.12.dr	Static PE information: section name: .idata
Source: f377015f96.exe.12.dr	Static PE information: section name:
Source: f377015f96.exe.12.dr	Static PE information: section name: ipnqzgkg
Source: f377015f96.exe.12.dr	Static PE information: section name: equqovlh
Source: f377015f96.exe.12.dr	Static PE information: section name: .taggant
Source: random[2].exe0.12.dr	Static PE information: section name:
Source: random[2].exe0.12.dr	Static PE information: section name: .idata
Source: random[2].exe0.12.dr	Static PE information: section name: cdtvwakf
Source: random[2].exe0.12.dr	Static PE information: section name: qjmihuav
Source: random[2].exe0.12.dr	Static PE information: section name: .taggant
Source: 9f6ad733e2.exe.12.dr	Static PE information: section name:
Source: 9f6ad733e2.exe.12.dr	Static PE information: section name: .idata
Source: 9f6ad733e2.exe.12.dr	Static PE information: section name: cdtvwakf
Source: 9f6ad733e2.exe.12.dr	Static PE information: section name: qjmihuav
Source: 9f6ad733e2.exe.12.dr	Static PE information: section name: .taggant

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C48B536 push ecx; ret	0_2_6C48B549
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Code function: 9_2_0049D91C push ecx; ret	9_2_0049D92F
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Code function: 9_2_00491359 push es; ret	9_2_0049135A
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 10_2_00F5D91C push ecx; ret	10_2_00F5D92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 11_2_00F5D91C push ecx; ret	11_2_00F5D92F

Source: file.exe	Static PE information: section name: ipnqzgkg entropy: 7.954190185075461
Source: random[1].exe.0.dr	Static PE information: section name: entropy: 7.067745136702224
Source: BAKFCBFHJD.exe.0.dr	Static PE information: section name: entropy: 7.067745136702224
Source: skotes.exe.9.dr	Static PE information: section name: entropy: 7.067745136702224
Source: random[1].exe.12.dr	Static PE information: section name: mkxflzam entropy: 7.941774290386521
Source: a17088d8c7.exe.12.dr	Static PE information: section name: mkxflzam entropy: 7.941774290386521
Source: random[1].exe0.12.dr	Static PE information: section name: entropy: 7.97823310420282
Source: random[1].exe0.12.dr	Static PE information: section name: xyjapqsh entropy: 7.953197683807969
Source: f039f524ee.exe.12.dr	Static PE information: section name: entropy: 7.97823310420282
Source: f039f524ee.exe.12.dr	Static PE information: section name: xyjapqsh entropy: 7.953197683807969
Source: random[1].exe1.12.dr	Static PE information: section name: ipnqzgkg entropy: 7.954190185075461
Source: f377015f96.exe.12.dr	Static PE information: section name: ipnqzgkg entropy: 7.954190185075461
Source: random[2].exe0.12.dr	Static PE information: section name: entropy: 7.79776762494654
Source: 9f6ad733e2.exe.12.dr	Static PE information: section name: entropy: 7.79776762494654

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\Documents\BAKFCBFHJD.exe

Jump to dropped file

Drops PE files

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[2].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Jump to dropped file
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\Documents\BAKFCBFHJD.exe	Jump to dropped file

Drops PE files to the application program directory (C:\ProgramData)

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Creates multiple autostart registry keys

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 18d00389b3.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run f039f524ee.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run f377015f96.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 9f6ad733e2.exe	Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Creates job files (autostart)

Source: C:\Users\user\Documents\BAKFCBFHJD.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run f039f524ee.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run f039f524ee.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run f377015f96.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run f377015f96.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 18d00389b3.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 18d00389b3.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 9f6ad733e2.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 9f6ad733e2.exe	Jump to behavior

Extensive use of GetProcAddress (often used to hide API calls)

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C4B55F0 LoadLibraryW,LoadLibraryW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_6C4B55F0

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	System information queried: FirmwareTableInformation
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	System information queried: FirmwareTableInformation
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	System information queried: FirmwareTableInformation
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	System information queried: FirmwareTableInformation

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1383678 second address: 138367C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138367C second address: 1383684 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1383684 second address: 138369A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F06B90E9DDCh 0x00000009 jne 00007F06B90E9DD6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138369A second address: 13836DE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F06B852D3C8h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edi 0x0000000c jg 00007F06B852D3B6h 0x00000012 pop edi 0x00000013 pop edx 0x00000014 pop eax 0x00000015 push eax 0x00000016 push edx 0x00000017 jns 00007F06B852D3BCh 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007F06B852D3BCh 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13836DE second address: 13836F8 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F06B90E9DD6h 0x00000008 jmp 00007F06B90E9DE0h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13836F8 second address: 13836FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138383D second address: 138384D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jl 00007F06B90E9DDEh 0x0000000c push eax 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1383B59 second address: 1383B5F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1383B5F second address: 1383B6D instructions: 0x00000000 rdtsc 0x00000002 jne 00007F06B90E9DD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1385F46 second address: 1385F4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1385F4A second address: 1385F60 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F06B90E9DD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e ja 00007F06B90E9DD8h 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1385F60 second address: 1385F65 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1385F65 second address: 1385F7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b push eax 0x0000000c push edx 0x0000000d jo 00007F06B90E9DD8h 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1385F7A second address: 1385F9A instructions: 0x00000000 rdtsc 0x00000002 jns 00007F06B852D3C0h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [eax] 0x0000000c push eax 0x0000000d push edx 0x0000000e js 00007F06B852D3BCh 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1385F9A second address: 1385F9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1385F9E second address: 1385FA4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1386028 second address: 1386073 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c jmp 00007F06B90E9DE0h 0x00000011 mov eax, dword ptr [eax] 0x00000013 push edi 0x00000014 jnl 00007F06B90E9DD8h 0x0000001a pop edi 0x0000001b mov dword ptr [esp+04h], eax 0x0000001f jnp 00007F06B90E9E04h 0x00000025 push eax 0x00000026 push edx 0x00000027 jmp 00007F06B90E9DE7h 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1386073 second address: 1386104 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B852D3C1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a mov esi, dword ptr [ebp+122D3A6Fh] 0x00000010 jmp 00007F06B852D3C8h 0x00000015 push 00000003h 0x00000017 push 00000000h 0x00000019 push esi 0x0000001a call 00007F06B852D3B8h 0x0000001f pop esi 0x00000020 mov dword ptr [esp+04h], esi 0x00000024 add dword ptr [esp+04h], 0000001Bh 0x0000002c inc esi 0x0000002d push esi 0x0000002e ret 0x0000002f pop esi 0x00000030 ret 0x00000031 push 00000000h 0x00000033 mov dword ptr [ebp+122D21ABh], ebx 0x00000039 push 00000003h 0x0000003b xor esi, dword ptr [ebp+122D39B3h] 0x00000041 or edx, 3201D4B3h 0x00000047 push 85D03809h 0x0000004c push eax 0x0000004d push edx 0x0000004e push ecx 0x0000004f jmp 00007F06B852D3C9h 0x00000054 pop ecx 0x00000055 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1386104 second address: 1386143 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F06B90E9DDCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xor dword ptr [esp], 45D03809h 0x00000011 jl 00007F06B90E9DD7h 0x00000017 lea ebx, dword ptr [ebp+12459E99h] 0x0000001d jng 00007F06B90E9DDCh 0x00000023 push eax 0x00000024 jns 00007F06B90E9DE2h 0x0000002a jnp 00007F06B90E9DDCh 0x00000030 push eax 0x00000031 push edx 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138619D second address: 13861A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13861A1 second address: 13861AB instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F06B90E9DD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13861AB second address: 1386256 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F06B852D3CFh 0x00000008 jmp 00007F06B852D3C9h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f nop 0x00000010 jnl 00007F06B852D3CEh 0x00000016 push 00000000h 0x00000018 xor ecx, dword ptr [ebp+122D2580h] 0x0000001e push 5C6D8844h 0x00000023 jng 00007F06B852D3BCh 0x00000029 pushad 0x0000002a push edx 0x0000002b pop edx 0x0000002c push eax 0x0000002d pop eax 0x0000002e popad 0x0000002f xor dword ptr [esp], 5C6D88C4h 0x00000036 mov edx, 57C5A234h 0x0000003b push 00000003h 0x0000003d jmp 00007F06B852D3BBh 0x00000042 push 00000000h 0x00000044 push eax 0x00000045 mov esi, ebx 0x00000047 pop esi 0x00000048 call 00007F06B852D3C2h 0x0000004d mov si, E982h 0x00000051 pop esi 0x00000052 push 00000003h 0x00000054 or esi, 3EF67F8Ah 0x0000005a call 00007F06B852D3B9h 0x0000005f pushad 0x00000060 push eax 0x00000061 push edx 0x00000062 jns 00007F06B852D3B6h 0x00000068 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1386256 second address: 1386276 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F06B90E9DDEh 0x0000000b popad 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push ecx 0x00000010 jo 00007F06B90E9DD6h 0x00000016 pop ecx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1386276 second address: 138631F instructions: 0x00000000 rdtsc 0x00000002 jno 00007F06B852D3CAh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e jmp 00007F06B852D3C8h 0x00000013 mov eax, dword ptr [eax] 0x00000015 push edx 0x00000016 jmp 00007F06B852D3BBh 0x0000001b pop edx 0x0000001c mov dword ptr [esp+04h], eax 0x00000020 jmp 00007F06B852D3C8h 0x00000025 pop eax 0x00000026 adc edx, 140D7800h 0x0000002c lea ebx, dword ptr [ebp+12459EA2h] 0x00000032 push 00000000h 0x00000034 push esi 0x00000035 call 00007F06B852D3B8h 0x0000003a pop esi 0x0000003b mov dword ptr [esp+04h], esi 0x0000003f add dword ptr [esp+04h], 00000019h 0x00000047 inc esi 0x00000048 push esi 0x00000049 ret 0x0000004a pop esi 0x0000004b ret 0x0000004c and cx, A046h 0x00000051 xchg eax, ebx 0x00000052 push eax 0x00000053 push edx 0x00000054 pushad 0x00000055 jbe 00007F06B852D3B6h 0x0000005b jbe 00007F06B852D3B6h 0x00000061 popad 0x00000062 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1397C0E second address: 1397C2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 jmp 00007F06B90E9DE5h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1397C2B second address: 1397C45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F06B852D3C0h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137284F second address: 1372855 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A44C1 second address: 13A44D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F06B852D3B6h 0x0000000a jc 00007F06B852D3B6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A44D1 second address: 13A450F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F06B90E9DE1h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jp 00007F06B90E9DDCh 0x00000011 pop edx 0x00000012 pop eax 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 push esi 0x00000017 pop esi 0x00000018 push ebx 0x00000019 pop ebx 0x0000001a jmp 00007F06B90E9DE1h 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A4659 second address: 13A465F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A4A78 second address: 13A4A88 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push edi 0x00000004 pop edi 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 pop ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a jnp 00007F06B90E9DD6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A4D03 second address: 13A4D0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F06B852D3B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A4D0D second address: 13A4D34 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 js 00007F06B90E9DEFh 0x0000000e jmp 00007F06B90E9DE9h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A5149 second address: 13A5167 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F06B852D3C7h 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A5167 second address: 13A5182 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B90E9DE1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A5182 second address: 13A5190 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnp 00007F06B852D3B6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A5190 second address: 13A5194 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A5194 second address: 13A51A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F06B852D3B6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1374288 second address: 13742A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007F06B90E9DE3h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13742A5 second address: 13742A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A559E second address: 13A55AA instructions: 0x00000000 rdtsc 0x00000002 jc 00007F06B90E9DD6h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A5C97 second address: 13A5C9D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A5C9D second address: 13A5CA4 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A5E20 second address: 13A5E36 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B852D3BFh 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A5F99 second address: 13A5FB0 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F06B90E9DD6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f jne 00007F06B90E9DD6h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A63DA second address: 13A63DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13AACD1 second address: 13AACD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13AACD5 second address: 13AACFB instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jc 00007F06B852D3B6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edi 0x0000000d jmp 00007F06B852D3C2h 0x00000012 pop edi 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13AACFB second address: 13AACFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13AACFF second address: 13AAD03 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13AAD03 second address: 13AAD15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jg 00007F06B90E9DD6h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13AAD15 second address: 13AAD19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13AAD19 second address: 13AAD1D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13AAD1D second address: 13AAD23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13AAD23 second address: 13AAD29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13AAD29 second address: 13AAD2F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13AAD2F second address: 13AAD33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137E3CE second address: 137E3D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137E3D2 second address: 137E3DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137E3DC second address: 137E3E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137E3E0 second address: 137E3EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F06B90E9DD6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13AD469 second address: 13AD483 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B852D3BFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13AD483 second address: 13AD489 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13AD489 second address: 13AD48F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B11F5 second address: 13B120F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push esi 0x00000006 push eax 0x00000007 pop eax 0x00000008 pushad 0x00000009 popad 0x0000000a pop esi 0x0000000b pop edi 0x0000000c push eax 0x0000000d push edx 0x0000000e jne 00007F06B90E9DDCh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B065D second address: 13B0671 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push ebx 0x00000006 jmp 00007F06B852D3BCh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B0807 second address: 13B0812 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F06B90E9DD6h 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B0959 second address: 13B095D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B0DD4 second address: 13B0DD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B0DD9 second address: 13B0DDE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B0DDE second address: 13B0DEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F06B90E9DD6h 0x0000000a push edi 0x0000000b pop edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B0DEC second address: 13B0E05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F06B852D3C1h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B0E05 second address: 13B0E0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B395B second address: 13B395F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1375CB4 second address: 1375CBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F06B90E9DD6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B5B67 second address: 13B5B6B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B5D69 second address: 13B5D73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B6214 second address: 13B6248 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 mov dword ptr [esp], ebx 0x00000009 push 00000000h 0x0000000b push ecx 0x0000000c call 00007F06B852D3B8h 0x00000011 pop ecx 0x00000012 mov dword ptr [esp+04h], ecx 0x00000016 add dword ptr [esp+04h], 00000018h 0x0000001e inc ecx 0x0000001f push ecx 0x00000020 ret 0x00000021 pop ecx 0x00000022 ret 0x00000023 nop 0x00000024 push eax 0x00000025 push edx 0x00000026 jc 00007F06B852D3BCh 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B6248 second address: 13B624C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B624C second address: 13B626D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B852D3C8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push ecx 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B6716 second address: 13B671C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B671C second address: 13B6733 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 jo 00007F06B852D3BCh 0x0000000e jc 00007F06B852D3B6h 0x00000014 push esi 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B67D5 second address: 13B67DF instructions: 0x00000000 rdtsc 0x00000002 jp 00007F06B90E9DD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B67DF second address: 13B67E4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B769C second address: 13B771F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B90E9DDBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push ebx 0x0000000e call 00007F06B90E9DD8h 0x00000013 pop ebx 0x00000014 mov dword ptr [esp+04h], ebx 0x00000018 add dword ptr [esp+04h], 0000001Bh 0x00000020 inc ebx 0x00000021 push ebx 0x00000022 ret 0x00000023 pop ebx 0x00000024 ret 0x00000025 jnl 00007F06B90E9DDCh 0x0000002b jbe 00007F06B90E9DD6h 0x00000031 push edx 0x00000032 add dword ptr [ebp+122D29FAh], eax 0x00000038 pop esi 0x00000039 push 00000000h 0x0000003b push 00000000h 0x0000003d push edx 0x0000003e call 00007F06B90E9DD8h 0x00000043 pop edx 0x00000044 mov dword ptr [esp+04h], edx 0x00000048 add dword ptr [esp+04h], 00000016h 0x00000050 inc edx 0x00000051 push edx 0x00000052 ret 0x00000053 pop edx 0x00000054 ret 0x00000055 or esi, 5BD013E9h 0x0000005b push 00000000h 0x0000005d mov dword ptr [ebp+122D2271h], edx 0x00000063 push eax 0x00000064 push eax 0x00000065 push edx 0x00000066 push eax 0x00000067 push edx 0x00000068 push eax 0x00000069 push edx 0x0000006a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B771F second address: 13B7723 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B7723 second address: 13B7729 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BA6CF second address: 13BA6DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F06B852D3BBh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BB0D8 second address: 13BB0DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BB174 second address: 13BB178 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BB178 second address: 13BB1C2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B90E9DE0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jo 00007F06B90E9DD6h 0x00000010 jmp 00007F06B90E9DE3h 0x00000015 popad 0x00000016 popad 0x00000017 push eax 0x00000018 pushad 0x00000019 pushad 0x0000001a jmp 00007F06B90E9DE1h 0x0000001f pushad 0x00000020 popad 0x00000021 popad 0x00000022 pushad 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BBC75 second address: 13BBC87 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B852D3BEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BC77B second address: 13BC782 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BC4B1 second address: 13BC4B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BC4B5 second address: 13BC4BF instructions: 0x00000000 rdtsc 0x00000002 jo 00007F06B90E9DD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BF938 second address: 13BF99A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F06B852D3C7h 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e push eax 0x0000000f mov edi, eax 0x00000011 pop edi 0x00000012 push 00000000h 0x00000014 pushad 0x00000015 push edx 0x00000016 mov dword ptr [ebp+122D33BEh], ecx 0x0000001c pop ecx 0x0000001d sub dword ptr [ebp+122D2AD8h], edx 0x00000023 popad 0x00000024 push 00000000h 0x00000026 mov dword ptr [ebp+122D29D9h], esi 0x0000002c mov di, 2C81h 0x00000030 xchg eax, esi 0x00000031 ja 00007F06B852D3C4h 0x00000037 push eax 0x00000038 jo 00007F06B852D3C4h 0x0000003e push eax 0x0000003f push edx 0x00000040 push ebx 0x00000041 pop ebx 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C597D second address: 13C5981 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C6AE3 second address: 13C6B45 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d jmp 00007F06B852D3BDh 0x00000012 push 00000000h 0x00000014 mov edi, 77A0BB0Eh 0x00000019 push 00000000h 0x0000001b push 00000000h 0x0000001d push ebp 0x0000001e call 00007F06B852D3B8h 0x00000023 pop ebp 0x00000024 mov dword ptr [esp+04h], ebp 0x00000028 add dword ptr [esp+04h], 0000001Bh 0x00000030 inc ebp 0x00000031 push ebp 0x00000032 ret 0x00000033 pop ebp 0x00000034 ret 0x00000035 jp 00007F06B852D3B9h 0x0000003b jnl 00007F06B852D3BCh 0x00000041 push eax 0x00000042 push eax 0x00000043 push edx 0x00000044 push eax 0x00000045 push edx 0x00000046 push eax 0x00000047 pop eax 0x00000048 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C0AE7 second address: 13C0AEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C1AA7 second address: 13C1AAB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C6B45 second address: 13C6B49 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C2B66 second address: 13C2B6A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C0AEB second address: 13C0B10 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 pushad 0x00000009 jmp 00007F06B90E9DE9h 0x0000000e push ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C1AAB second address: 13C1AB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a pushad 0x0000000b popad 0x0000000c pop ebx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C6B49 second address: 13C6B4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C2B6A second address: 13C2B70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C0BB1 second address: 13C0BB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C7BBE second address: 13C7BDD instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jo 00007F06B852D3B6h 0x0000000d ja 00007F06B852D3B6h 0x00000013 popad 0x00000014 popad 0x00000015 push eax 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 jl 00007F06B852D3B6h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C7BDD second address: 13C7BF6 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F06B90E9DD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F06B90E9DDDh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C6DBE second address: 13C6DC3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C8B05 second address: 13C8B5D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push edx 0x0000000a call 00007F06B90E9DD8h 0x0000000f pop edx 0x00000010 mov dword ptr [esp+04h], edx 0x00000014 add dword ptr [esp+04h], 00000016h 0x0000001c inc edx 0x0000001d push edx 0x0000001e ret 0x0000001f pop edx 0x00000020 ret 0x00000021 jmp 00007F06B90E9DDFh 0x00000026 push 00000000h 0x00000028 movzx ebx, si 0x0000002b add ebx, 5BD01066h 0x00000031 push 00000000h 0x00000033 sbb ebx, 30780C84h 0x00000039 push eax 0x0000003a push eax 0x0000003b push edx 0x0000003c pushad 0x0000003d ja 00007F06B90E9DD6h 0x00000043 jne 00007F06B90E9DD6h 0x00000049 popad 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C8B5D second address: 13C8B7B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F06B852D3C9h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CAB5C second address: 13CAB62 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CAB62 second address: 13CAB66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CBC78 second address: 13CBD1E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F06B90E9DDCh 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e ja 00007F06B90E9DEFh 0x00000014 push 00000000h 0x00000016 push 00000000h 0x00000018 push edi 0x00000019 call 00007F06B90E9DD8h 0x0000001e pop edi 0x0000001f mov dword ptr [esp+04h], edi 0x00000023 add dword ptr [esp+04h], 0000001Dh 0x0000002b inc edi 0x0000002c push edi 0x0000002d ret 0x0000002e pop edi 0x0000002f ret 0x00000030 mov bx, dx 0x00000033 push 00000000h 0x00000035 push 00000000h 0x00000037 push ebx 0x00000038 call 00007F06B90E9DD8h 0x0000003d pop ebx 0x0000003e mov dword ptr [esp+04h], ebx 0x00000042 add dword ptr [esp+04h], 00000014h 0x0000004a inc ebx 0x0000004b push ebx 0x0000004c ret 0x0000004d pop ebx 0x0000004e ret 0x0000004f mov ebx, dword ptr [ebp+122D180Ah] 0x00000055 xchg eax, esi 0x00000056 push eax 0x00000057 push edx 0x00000058 pushad 0x00000059 jmp 00007F06B90E9DE9h 0x0000005e ja 00007F06B90E9DD6h 0x00000064 popad 0x00000065 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CBD1E second address: 13CBD31 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F06B852D3BFh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CBD31 second address: 13CBD35 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CBD35 second address: 13CBD44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push ebx 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C9DFE second address: 13C9E04 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C9E04 second address: 13C9E0E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F06B852D3B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CCCAF second address: 13CCD25 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B90E9DDBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a mov edi, dword ptr [ebp+122D2203h] 0x00000010 push 00000000h 0x00000012 mov edi, dword ptr [ebp+122D3AABh] 0x00000018 push 00000000h 0x0000001a push 00000000h 0x0000001c push edx 0x0000001d call 00007F06B90E9DD8h 0x00000022 pop edx 0x00000023 mov dword ptr [esp+04h], edx 0x00000027 add dword ptr [esp+04h], 00000015h 0x0000002f inc edx 0x00000030 push edx 0x00000031 ret 0x00000032 pop edx 0x00000033 ret 0x00000034 jg 00007F06B90E9DDCh 0x0000003a xchg eax, esi 0x0000003b pushad 0x0000003c jmp 00007F06B90E9DE0h 0x00000041 push eax 0x00000042 push edx 0x00000043 jmp 00007F06B90E9DE9h 0x00000048 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CF360 second address: 13CF37E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F06B852D3C9h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CF37E second address: 13CF390 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push esi 0x0000000b jc 00007F06B90E9DD6h 0x00000011 pop esi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CF390 second address: 13CF396 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CF396 second address: 13CF39A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D0553 second address: 13D0557 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D9F40 second address: 13D9F46 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D9F46 second address: 13D9F4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D9F4A second address: 13D9F54 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D9F54 second address: 13D9F5A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D9A8E second address: 13D9AA4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F06B90E9DDCh 0x0000000d push edi 0x0000000e pop edi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D9AA4 second address: 13D9ABA instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F06B852D3BAh 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D9ABA second address: 13D9AF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F06B90E9DE3h 0x00000009 pushad 0x0000000a popad 0x0000000b push edx 0x0000000c pop edx 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F06B90E9DE8h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D9AF0 second address: 13D9AFA instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F06B852D3B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D9AFA second address: 13D9B15 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F06B90E9DEDh 0x00000008 jmp 00007F06B90E9DE1h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DCF18 second address: 13DCF22 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F06B852D3B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DCF22 second address: 13DCF40 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B90E9DE3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d pushad 0x0000000e popad 0x0000000f pop ecx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DCF40 second address: 13DCF45 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DCF45 second address: 13DCF58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DCF58 second address: 13DCF5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DCF5C second address: 13DCF78 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B90E9DE8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DCF78 second address: 13DCF8B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F06B852D3BFh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DCF8B second address: 13DCF9E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a jns 00007F06B90E9DDEh 0x00000010 push edi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DCF9E second address: 13DCFB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 mov dword ptr [esp+04h], eax 0x00000009 pushad 0x0000000a jmp 00007F06B852D3BDh 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DCFB8 second address: 13DCFBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DD07F second address: 13DD083 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DD083 second address: 13DD092 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E3BF0 second address: 13E3BFA instructions: 0x00000000 rdtsc 0x00000002 je 00007F06B852D3BCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136D78E second address: 136D793 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136D793 second address: 136D7B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F06B852D3C3h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 ja 00007F06B852D3B6h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E28AC second address: 13E28B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E28B0 second address: 13E28C1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B852D3BDh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E28C1 second address: 13E28D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jns 00007F06B90E9DD6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E28D1 second address: 13E28D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E28D5 second address: 13E28EC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B90E9DE3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E3029 second address: 13E3033 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E3033 second address: 13E303A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E303A second address: 13E3060 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007F06B852D3BEh 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F06B852D3BCh 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E3060 second address: 13E306E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 ja 00007F06B90E9DDCh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E306E second address: 13E3072 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E3072 second address: 13E3077 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E31C5 second address: 13E31D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 ja 00007F06B852D3BCh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E31D4 second address: 13E31DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E31DE second address: 13E31E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E31E2 second address: 13E31E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E3330 second address: 13E3334 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E3334 second address: 13E333A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E34BF second address: 13E34C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E34C3 second address: 13E34F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F06B90E9DE8h 0x0000000b pop esi 0x0000000c push edi 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F06B90E9DDFh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E9160 second address: 13E9166 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E7F7A second address: 13E7F91 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F06B90E9DE2h 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E80E2 second address: 13E80E7 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E80E7 second address: 13E8111 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F06B90E9DD6h 0x0000000a pop ebx 0x0000000b pushad 0x0000000c jmp 00007F06B90E9DDFh 0x00000011 jmp 00007F06B90E9DDDh 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E83A3 second address: 13E83D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 jmp 00007F06B852D3C6h 0x0000000d jmp 00007F06B852D3C0h 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E83D6 second address: 13E83DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E8513 second address: 13E852F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F06B852D3C1h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d pop esi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E852F second address: 13E8533 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E8533 second address: 13E8550 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 jp 00007F06B852D3C1h 0x0000000e push eax 0x0000000f push edx 0x00000010 push edi 0x00000011 pop edi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E79FC second address: 13E7A17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 pushad 0x00000008 jc 00007F06B90E9DD6h 0x0000000e jp 00007F06B90E9DD6h 0x00000014 jnl 00007F06B90E9DD6h 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E7A17 second address: 13E7A36 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 jmp 00007F06B852D3C9h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E7A36 second address: 13E7A3A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E8863 second address: 13E886B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E886B second address: 13E8870 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E8870 second address: 13E888C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F06B852D3C2h 0x00000009 jg 00007F06B852D3B6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E888C second address: 13E8890 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E89FB second address: 13E8A03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E8B90 second address: 13E8BA7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B90E9DE1h 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E8BA7 second address: 13E8BAB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E8E81 second address: 13E8EA1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B90E9DE8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13EA70F second address: 13EA714 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13EA714 second address: 13EA71C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F27A4 second address: 13F27D9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jp 00007F06B852D3B6h 0x00000009 jmp 00007F06B852D3C7h 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 pushad 0x00000012 jmp 00007F06B852D3BDh 0x00000017 pushad 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B4138 second address: 13B4180 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push esi 0x00000006 pop esi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b jmp 00007F06B90E9DE6h 0x00000010 lea eax, dword ptr [ebp+12487E7Ch] 0x00000016 push esi 0x00000017 xor dword ptr [ebp+122D29F4h], esi 0x0000001d pop ecx 0x0000001e push eax 0x0000001f pushad 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007F06B90E9DE5h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B4180 second address: 139BBE0 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 push eax 0x0000000a pop eax 0x0000000b popad 0x0000000c popad 0x0000000d mov dword ptr [esp], eax 0x00000010 sub dl, 00000000h 0x00000013 call dword ptr [ebp+122D212Eh] 0x00000019 jmp 00007F06B852D3C5h 0x0000001e push edi 0x0000001f pushad 0x00000020 pushad 0x00000021 popad 0x00000022 jmp 00007F06B852D3C4h 0x00000027 popad 0x00000028 push eax 0x00000029 push edx 0x0000002a jmp 00007F06B852D3C8h 0x0000002f jg 00007F06B852D3B6h 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B435D second address: 13B4391 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B90E9DE9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F06B90E9DE3h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B4391 second address: 13B439B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F06B852D3B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B4736 second address: 13B4771 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 ja 00007F06B90E9DDEh 0x0000000d jng 00007F06B90E9DD8h 0x00000013 pushad 0x00000014 popad 0x00000015 mov eax, dword ptr [esp+04h] 0x00000019 jmp 00007F06B90E9DE6h 0x0000001e mov eax, dword ptr [eax] 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 jnc 00007F06B90E9DD6h 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B4771 second address: 13B477B instructions: 0x00000000 rdtsc 0x00000002 jns 00007F06B852D3B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B477B second address: 13B47A2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B90E9DE5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d js 00007F06B90E9DE4h 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B47A2 second address: 13B47A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B4893 second address: 13B4899 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B4978 second address: 13B498F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B852D3C3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B4BCF second address: 13B4BD3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B526D second address: 13B5315 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F06B852D3B8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c pushad 0x0000000d jg 00007F06B852D3B6h 0x00000013 jg 00007F06B852D3B6h 0x00000019 popad 0x0000001a pop eax 0x0000001b nop 0x0000001c push 00000000h 0x0000001e push ebp 0x0000001f call 00007F06B852D3B8h 0x00000024 pop ebp 0x00000025 mov dword ptr [esp+04h], ebp 0x00000029 add dword ptr [esp+04h], 00000018h 0x00000031 inc ebp 0x00000032 push ebp 0x00000033 ret 0x00000034 pop ebp 0x00000035 ret 0x00000036 sub edx, dword ptr [ebp+122D389Fh] 0x0000003c jmp 00007F06B852D3BBh 0x00000041 lea eax, dword ptr [ebp+12487EC0h] 0x00000047 push 00000000h 0x00000049 push ebp 0x0000004a call 00007F06B852D3B8h 0x0000004f pop ebp 0x00000050 mov dword ptr [esp+04h], ebp 0x00000054 add dword ptr [esp+04h], 0000001Dh 0x0000005c inc ebp 0x0000005d push ebp 0x0000005e ret 0x0000005f pop ebp 0x00000060 ret 0x00000061 or dword ptr [ebp+122D2B00h], edx 0x00000067 nop 0x00000068 jno 00007F06B852D3C2h 0x0000006e push eax 0x0000006f push eax 0x00000070 pushad 0x00000071 jmp 00007F06B852D3C0h 0x00000076 push eax 0x00000077 push edx 0x00000078 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B5315 second address: 139C5D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 nop 0x00000007 mov edi, 213E84B9h 0x0000000c lea eax, dword ptr [ebp+12487E7Ch] 0x00000012 clc 0x00000013 push eax 0x00000014 jmp 00007F06B90E9DE2h 0x00000019 mov dword ptr [esp], eax 0x0000001c and edi, dword ptr [ebp+122D2B15h] 0x00000022 call dword ptr [ebp+122D2507h] 0x00000028 jo 00007F06B90E9DEEh 0x0000002e push eax 0x0000002f push edx 0x00000030 push eax 0x00000031 push edx 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 139C5D9 second address: 139C5E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F06B852D3B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 139C5E3 second address: 139C5E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1370D3E second address: 1370D42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1370D42 second address: 1370D59 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B90E9DE3h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1370D59 second address: 1370D8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 jg 00007F06B852D3B6h 0x0000000d pop ecx 0x0000000e jnp 00007F06B852D3DBh 0x00000014 pushad 0x00000015 jmp 00007F06B852D3BAh 0x0000001a jmp 00007F06B852D3C1h 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F1C88 second address: 13F1C8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F1C8C second address: 13F1CBB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F06B852D3BFh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jng 00007F06B852D3BEh 0x00000011 jc 00007F06B852D3B6h 0x00000017 push ecx 0x00000018 pop ecx 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F06B852D3BAh 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F206E second address: 13F2072 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F2072 second address: 13F2078 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F21EB second address: 13F21F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 pop eax 0x00000008 push edi 0x00000009 pop edi 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F21F6 second address: 13F2212 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F06B852D3C1h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d push ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F7F6A second address: 13F7F6E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F7F6E second address: 13F7F77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F6BE0 second address: 13F6BF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F06B90E9DDFh 0x00000009 pop edx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F6F16 second address: 13F6F2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F06B852D3C2h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F6F2C second address: 13F6F4D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B90E9DDBh 0x00000007 jmp 00007F06B90E9DE2h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F70D0 second address: 13F70E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jng 00007F06B852D3BCh 0x0000000b jnl 00007F06B852D3B6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F725F second address: 13F7288 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pushad 0x0000000a jmp 00007F06B90E9DDEh 0x0000000f jp 00007F06B90E9DD6h 0x00000015 push edx 0x00000016 pop edx 0x00000017 popad 0x00000018 pop esi 0x00000019 push eax 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d pop eax 0x0000001e push edi 0x0000001f pop edi 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F7288 second address: 13F72A4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B852D3C8h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F72A4 second address: 13F72B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnp 00007F06B90E9DE2h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F72B2 second address: 13F72B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F753C second address: 13F7546 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F06B90E9DD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F768B second address: 13F7691 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F7691 second address: 13F76AB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B90E9DE0h 0x00000007 jnp 00007F06B90E9DD6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F782C second address: 13F7834 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F7834 second address: 13F7838 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F7838 second address: 13F783C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FAF1F second address: 13FAF53 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007F06B90E9DE6h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F06B90E9DE8h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FDF98 second address: 13FDFA8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007F06B852D3B6h 0x0000000a jl 00007F06B852D3B6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1400DA1 second address: 1400DA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1400DA5 second address: 1400DA9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14005DF second address: 14005F3 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F06B90E9DD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b push ecx 0x0000000c js 00007F06B90E9DDEh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140075D second address: 1400777 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B852D3BDh 0x00000007 jnc 00007F06B852D3B6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1400777 second address: 140077F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140077F second address: 1400788 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1400788 second address: 1400797 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B90E9DDBh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1400797 second address: 14007A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14007A1 second address: 14007A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1408AEB second address: 1408AF8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 jns 00007F06B852D3B6h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140749C second address: 14074A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14078DB second address: 14078F9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B852D3BCh 0x00000007 jmp 00007F06B852D3BBh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14078F9 second address: 1407917 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F06B90E9DE8h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1407917 second address: 140794D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F06B852D3C6h 0x0000000a popad 0x0000000b pushad 0x0000000c push ebx 0x0000000d pushad 0x0000000e popad 0x0000000f pop ebx 0x00000010 jmp 00007F06B852D3BFh 0x00000015 push eax 0x00000016 push edx 0x00000017 push ebx 0x00000018 pop ebx 0x00000019 push edx 0x0000001a pop edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B4E0F second address: 13B4E30 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 jmp 00007F06B90E9DE3h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push esi 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B4E30 second address: 13B4E34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B4E34 second address: 13B4E38 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1407D1B second address: 1407D22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1407D22 second address: 1407D55 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 pushad 0x00000006 popad 0x00000007 jmp 00007F06B90E9DDCh 0x0000000c push edx 0x0000000d pop edx 0x0000000e popad 0x0000000f js 00007F06B90E9DD8h 0x00000015 push esi 0x00000016 pop esi 0x00000017 pop edx 0x00000018 pop eax 0x00000019 push edi 0x0000001a jmp 00007F06B90E9DDAh 0x0000001f push eax 0x00000020 push edx 0x00000021 jnl 00007F06B90E9DD6h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137C820 second address: 137C826 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137C826 second address: 137C84E instructions: 0x00000000 rdtsc 0x00000002 js 00007F06B90E9DD6h 0x00000008 jp 00007F06B90E9DD6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F06B90E9DE4h 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137C84E second address: 137C87B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F06B852D3C0h 0x0000000d push eax 0x0000000e push edx 0x0000000f jbe 00007F06B852D3B6h 0x00000015 jmp 00007F06B852D3BDh 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140CF40 second address: 140CF44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140CF44 second address: 140CF48 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140CF48 second address: 140CF4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140C9C6 second address: 140C9CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140C9CC second address: 140C9D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140FFC6 second address: 140FFE5 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jmp 00007F06B852D3BFh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b js 00007F06B852D3BEh 0x00000011 push edi 0x00000012 pop edi 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14100F9 second address: 1410104 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1410104 second address: 1410108 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1410108 second address: 1410117 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B90E9DDBh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1410117 second address: 1410136 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 jp 00007F06B852D3D8h 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F06B852D3BEh 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1410702 second address: 1410708 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14108A4 second address: 14108AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14108AA second address: 14108B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14108B0 second address: 14108B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1417822 second address: 1417847 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B90E9DE5h 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f jnc 00007F06B90E9DD6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1417847 second address: 141786A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B852D3C6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edi 0x0000000b pop edi 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e pop eax 0x0000000f push ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141786A second address: 1417885 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 popad 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F06B90E9DDEh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1417885 second address: 1417889 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1417889 second address: 1417892 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1417892 second address: 1417898 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1419394 second address: 141939A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141939A second address: 14193A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14193A0 second address: 14193C2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B90E9DDAh 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F06B90E9DE2h 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14193C2 second address: 14193C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141DD6D second address: 141DD72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1420B4F second address: 1420B55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1420B55 second address: 1420B95 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B90E9DDCh 0x00000007 jmp 00007F06B90E9DE8h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F06B90E9DE0h 0x00000015 jl 00007F06B90E9DD6h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1420CF1 second address: 1420CF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1420CF5 second address: 1420D69 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B90E9DDDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007F06B90E9DEAh 0x0000000f jmp 00007F06B90E9DE7h 0x00000014 pushad 0x00000015 pushad 0x00000016 popad 0x00000017 jmp 00007F06B90E9DDDh 0x0000001c popad 0x0000001d popad 0x0000001e push eax 0x0000001f push edx 0x00000020 ja 00007F06B90E9DDAh 0x00000026 pushad 0x00000027 popad 0x00000028 push edx 0x00000029 pop edx 0x0000002a jmp 00007F06B90E9DE4h 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1420ECA second address: 1420ED6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F06B852D3C2h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1420ED6 second address: 1420EFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F06B90E9DD6h 0x0000000a pop eax 0x0000000b push eax 0x0000000c jnp 00007F06B90E9DE5h 0x00000012 jmp 00007F06B90E9DDFh 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1420EFA second address: 1420F00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1421076 second address: 1421093 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F06B90E9DDBh 0x00000009 jmp 00007F06B90E9DDEh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1421093 second address: 1421099 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14215E9 second address: 14215ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14215ED second address: 14215F3 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14215F3 second address: 142160B instructions: 0x00000000 rdtsc 0x00000002 jns 00007F06B90E9DE2h 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142160B second address: 1421611 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142175E second address: 1421764 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1421764 second address: 1421769 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1429291 second address: 142929B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F06B90E9DD6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14293C4 second address: 14293F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnc 00007F06B852D3BCh 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F06B852D3C7h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14293F0 second address: 14293F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14293F4 second address: 14293F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14293F8 second address: 1429408 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F06B90E9DD6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142971D second address: 1429758 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F06B852D3C3h 0x00000009 popad 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jno 00007F06B852D3C8h 0x00000013 push eax 0x00000014 push edx 0x00000015 je 00007F06B852D3B6h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1429758 second address: 142975E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14298CC second address: 14298E6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 jmp 00007F06B852D3C1h 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1429A49 second address: 1429A4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142A134 second address: 142A14C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 jmp 00007F06B852D3C1h 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143011C second address: 1430120 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1430120 second address: 1430148 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jp 00007F06B852D3B6h 0x0000000f jmp 00007F06B852D3C6h 0x00000014 pushad 0x00000015 popad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1430148 second address: 1430181 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F06B90E9DE2h 0x00000008 pushad 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push ebx 0x00000015 jmp 00007F06B90E9DE1h 0x0000001a jnc 00007F06B90E9DD6h 0x00000020 pop ebx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14302E2 second address: 14302E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14302E9 second address: 1430311 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F06B90E9DE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jo 00007F06B90E9DD8h 0x00000012 push edi 0x00000013 pop edi 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 pop eax 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1430311 second address: 1430319 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1430319 second address: 1430333 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F06B90E9DE6h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1430333 second address: 1430337 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143DEFF second address: 143DF09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop ebx 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1443492 second address: 14434B4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push edx 0x00000006 pop edx 0x00000007 pushad 0x00000008 popad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jno 00007F06B852D3BCh 0x00000014 jo 00007F06B852D3B8h 0x0000001a push eax 0x0000001b pop eax 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14434B4 second address: 14434D2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B90E9DE2h 0x00000007 push eax 0x00000008 push edx 0x00000009 jnl 00007F06B90E9DD6h 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1449429 second address: 1449436 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jo 00007F06B852D3B6h 0x00000009 pop edi 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1449436 second address: 1449454 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F06B90E9DDAh 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jnp 00007F06B90E9DD8h 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1449454 second address: 144945A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144945A second address: 1449461 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1449461 second address: 144946D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jbe 00007F06B852D3B6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1459B69 second address: 1459B80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 jmp 00007F06B90E9DDEh 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1459DA9 second address: 1459DAD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1459F2F second address: 1459F35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 145ADF3 second address: 145AE0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F06B852D3C6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1466788 second address: 146678E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 146678E second address: 1466793 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1466793 second address: 14667AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F06B90E9DE8h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14667AF second address: 14667B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1368836 second address: 1368842 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jns 00007F06B90E9DD6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1368842 second address: 1368846 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 147FBB8 second address: 147FBC4 instructions: 0x00000000 rdtsc 0x00000002 js 00007F06B90E9DD6h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14943E5 second address: 14943FC instructions: 0x00000000 rdtsc 0x00000002 jp 00007F06B852D3B6h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f je 00007F06B852D3B6h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1494CAB second address: 1494CB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1494CB1 second address: 1494CCA instructions: 0x00000000 rdtsc 0x00000002 ja 00007F06B852D3B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F06B852D3BFh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1494CCA second address: 1494CD0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1494CD0 second address: 1494CD6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1498FE1 second address: 1498FE7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14994AB second address: 14994AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 149C7B7 second address: 149C7BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop eax 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137AE38 second address: 137AE3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0283 second address: 53B0287 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0287 second address: 53B0299 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B852D3BEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B02FA second address: 53B02FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B02FE second address: 53B0304 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B8043 second address: 13B804D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B820D second address: 13B8211 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B83F6 second address: 13B8400 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B8400 second address: 13B8404 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B03F9 second address: 53B0431 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F06B90E9DE5h 0x00000008 pop ecx 0x00000009 push ebx 0x0000000a pop esi 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e xchg eax, ebp 0x0000000f jmp 00007F06B90E9DE3h 0x00000014 mov ebp, esp 0x00000016 pushad 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B04B9 second address: 53B04BF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B04BF second address: 53B051A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edi, ax 0x00000006 mov cx, AF13h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d xor dword ptr [esp], 48BA3DABh 0x00000014 jmp 00007F06B90E9DE6h 0x00000019 call 00007F0728B2D8DFh 0x0000001e push 74DF27D0h 0x00000023 push dword ptr fs:[00000000h] 0x0000002a mov eax, dword ptr [esp+10h] 0x0000002e mov dword ptr [esp+10h], ebp 0x00000032 lea ebp, dword ptr [esp+10h] 0x00000036 sub esp, eax 0x00000038 push ebx 0x00000039 push esi 0x0000003a push edi 0x0000003b mov eax, dword ptr [74E80140h] 0x00000040 xor dword ptr [ebp-04h], eax 0x00000043 xor eax, ebp 0x00000045 push eax 0x00000046 mov dword ptr [ebp-18h], esp 0x00000049 push dword ptr [ebp-08h] 0x0000004c mov eax, dword ptr [ebp-04h] 0x0000004f mov dword ptr [ebp-04h], FFFFFFFEh 0x00000056 mov dword ptr [ebp-08h], eax 0x00000059 lea eax, dword ptr [ebp-10h] 0x0000005c mov dword ptr fs:[00000000h], eax 0x00000062 ret 0x00000063 jmp 00007F06B90E9DE0h 0x00000068 and dword ptr [ebp-04h], 00000000h 0x0000006c jmp 00007F06B90E9DE0h 0x00000071 mov edx, dword ptr [ebp+0Ch] 0x00000074 push eax 0x00000075 push edx 0x00000076 pushad 0x00000077 push eax 0x00000078 push edx 0x00000079 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B051A second address: 53B0521 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov esi, edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0521 second address: 53B0530 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F06B90E9DDBh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0530 second address: 53B0579 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov esi, edx 0x0000000a jmp 00007F06B852D3C5h 0x0000000f mov al, byte ptr [edx] 0x00000011 jmp 00007F06B852D3BEh 0x00000016 inc edx 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F06B852D3C7h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0579 second address: 53B057E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B057E second address: 53B0584 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0584 second address: 53B0579 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 test al, al 0x00000009 jmp 00007F06B90E9DE1h 0x0000000e jne 00007F06B90E9D81h 0x00000014 mov al, byte ptr [edx] 0x00000016 jmp 00007F06B90E9DDEh 0x0000001b inc edx 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007F06B90E9DE7h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B065B second address: 53B0661 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0661 second address: 53B0665 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0665 second address: 53B0669 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0669 second address: 53B06EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov al, byte ptr [edi+01h] 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007F06B90E9DE4h 0x00000012 or eax, 1FFF8888h 0x00000018 jmp 00007F06B90E9DDBh 0x0000001d popfd 0x0000001e push eax 0x0000001f pushfd 0x00000020 jmp 00007F06B90E9DDFh 0x00000025 sub ch, FFFFFFCEh 0x00000028 jmp 00007F06B90E9DE9h 0x0000002d popfd 0x0000002e pop esi 0x0000002f popad 0x00000030 inc edi 0x00000031 pushad 0x00000032 push edx 0x00000033 mov ch, C1h 0x00000035 pop edx 0x00000036 mov esi, 416BF7E1h 0x0000003b popad 0x0000003c test al, al 0x0000003e push eax 0x0000003f push edx 0x00000040 jmp 00007F06B90E9DE3h 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B06EF second address: 53B06F5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B06F5 second address: 53B078B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jne 00007F0728B22158h 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007F06B90E9DDDh 0x00000015 add cx, 9116h 0x0000001a jmp 00007F06B90E9DE1h 0x0000001f popfd 0x00000020 popad 0x00000021 mov ecx, edx 0x00000023 jmp 00007F06B90E9DDAh 0x00000028 shr ecx, 02h 0x0000002b jmp 00007F06B90E9DE0h 0x00000030 rep movsd 0x00000032 rep movsd 0x00000034 rep movsd 0x00000036 rep movsd 0x00000038 rep movsd 0x0000003a jmp 00007F06B90E9DE0h 0x0000003f mov ecx, edx 0x00000041 pushad 0x00000042 jmp 00007F06B90E9DDEh 0x00000047 movzx ecx, bx 0x0000004a popad 0x0000004b and ecx, 03h 0x0000004e push eax 0x0000004f push edx 0x00000050 pushad 0x00000051 push eax 0x00000052 pop ebx 0x00000053 jmp 00007F06B90E9DE2h 0x00000058 popad 0x00000059 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B078B second address: 53B0790 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0790 second address: 53B07D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov cx, di 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rep movsb 0x0000000c pushad 0x0000000d mov eax, edi 0x0000000f pushfd 0x00000010 jmp 00007F06B90E9DDBh 0x00000015 sub eax, 6F31026Eh 0x0000001b jmp 00007F06B90E9DE9h 0x00000020 popfd 0x00000021 popad 0x00000022 mov dword ptr [ebp-04h], FFFFFFFEh 0x00000029 push eax 0x0000002a push edx 0x0000002b push eax 0x0000002c push edx 0x0000002d pushad 0x0000002e popad 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B07D9 second address: 53B07DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B07DD second address: 53B07E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B07E3 second address: 53B0800 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B852D3C2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, ebx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e push ecx 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0800 second address: 53B0804 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0804 second address: 53B084D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushfd 0x00000007 jmp 00007F06B852D3C6h 0x0000000c add ax, 5B78h 0x00000011 jmp 00007F06B852D3BBh 0x00000016 popfd 0x00000017 popad 0x00000018 mov ecx, dword ptr [ebp-10h] 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007F06B852D3C5h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B084D second address: 53B08C1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B90E9DE1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr fs:[00000000h], ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 pushfd 0x00000014 jmp 00007F06B90E9DE3h 0x00000019 sbb esi, 743D654Eh 0x0000001f jmp 00007F06B90E9DE9h 0x00000024 popfd 0x00000025 pushfd 0x00000026 jmp 00007F06B90E9DE0h 0x0000002b add cl, FFFFFFC8h 0x0000002e jmp 00007F06B90E9DDBh 0x00000033 popfd 0x00000034 popad 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B08C1 second address: 53B094F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F06B852D3BFh 0x00000009 xor si, 100Eh 0x0000000e jmp 00007F06B852D3C9h 0x00000013 popfd 0x00000014 jmp 00007F06B852D3C0h 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c pop ecx 0x0000001d pushad 0x0000001e pushad 0x0000001f mov cx, 63A3h 0x00000023 pushfd 0x00000024 jmp 00007F06B852D3C8h 0x00000029 and cx, 90E8h 0x0000002e jmp 00007F06B852D3BBh 0x00000033 popfd 0x00000034 popad 0x00000035 movzx ecx, bx 0x00000038 popad 0x00000039 pop edi 0x0000003a jmp 00007F06B852D3BBh 0x0000003f pop esi 0x00000040 push eax 0x00000041 push edx 0x00000042 push eax 0x00000043 push edx 0x00000044 pushad 0x00000045 popad 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B094F second address: 53B096A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B90E9DE7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B096A second address: 53B099A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cx, bx 0x00000006 pushfd 0x00000007 jmp 00007F06B852D3BBh 0x0000000c jmp 00007F06B852D3C3h 0x00000011 popfd 0x00000012 popad 0x00000013 pop edx 0x00000014 pop eax 0x00000015 pop ebx 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B099A second address: 53B099E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B099E second address: 53B09B9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B852D3C7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B09B9 second address: 53B04B9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B90E9DE9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 leave 0x0000000a pushad 0x0000000b mov ax, AEF3h 0x0000000f mov esi, 4312474Fh 0x00000014 popad 0x00000015 retn 0008h 0x00000018 cmp dword ptr [ebp-2Ch], 10h 0x0000001c mov eax, dword ptr [ebp-40h] 0x0000001f jnc 00007F06B90E9DD5h 0x00000021 push eax 0x00000022 lea edx, dword ptr [ebp-00000590h] 0x00000028 push edx 0x00000029 call esi 0x0000002b push 00000008h 0x0000002d jmp 00007F06B90E9DE6h 0x00000032 push 3C5C2183h 0x00000037 push eax 0x00000038 push edx 0x00000039 push eax 0x0000003a push edx 0x0000003b pushad 0x0000003c popad 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0ACE second address: 53B0B0C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B852D3C9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F06B852D3BEh 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F06B852D3BDh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0B0C second address: 53B0B12 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0B12 second address: 53B0B32 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B852D3BCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b mov di, ax 0x0000000e mov edx, esi 0x00000010 popad 0x00000011 mov ebp, esp 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0B32 second address: 53B0B36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0B36 second address: 53B0B3A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0B3A second address: 53B0B40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 4EF8C1 second address: 4EF8C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 4EF8C6 second address: 4EF8CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 658A44 second address: 658A6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 push eax 0x00000007 pop eax 0x00000008 jmp 00007F06B852D3C9h 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 pop eax 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 6696DF second address: 669701 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F06B90E9DD6h 0x0000000a pop ebx 0x0000000b pop esi 0x0000000c push esi 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F06B90E9DE1h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 669701 second address: 669705 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 66997B second address: 669981 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 669981 second address: 669985 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 669985 second address: 6699A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F06B90E9DDDh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop eax 0x0000000c push eax 0x0000000d jne 00007F06B90E9DE9h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 669AE3 second address: 669AE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 669AE9 second address: 669AEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 669D54 second address: 669D5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 669D5F second address: 669D65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 669D65 second address: 669D69 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 669E95 second address: 669ED8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F06B90E9DE9h 0x00000009 popad 0x0000000a pushad 0x0000000b push esi 0x0000000c pushad 0x0000000d popad 0x0000000e pop esi 0x0000000f jng 00007F06B90E9DDAh 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F06B90E9DE4h 0x0000001c rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 669ED8 second address: 669EF5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B852D3C9h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 66CF8D second address: 66CF92 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 66CF92 second address: 66CFAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [eax] 0x00000009 jmp 00007F06B852D3BBh 0x0000000e mov dword ptr [esp+04h], eax 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 push esi 0x00000016 pop esi 0x00000017 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 66CFAF second address: 66CFBC instructions: 0x00000000 rdtsc 0x00000002 je 00007F06B90E9DD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 66CFF7 second address: 66CFFB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 66D174 second address: 66D198 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B90E9DE3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F06B90E9DDBh 0x00000010 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 66D198 second address: 66D209 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 add dword ptr [esp], 6603B300h 0x0000000e mov edx, dword ptr [ebp+122D1CE1h] 0x00000014 jmp 00007F06B852D3BFh 0x00000019 push 00000003h 0x0000001b mov ecx, dword ptr [ebp+122D3DDCh] 0x00000021 push 00000000h 0x00000023 and edx, 72EB46EEh 0x00000029 push 00000003h 0x0000002b jmp 00007F06B852D3C7h 0x00000030 push 6887205Fh 0x00000035 js 00007F06B852D3DEh 0x0000003b push eax 0x0000003c push edx 0x0000003d jmp 00007F06B852D3C8h 0x00000042 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 66D209 second address: 66D27C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B90E9DDAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 add dword ptr [esp], 5778DFA1h 0x00000010 push ebx 0x00000011 mov ecx, dword ptr [ebp+122D3E44h] 0x00000017 pop edi 0x00000018 push eax 0x00000019 mov edx, dword ptr [ebp+122D3DACh] 0x0000001f pop ecx 0x00000020 lea ebx, dword ptr [ebp+12451E5Fh] 0x00000026 jmp 00007F06B90E9DE2h 0x0000002b mov esi, dword ptr [ebp+122D39CCh] 0x00000031 xchg eax, ebx 0x00000032 jmp 00007F06B90E9DE9h 0x00000037 push eax 0x00000038 push eax 0x00000039 push edx 0x0000003a pushad 0x0000003b js 00007F06B90E9DD6h 0x00000041 jmp 00007F06B90E9DDBh 0x00000046 popad 0x00000047 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 66D27C second address: 66D286 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F06B852D3BCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 66D35F second address: 66D3BC instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push ebx 0x0000000b call 00007F06B90E9DD8h 0x00000010 pop ebx 0x00000011 mov dword ptr [esp+04h], ebx 0x00000015 add dword ptr [esp+04h], 00000015h 0x0000001d inc ebx 0x0000001e push ebx 0x0000001f ret 0x00000020 pop ebx 0x00000021 ret 0x00000022 sub dword ptr [ebp+122D1CDCh], ecx 0x00000028 push 00000000h 0x0000002a push 00000000h 0x0000002c push ebx 0x0000002d call 00007F06B90E9DD8h 0x00000032 pop ebx 0x00000033 mov dword ptr [esp+04h], ebx 0x00000037 add dword ptr [esp+04h], 00000017h 0x0000003f inc ebx 0x00000040 push ebx 0x00000041 ret 0x00000042 pop ebx 0x00000043 ret 0x00000044 xor dword ptr [ebp+122D263Dh], eax 0x0000004a push 5D5FCE2Fh 0x0000004f push eax 0x00000050 push edx 0x00000051 push eax 0x00000052 push edx 0x00000053 push eax 0x00000054 push edx 0x00000055 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 66D3BC second address: 66D3C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 66D3C0 second address: 66D3C6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 68D3D3 second address: 68D419 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B852D3C4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F06B852D3C7h 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 jc 00007F06B852D3B8h 0x00000017 js 00007F06B852D3BCh 0x0000001d je 00007F06B852D3B6h 0x00000023 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 68B304 second address: 68B32C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F06B90E9DDFh 0x00000009 popad 0x0000000a push ecx 0x0000000b jmp 00007F06B90E9DDCh 0x00000010 jbe 00007F06B90E9DD6h 0x00000016 pop ecx 0x00000017 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 68B479 second address: 68B47E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 68B47E second address: 68B48C instructions: 0x00000000 rdtsc 0x00000002 jne 00007F06B90E9DD8h 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 68BD51 second address: 68BD6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F06B852D3B6h 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F06B852D3C1h 0x00000012 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 68BD6F second address: 68BD75 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 68BD75 second address: 68BD7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 68BD7B second address: 68BD80 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 68BD80 second address: 68BD86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 68BD86 second address: 68BD99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F06B90E9DDAh 0x0000000e rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 68C193 second address: 68C19D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 655457 second address: 655467 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F06B90E9DDAh 0x00000008 push edx 0x00000009 pop edx 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push edi 0x0000000f pop edi 0x00000010 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 68CA41 second address: 68CA47 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 68CA47 second address: 68CA60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F06B90E9DE5h 0x00000009 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 68CA60 second address: 68CA64 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 68CA64 second address: 68CA78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 68CA78 second address: 68CA7C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 68CA7C second address: 68CA84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 68CA84 second address: 68CAA8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B852D3C4h 0x00000007 pushad 0x00000008 jmp 00007F06B852D3BBh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 68CAA8 second address: 68CAAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 68CC1B second address: 68CC2E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F06B852D3BEh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 68CF68 second address: 68CF6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 68CF6C second address: 68CF73 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 68D24C second address: 68D250 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 68D250 second address: 68D258 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 68D258 second address: 68D281 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 jmp 00007F06B90E9DDEh 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F06B90E9DE1h 0x00000014 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 68E87F second address: 68E885 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 68E885 second address: 68E889 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 68E889 second address: 68E88D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 68E88D second address: 68E8A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jg 00007F06B90E9DD8h 0x00000011 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 69175E second address: 691762 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 691762 second address: 691766 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 69811A second address: 698124 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F06B852D3B6h 0x0000000a rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 698124 second address: 69812A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 69812A second address: 698130 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 698130 second address: 698137 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 697842 second address: 697857 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F06B852D3C0h 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 6979CA second address: 6979D4 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F06B90E9DD6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 697CAA second address: 697CCB instructions: 0x00000000 rdtsc 0x00000002 jng 00007F06B852D3D3h 0x00000008 jmp 00007F06B852D3C7h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 697F99 second address: 697FB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F06B90E9DE6h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 69ABC6 second address: 69ABD1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnl 00007F06B852D3B6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 69ABD1 second address: 69ABE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 jbe 00007F06B90E9DDCh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 69B0B2 second address: 69B0B9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 69B19C second address: 69B1A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F06B90E9DD6h 0x0000000a rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 69B671 second address: 69B676 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 69C07C second address: 69C080 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 69C080 second address: 69C0A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a mov esi, dword ptr [ebp+122D3F5Ch] 0x00000010 push 00000000h 0x00000012 xor si, E10Bh 0x00000017 push 00000000h 0x00000019 adc di, 30A6h 0x0000001e xchg eax, ebx 0x0000001f push eax 0x00000020 pushad 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 69D9EA second address: 69DA6A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B90E9DE6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push ebx 0x00000010 call 00007F06B90E9DD8h 0x00000015 pop ebx 0x00000016 mov dword ptr [esp+04h], ebx 0x0000001a add dword ptr [esp+04h], 00000016h 0x00000022 inc ebx 0x00000023 push ebx 0x00000024 ret 0x00000025 pop ebx 0x00000026 ret 0x00000027 sub dword ptr [ebp+122D1D02h], edx 0x0000002d push 00000000h 0x0000002f cmc 0x00000030 push 00000000h 0x00000032 push 00000000h 0x00000034 push eax 0x00000035 call 00007F06B90E9DD8h 0x0000003a pop eax 0x0000003b mov dword ptr [esp+04h], eax 0x0000003f add dword ptr [esp+04h], 00000014h 0x00000047 inc eax 0x00000048 push eax 0x00000049 ret 0x0000004a pop eax 0x0000004b ret 0x0000004c mov esi, dword ptr [ebp+122DBC8Bh] 0x00000052 xchg eax, ebx 0x00000053 push eax 0x00000054 push edx 0x00000055 push edx 0x00000056 jmp 00007F06B90E9DE2h 0x0000005b pop edx 0x0000005c rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 69E503 second address: 69E51B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F06B852D3C3h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 69EE52 second address: 69EEDB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F06B90E9DE1h 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov dword ptr [esp], eax 0x00000010 sbb esi, 15047600h 0x00000016 push 00000000h 0x00000018 push 00000000h 0x0000001a push esi 0x0000001b call 00007F06B90E9DD8h 0x00000020 pop esi 0x00000021 mov dword ptr [esp+04h], esi 0x00000025 add dword ptr [esp+04h], 00000018h 0x0000002d inc esi 0x0000002e push esi 0x0000002f ret 0x00000030 pop esi 0x00000031 ret 0x00000032 pushad 0x00000033 mov eax, ebx 0x00000035 pushad 0x00000036 mov dh, bh 0x00000038 or cl, FFFFFFFAh 0x0000003b popad 0x0000003c popad 0x0000003d push 00000000h 0x0000003f push 00000000h 0x00000041 push ebx 0x00000042 call 00007F06B90E9DD8h 0x00000047 pop ebx 0x00000048 mov dword ptr [esp+04h], ebx 0x0000004c add dword ptr [esp+04h], 0000001Ah 0x00000054 inc ebx 0x00000055 push ebx 0x00000056 ret 0x00000057 pop ebx 0x00000058 ret 0x00000059 mov dword ptr [ebp+122D22A9h], ecx 0x0000005f xchg eax, ebx 0x00000060 js 00007F06B90E9DE4h 0x00000066 pushad 0x00000067 je 00007F06B90E9DD6h 0x0000006d push eax 0x0000006e push edx 0x0000006f rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 6A029D second address: 6A02A7 instructions: 0x00000000 rdtsc 0x00000002 js 00007F06B852D3B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 6A0CEB second address: 6A0D16 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F06B90E9DE4h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e js 00007F06B90E9DE8h 0x00000014 push eax 0x00000015 push edx 0x00000016 je 00007F06B90E9DD6h 0x0000001c rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 6A0D16 second address: 6A0D76 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F06B852D3B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b jp 00007F06B852D3BEh 0x00000011 pushad 0x00000012 or dword ptr [ebp+122D1F4Eh], edi 0x00000018 sbb ch, 00000007h 0x0000001b popad 0x0000001c push 00000000h 0x0000001e push 00000000h 0x00000020 push ecx 0x00000021 call 00007F06B852D3B8h 0x00000026 pop ecx 0x00000027 mov dword ptr [esp+04h], ecx 0x0000002b add dword ptr [esp+04h], 00000014h 0x00000033 inc ecx 0x00000034 push ecx 0x00000035 ret 0x00000036 pop ecx 0x00000037 ret 0x00000038 push esi 0x00000039 sbb si, 1841h 0x0000003e pop edi 0x0000003f push 00000000h 0x00000041 mov dword ptr [ebp+1247974Eh], edi 0x00000047 xchg eax, ebx 0x00000048 pushad 0x00000049 pushad 0x0000004a push esi 0x0000004b pop esi 0x0000004c jnc 00007F06B852D3B6h 0x00000052 popad 0x00000053 pushad 0x00000054 push eax 0x00000055 push edx 0x00000056 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 6A4295 second address: 6A4299 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 6A4299 second address: 6A42AD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F06B852D3BBh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 6A42AD second address: 6A42B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 65042F second address: 65043F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B852D3BAh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 65043F second address: 65044F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F06B90E9DD6h 0x0000000a ja 00007F06B90E9DD6h 0x00000010 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 65044F second address: 650453 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 650453 second address: 650472 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jnc 00007F06B90E9DD6h 0x00000010 jmp 00007F06B90E9DDFh 0x00000015 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 650472 second address: 650476 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 6A765D second address: 6A769C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 mov dword ptr [esp], eax 0x0000000a mov bx, F5EDh 0x0000000e push 00000000h 0x00000010 push 00000000h 0x00000012 push edi 0x00000013 call 00007F06B90E9DD8h 0x00000018 pop edi 0x00000019 mov dword ptr [esp+04h], edi 0x0000001d add dword ptr [esp+04h], 0000001Dh 0x00000025 inc edi 0x00000026 push edi 0x00000027 ret 0x00000028 pop edi 0x00000029 ret 0x0000002a push 00000000h 0x0000002c mov bl, 71h 0x0000002e xchg eax, esi 0x0000002f pushad 0x00000030 push eax 0x00000031 push edx 0x00000032 pushad 0x00000033 popad 0x00000034 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 6A8772 second address: 6A8776 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 6A8776 second address: 6A877A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 6A877A second address: 6A87D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push edi 0x0000000b call 00007F06B852D3B8h 0x00000010 pop edi 0x00000011 mov dword ptr [esp+04h], edi 0x00000015 add dword ptr [esp+04h], 00000016h 0x0000001d inc edi 0x0000001e push edi 0x0000001f ret 0x00000020 pop edi 0x00000021 ret 0x00000022 jns 00007F06B852D3B8h 0x00000028 mov ebx, dword ptr [ebp+122D3C58h] 0x0000002e push 00000000h 0x00000030 clc 0x00000031 push 00000000h 0x00000033 mov bh, 5Ch 0x00000035 mov di, ax 0x00000038 xchg eax, esi 0x00000039 jmp 00007F06B852D3BFh 0x0000003e push eax 0x0000003f jo 00007F06B852D3BEh 0x00000045 push ebx 0x00000046 push eax 0x00000047 push edx 0x00000048 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 6A971B second address: 6A971F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 6A971F second address: 6A9729 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F06B852D3B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 6AA75C second address: 6AA7D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 mov dword ptr [esp], eax 0x00000008 push 00000000h 0x0000000a push edx 0x0000000b call 00007F06B90E9DD8h 0x00000010 pop edx 0x00000011 mov dword ptr [esp+04h], edx 0x00000015 add dword ptr [esp+04h], 0000001Ch 0x0000001d inc edx 0x0000001e push edx 0x0000001f ret 0x00000020 pop edx 0x00000021 ret 0x00000022 push 00000000h 0x00000024 push edx 0x00000025 sub ebx, dword ptr [ebp+122D2414h] 0x0000002b pop edi 0x0000002c push 00000000h 0x0000002e push 00000000h 0x00000030 push eax 0x00000031 call 00007F06B90E9DD8h 0x00000036 pop eax 0x00000037 mov dword ptr [esp+04h], eax 0x0000003b add dword ptr [esp+04h], 0000001Ch 0x00000043 inc eax 0x00000044 push eax 0x00000045 ret 0x00000046 pop eax 0x00000047 ret 0x00000048 xchg eax, esi 0x00000049 js 00007F06B90E9DE0h 0x0000004f jmp 00007F06B90E9DDAh 0x00000054 push eax 0x00000055 jc 00007F06B90E9DE2h 0x0000005b jp 00007F06B90E9DDCh 0x00000061 push eax 0x00000062 push edx 0x00000063 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 6AC763 second address: 6AC7EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F06B852D3C0h 0x00000009 popad 0x0000000a pop esi 0x0000000b push eax 0x0000000c js 00007F06B852D3C4h 0x00000012 pushad 0x00000013 jp 00007F06B852D3B6h 0x00000019 jo 00007F06B852D3B6h 0x0000001f popad 0x00000020 nop 0x00000021 push 00000000h 0x00000023 push ecx 0x00000024 call 00007F06B852D3B8h 0x00000029 pop ecx 0x0000002a mov dword ptr [esp+04h], ecx 0x0000002e add dword ptr [esp+04h], 00000017h 0x00000036 inc ecx 0x00000037 push ecx 0x00000038 ret 0x00000039 pop ecx 0x0000003a ret 0x0000003b adc edi, 0EC0C071h 0x00000041 push 00000000h 0x00000043 push 00000000h 0x00000045 push esi 0x00000046 call 00007F06B852D3B8h 0x0000004b pop esi 0x0000004c mov dword ptr [esp+04h], esi 0x00000050 add dword ptr [esp+04h], 00000019h 0x00000058 inc esi 0x00000059 push esi 0x0000005a ret 0x0000005b pop esi 0x0000005c ret 0x0000005d mov ebx, dword ptr [ebp+122D3CE0h] 0x00000063 push 00000000h 0x00000065 mov dword ptr [ebp+122D1F99h], esi 0x0000006b xchg eax, esi 0x0000006c js 00007F06B852D3BEh 0x00000072 push edi 0x00000073 push eax 0x00000074 push edx 0x00000075 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 6AC7EF second address: 6AC7FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 6AC7FB second address: 6AC7FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 6AC7FF second address: 6AC80D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B90E9DDAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 6AD850 second address: 6AD854 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 6AD854 second address: 6AD85A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 6B37FF second address: 6B3867 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F06B852D3C0h 0x0000000b pushad 0x0000000c jmp 00007F06B852D3BEh 0x00000011 jmp 00007F06B852D3C8h 0x00000016 js 00007F06B852D3B6h 0x0000001c pushad 0x0000001d popad 0x0000001e popad 0x0000001f popad 0x00000020 pushad 0x00000021 jmp 00007F06B852D3C8h 0x00000026 push eax 0x00000027 push edx 0x00000028 jl 00007F06B852D3B6h 0x0000002e rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 653984 second address: 65398A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 6B3E2A second address: 6B3E30 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 6B3E30 second address: 6B3E75 instructions: 0x00000000 rdtsc 0x00000002 je 00007F06B90E9DD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f push 00000000h 0x00000011 push edx 0x00000012 call 00007F06B90E9DD8h 0x00000017 pop edx 0x00000018 mov dword ptr [esp+04h], edx 0x0000001c add dword ptr [esp+04h], 00000015h 0x00000024 inc edx 0x00000025 push edx 0x00000026 ret 0x00000027 pop edx 0x00000028 ret 0x00000029 movzx edi, dx 0x0000002c push 00000000h 0x0000002e sub ebx, dword ptr [ebp+122D3C40h] 0x00000034 push 00000000h 0x00000036 mov dword ptr [ebp+122D1E3Dh], esi 0x0000003c push eax 0x0000003d push eax 0x0000003e push edx 0x0000003f pushad 0x00000040 push eax 0x00000041 push edx 0x00000042 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 6B3E75 second address: 6B3E7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 6B3E7C second address: 6B3E91 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F06B90E9DE1h 0x00000009 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 6B4DA3 second address: 6B4DDE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jng 00007F06B852D3B6h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f pushad 0x00000010 jmp 00007F06B852D3C8h 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F06B852D3C1h 0x0000001c rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 6B5E27 second address: 6B5E2D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 6CA1B5 second address: 6CA1CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 jnc 00007F06B852D3B6h 0x0000000c jmp 00007F06B852D3BDh 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 6CA1CF second address: 6CA1D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 6CA1D5 second address: 6CA1DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 6CA1DB second address: 6CA1DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 6CA1DF second address: 6CA1E9 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F06B852D3B6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 6C9506 second address: 6C950C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 6C950C second address: 6C9512 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 11FFC3D instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 11FFB5B instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 14327A4 instructions caused by: Self-modifying code
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Special instruction interceptor: First address: 68F6B5 instructions caused by: Self-modifying code
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Special instruction interceptor: First address: 71C8EF instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 114F6B5 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 11DC8EF instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Special instruction interceptor: First address: 8257BC instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Special instruction interceptor: First address: 8256F8 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Special instruction interceptor: First address: 9CD725 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Special instruction interceptor: First address: 9F6B00 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Special instruction interceptor: First address: 9D73EE instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Special instruction interceptor: First address: A58594 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Special instruction interceptor: First address: 663277 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Special instruction interceptor: First address: 4B608E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Special instruction interceptor: First address: 67442E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Special instruction interceptor: First address: 6F184C instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Special instruction interceptor: First address: FFFC3D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Special instruction interceptor: First address: FFFB5B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Special instruction interceptor: First address: 12327A4 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Special instruction interceptor: First address: EFDE86 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Special instruction interceptor: First address: EFDDE9 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Special instruction interceptor: First address: 10B1E84 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Special instruction interceptor: First address: EFDD93 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Special instruction interceptor: First address: 1150B23 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Special instruction interceptor: First address: F01E23 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Special instruction interceptor: First address: 618DE86 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Special instruction interceptor: First address: 618DDE9 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Special instruction interceptor: First address: 6341E84 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Special instruction interceptor: First address: 618DD93 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Special instruction interceptor: First address: 63E0B23 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Special instruction interceptor: First address: 648DE86 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Special instruction interceptor: First address: 648DDE9 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Special instruction interceptor: First address: 6191E23 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Special instruction interceptor: First address: 6641E84 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Special instruction interceptor: First address: 648DD93 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Special instruction interceptor: First address: 66E0B23 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Special instruction interceptor: First address: 6491E23 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Special instruction interceptor: First address: 5A1DE86 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Special instruction interceptor: First address: 5A1DDE9 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Special instruction interceptor: First address: 5BD1E84 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Special instruction interceptor: First address: 5A1DD93 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Special instruction interceptor: First address: 5C70B23 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Special instruction interceptor: First address: 641DE86 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Special instruction interceptor: First address: 641DDE9 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Special instruction interceptor: First address: 5A21E23 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Special instruction interceptor: First address: 65D1E84 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Special instruction interceptor: First address: 641DD93 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Special instruction interceptor: First address: 6670B23 instructions caused by: Self-modifying code

Allocates memory with a write watch (potentially for evading sandboxes)

Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Memory allocated: 5370000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Memory allocated: 55B0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Memory allocated: 53B0000 memory reserve \| memory write watch

Contains capabilities to detect virtual machines

Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Contains functionality for execution timing, often used to detect debuggers

Source: C:\Users\user\Documents\BAKFCBFHJD.exe

Code function: 9_2_05220D46 rdtsc

9_2_05220D46

Contains long sleeps (>= 3 min)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Thread delayed: delay time: 922337203685477

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 4332	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Window / User API: threadDelayed 1590
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Window / User API: threadDelayed 1072
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Window / User API: threadDelayed 910
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Window / User API: threadDelayed 689
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Window / User API: threadDelayed 1628
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Window / User API: threadDelayed 1516
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Window / User API: threadDelayed 1068
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Window / User API: threadDelayed 652

Found dropped PE file which has not been started or loaded

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Found large amount of non-executed APIs

Source: C:\Users\user\Desktop\file.exe

API coverage: 0.3 %

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Users\user\Desktop\file.exe TID: 4348	Thread sleep time: -36018s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5740	Thread sleep time: -38019s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 4144	Thread sleep time: -32000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 3752	Thread sleep time: -42021s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 3332	Thread sleep time: -38019s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5228	Thread sleep time: -36018s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7396	Thread sleep count: 87 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7396	Thread sleep time: -174087s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7404	Thread sleep count: 70 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7404	Thread sleep time: -140070s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7364	Thread sleep count: 231 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7364	Thread sleep time: -6930000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7336	Thread sleep count: 4332 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7336	Thread sleep time: -8668332s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7384	Thread sleep count: 85 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7384	Thread sleep time: -170085s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7400	Thread sleep time: -180000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7336	Thread sleep time: -32016s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe TID: 8028	Thread sleep count: 1590 > 30
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe TID: 8028	Thread sleep time: -3181590s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe TID: 8008	Thread sleep count: 1072 > 30
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe TID: 8008	Thread sleep time: -2145072s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe TID: 7976	Thread sleep count: 77 > 30
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe TID: 7976	Thread sleep count: 78 > 30
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe TID: 7976	Thread sleep count: 79 > 30
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe TID: 2424	Thread sleep count: 910 > 30
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe TID: 2424	Thread sleep time: -1820910s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe TID: 796	Thread sleep count: 689 > 30
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe TID: 796	Thread sleep time: -1378689s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe TID: 2232	Thread sleep count: 1628 > 30
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe TID: 2232	Thread sleep time: -3257628s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe TID: 8056	Thread sleep count: 1516 > 30
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe TID: 8056	Thread sleep time: -3033516s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe TID: 1228	Thread sleep count: 1068 > 30
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe TID: 1228	Thread sleep time: -2137068s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe TID: 6748	Thread sleep time: -58029s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe TID: 6760	Thread sleep time: -44022s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe TID: 7096	Thread sleep time: -32000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe TID: 6764	Thread sleep time: -54027s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe TID: 7120	Thread sleep time: -210000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe TID: 6828	Thread sleep time: -44022s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe TID: 6832	Thread sleep time: -54027s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe TID: 6808	Thread sleep time: -54027s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe TID: 6804	Thread sleep time: -62031s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe TID: 1168	Thread sleep time: -56028s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe TID: 396	Thread sleep time: -46023s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe TID: 6840	Thread sleep time: -36000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe TID: 5376	Thread sleep time: -42021s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe TID: 6928	Thread sleep time: -210000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe TID: 6192	Thread sleep time: -56028s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe TID: 3492	Thread sleep time: -48024s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe TID: 412	Thread sleep time: -44022s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe TID: 3668	Thread sleep time: -40020s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe TID: 5368	Thread sleep count: 103 > 30
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe TID: 5368	Thread sleep count: 144 > 30
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe TID: 1420	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe TID: 4284	Thread sleep count: 652 > 30
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe TID: 4284	Thread sleep count: 280 > 30
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe TID: 4284	Thread sleep count: 141 > 30
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe TID: 2740	Thread sleep time: -48024s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe TID: 2716	Thread sleep time: -36018s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe TID: 2288	Thread sleep time: -48024s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe TID: 2832	Thread sleep time: -34017s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe TID: 7996	Thread sleep time: -270000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe TID: 6040	Thread sleep time: -34017s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe TID: 2784	Thread sleep time: -36018s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe TID: 4944	Thread sleep time: -34017s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe TID: 2496	Thread sleep time: -180000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe TID: 3752	Thread sleep time: -32016s >= -30000s

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Sample execution stops while process was sleeping (likely an evasion)

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Documents\BAKFCBFHJD.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C46C930 GetSystemInfo,VirtualAlloc,GetSystemInfo,VirtualFree,VirtualAlloc,

0_2_6C46C930

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.2107629430.000000000138B000.00000040.00000001.01000000.00000003.sdmp, BAKFCBFHJD.exe, 00000009.00000002.2157881884.0000000000673000.00000040.00000001.01000000.0000000B.sdmp, BAKFCBFHJD.exe, 00000009.00000000.2088224331.0000000000673000.00000080.00000001.01000000.0000000B.sdmp, skotes.exe, 0000000A.00000002.2198440738.0000000001133000.00000040.00000001.01000000.0000000D.sdmp, skotes.exe, 0000000A.00000000.2127869098.0000000001133000.00000080.00000001.01000000.0000000D.sdmp, skotes.exe, 0000000B.00000000.2132260235.0000000001133000.00000080.00000001.01000000.0000000D.sdmp, skotes.exe, 0000000B.00000002.2199681608.0000000001133000.00000040.00000001.01000000.0000000D.sdmp, skotes.exe, 0000000C.00000000.2299229146.0000000001133000.00000080.00000001.01000000.0000000D.sdmp, f377015f96.exe, 00000010.00000002.2679711119.000000000118B000.00000040.00000001.01000000.00000010.sdmp, f377015f96.exe, 00000019.00000002.2850082344.000000000118B000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: f039f524ee.exe, 0000000F.00000003.2646499229.0000000001011000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2646636082.0000000001017000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2622538163.0000000001019000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2646669500.0000000001019000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2616118705.0000000001012000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ItQegq4KuCKrUeyRbO71YP7nEBBLPLkYmFsftqEMuZoh
Source: a17088d8c7.exe, 0000000D.00000003.3078884337.00000000055D4000.00000004.00000020.00020000.00000000.sdmp, a17088d8c7.exe, 0000000D.00000003.3117232730.00000000055D4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWZ:u
Source: f039f524ee.exe, 0000000F.00000003.2848661309.0000000000FB0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWQ
Source: file.exe, 00000000.00000002.2107233640.0000000000E45000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWhw
Source: file.exe, 00000000.00000002.2107233640.0000000000E71000.00000004.00000020.00020000.00000000.sdmp, a17088d8c7.exe, 0000000D.00000003.3078884337.00000000055D4000.00000004.00000020.00020000.00000000.sdmp, a17088d8c7.exe, 0000000D.00000003.3117232730.00000000055D4000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2848661309.0000000000FB0000.00000004.00000020.00020000.00000000.sdmp, f377015f96.exe, 00000010.00000002.2681962698.00000000015CF000.00000004.00000020.00020000.00000000.sdmp, 18d00389b3.exe, 00000012.00000003.2824173672.0000000001801000.00000004.00000020.00020000.00000000.sdmp, 18d00389b3.exe, 00000012.00000003.2818519812.00000000017FD000.00000004.00000020.00020000.00000000.sdmp, 18d00389b3.exe, 00000012.00000002.2849633497.0000000001802000.00000004.00000020.00020000.00000000.sdmp, f377015f96.exe, 00000019.00000002.2861247425.0000000001AD5000.00000004.00000020.00020000.00000000.sdmp, f377015f96.exe, 00000019.00000002.2861247425.0000000001AAA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.2107233640.0000000000E71000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW9
Source: f377015f96.exe, 00000019.00000002.2861247425.0000000001A6B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: f377015f96.exe, 00000010.00000002.2681962698.00000000015A4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW(F]
Source: firefox.exe, 00000020.00000002.2906223989.0000017CD50B5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW : 2 : 34 : 1 : 1 : 0x20026 : 0x8 : %SystemRoot%\system32\mswsock.dll : : 1234191b-4bf7-4ca7-86e0-dfd7c32b5445
Source: f039f524ee.exe, 0000000F.00000003.2589748747.0000000001021000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2589686211.000000000100F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: hi/UVNPhErBJsEzz8BycqmCn70pmM0K3FspTC9nXO+nZZIRTzaVB7hz6Xp6Ze8CjPr2bcAcrXrlZmEtq2Ycn78RigFzD7UHsEKsm7udUju1unb1OKGAR+kDTHl+I3R73wnGXZO6ACq5b7Vn49QKOsT/+9wx0MEWqAYhBTNeJae+UOcYegrMKuFusF62mT8C2PKypXzBoV8do6hBSkJMs/sVfqn/JoFrtCuYdtutjxbQ+s75RIn0h713ZGki1nT/+xVzORcWoUeBK7UOgp1nJixCQol0lZSHvVc4UE9fQJrmMWNRCzLZFrAr4F6uxS4GgLbDvY2grCLkOmD9ej5c4uZohkhCa8wSgH/pZ+PceleB96f8OOSUJuUCYSwHX0Du5jCHTU9CzTOMN6F6emW3DuS+5vUozZgD3UOYtf5SGLuHfb5pTgu8K71uzIOCLQdiyP+XjWiYrL7cWwFML2bwk79Nw2XzPt034EOUXo+cCjrNu5v0SZm8BuQ6IQQjMw36phn7aSYK3CrhJpVmy5xSO8i2svVolfRO+aOYlWZ7SCfrCItQegq4KuCKrUeyRbO71YP7nEBBLPLkYmFsftqEMuZoh3BzljmSgVatR7Ih97vVg/ucQKWsd4xaWUxvVswnflC/UGI6FZNpbpVno63runG7w7xRqQTDSFpZTG9WGM++UXtoQ2uESoDToEq7lbcC+KbK5TWtdGv522wUT19AvuYww2hDGsAq4S7lC9fQbnucx8LYcMCtIqxiYARPB0Aih6l+mf+GKZKBVqxbg/3WO/WKfg3NmJVCxGuo8d9neabGYU7t8gu8KqFfZNo7nAo79D52OdgEnItYWllMb1aUb1pQv1BiOk2WgVatR7JB9/vUR8O9EZjNQ1lXTHRG4niL+2HeFHfCmT+MK/Ajg6QzI9Xbv4RwielChBopIBsrHeavLL40Q1OESslWrC+D/DIm7I7+sUiV5Av9VzhAUp64G+t9vlFvSp3TeKv0UsKAMgPUh/vdlZiNc/1aYLB3ZiGmhlE6XW8zja+4Q7BW2tgHhtiWwr1c2bVC3Ft5TC8jeaf3FIcwAkPofs0y7S7/pVY6jbub9EmZ5UKEWnxBBi5Yq79cmqm7FjgjBFeAerLEMgPUh/vdlZiNc/1XOUx3Z2GX/13fbQciuCq5bo1WmpFqBoC2w7xJmI1z+WdZTbNfQMbmMIbtTya8IwRXgHqyxXYOSIZ+hVyFnBrkYmBUTwcFnudBw1AiS8xG1SLxJ8rhz0Q==
Source: file.exe, 00000000.00000002.2107629430.000000000138B000.00000040.00000001.01000000.00000003.sdmp, BAKFCBFHJD.exe, 00000009.00000002.2157881884.0000000000673000.00000040.00000001.01000000.0000000B.sdmp, BAKFCBFHJD.exe, 00000009.00000000.2088224331.0000000000673000.00000080.00000001.01000000.0000000B.sdmp, skotes.exe, 0000000A.00000002.2198440738.0000000001133000.00000040.00000001.01000000.0000000D.sdmp, skotes.exe, 0000000A.00000000.2127869098.0000000001133000.00000080.00000001.01000000.0000000D.sdmp, skotes.exe, 0000000B.00000000.2132260235.0000000001133000.00000080.00000001.01000000.0000000D.sdmp, skotes.exe, 0000000B.00000002.2199681608.0000000001133000.00000040.00000001.01000000.0000000D.sdmp, skotes.exe, 0000000C.00000000.2299229146.0000000001133000.00000080.00000001.01000000.0000000D.sdmp, f377015f96.exe, 00000010.00000002.2679711119.000000000118B000.00000040.00000001.01000000.00000010.sdmp, f377015f96.exe, 00000019.00000002.2850082344.000000000118B000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: firefox.exe, 00000022.00000002.2931706128.0000029454540000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: f377015f96.exe, 00000019.00000002.2861247425.0000000001AD5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWD

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	API call chain: ExitProcess graph end node

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Checks for debuggers (devices)

Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: SIWVID

Checks for kernel debuggers (NtQuerySystemInformation(SystemKernelDebuggerInformation))

Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe

System information queried: KernelDebuggerInformation

Checks if the current process is being debugged

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process queried: DebugPort

Contains functionality for execution timing, often used to detect debuggers

Source: C:\Users\user\Documents\BAKFCBFHJD.exe

Code function: 9_2_05220D46 rdtsc

9_2_05220D46

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C4B5FF0 IsDebuggerPresent,??0PrintfTarget@mozilla@@IAE@XZ,?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z,OutputDebugStringA,__acrt_iob_func,_fileno,_dup,_fdopen,__stdio_common_vfprintf,fclose,

0_2_6C4B5FF0

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C4BC410 LoadLibraryW,GetProcAddress,FreeLibrary,

0_2_6C4BC410

Contains functionality to read the PEB

Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Code function: 9_2_004B652B mov eax, dword ptr fs:[00000030h]	9_2_004B652B
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Code function: 9_2_004BA302 mov eax, dword ptr fs:[00000030h]	9_2_004BA302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 10_2_00F7A302 mov eax, dword ptr fs:[00000030h]	10_2_00F7A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 10_2_00F7652B mov eax, dword ptr fs:[00000030h]	10_2_00F7652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 11_2_00F7A302 mov eax, dword ptr fs:[00000030h]	11_2_00F7A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 11_2_00F7652B mov eax, dword ptr fs:[00000030h]	11_2_00F7652B

Enables debug privileges

Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C48B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_6C48B66C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C48B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6C48B1F7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C63AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6C63AC62

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: file.exe PID: 3152, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: f377015f96.exe PID: 8, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: f377015f96.exe PID: 5228, type: MEMORYSTR

Excessive usage of taskkill to terminate processes

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T

Creates a process in suspended mode (likely to inject code)

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\BAKFCBFHJD.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Documents\BAKFCBFHJD.exe "C:\Users\user\Documents\BAKFCBFHJD.exe"	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe "C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe "C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe "C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe "C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe "C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=f039f524ee.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=f039f524ee.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=f039f524ee.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=f039f524ee.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process created: unknown unknown

Uses taskkill to terminate processes

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C684760 malloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetSecurityDescriptorGroup,GetLengthSid,GetLengthSid,GetLengthSid,malloc,InitializeAcl,AddAccessAllowedAce,AddAccessAllowedAce,AddAccessAllowedAce,SetSecurityDescriptorDacl,PR_SetError,GetLastError,free,GetLastError,GetLastError,free,free,free,

0_2_6C684760

Source: 18d00389b3.exe, 00000012.00000000.2682081483.00000000008E2000.00000002.00000001.01000000.00000011.sdmp	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: file.exe, file.exe, 00000000.00000002.2107629430.000000000138B000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: dProgram Manager
Source: firefox.exe, 00000020.00000002.2896023910.00000018880BB000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: ?ProgmanListenerWi
Source: BAKFCBFHJD.exe, 00000009.00000002.2158184442.00000000006B7000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, 0000000A.00000002.2198597904.0000000001177000.00000040.00000001.01000000.0000000D.sdmp, skotes.exe, 0000000B.00000002.2199941474.0000000001177000.00000040.00000001.01000000.0000000D.sdmp	Binary or memory string: ^lProgram Manager

Contains functionality to query CPU information (cpuid)

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C48B341 cpuid

0_2_6C48B341

Queries information about the installed CPU (vendor, model number etc)

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Queries the volume information (name, serial number etc) of a device

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C4535A0 ?Startup@TimeStamp@mozilla@@SAXXZ,InitializeCriticalSectionAndSpinCount,getenv,QueryPerformanceFrequency,_strnicmp,GetSystemTimeAdjustment,__aulldiv,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,__aulldiv,strcmp,strcmp,_strnicmp,

0_2_6C4535A0

Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Lowering of HIPS / PFW / Operating System Security Settings

Disable Windows Defender notifications (registry)

Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe

Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1

Disable Windows Defender real time protection (registry)

Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableIOAVProtection 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRealtimeMonitoring 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	Registry value created: DisableNotifications 1

Disables Windows Defender Tamper protection

Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe

Registry value created: TamperProtection 0

Modifies windows update settings

Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AutoInstallMinorUpdates
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotConnectToWindowsUpdateInternetLocations

AV process strings found (often used to terminate AV products)

Source: f039f524ee.exe, 0000000F.00000003.2714506979.0000000001037000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2713928133.000000000101B000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2713837367.000000000102A000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2848661309.0000000000FA5000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2714116427.000000000571C000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2714035777.000000000101D000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2904185884.00000000011FA000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2861815157.00000000011F2000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2889643830.00000000011FA000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 11.2.skotes.exe.f40000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.skotes.exe.f40000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.BAKFCBFHJD.exe.480000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.2153108799.0000000000481000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2198230771.0000000000F41000.00000040.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2199343337.0000000000F41000.00000040.00000001.01000000.0000000D.sdmp, type: MEMORY

Yara detected Credential Flusher

Source: Yara match

File source: Process Memory Space: 18d00389b3.exe PID: 3284, type: MEMORYSTR

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: f039f524ee.exe PID: 6696, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: f039f524ee.exe PID: 2840, type: MEMORYSTR

Yara detected Stealc

Source: Yara match	File source: 00000000.00000003.1658639876.0000000005220000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000031.00000002.3117979567.0000000000DB1000.00000040.00000001.01000000.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.2848099754.0000000000DB1000.00000040.00000001.01000000.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2107422140.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.2629217512.00000000050B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.2861247425.0000000001A6B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000031.00000003.3020544677.0000000004B00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000003.2757599430.00000000056A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.2681962698.000000000155E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.2679338417.0000000000DB1000.00000040.00000001.01000000.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000031.00000002.3112834532.000000000068B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2107233640.0000000000DFE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 3152, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: f377015f96.exe PID: 8, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: f377015f96.exe PID: 5228, type: MEMORYSTR

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 3152, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.2107422140.0000000001034000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2107422140.0000000001034000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2107422140.0000000001034000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2107422140.0000000001117000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Jaxx Liberty
Source: file.exe, 00000000.00000002.2107422140.0000000001034000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2107422140.0000000001034000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2107422140.0000000001034000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2107422140.0000000001034000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2107422140.0000000001034000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2107422140.0000000001034000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2107422140.0000000001034000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2107422140.0000000001034000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2107422140.0000000001034000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2107422140.0000000001034000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2107422140.0000000001034000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2107422140.0000000001034000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2107422140.0000000001034000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2107422140.0000000001034000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2107422140.0000000001034000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2107422140.0000000001034000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2107422140.0000000001034000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2107233640.0000000000E71000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\.

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Searches for user specific document files

Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents\JSDNGYCOWY
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents\JSDNGYCOWY
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents\JSDNGYCOWY
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents\JSDNGYCOWY
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents\SQRKHNBNYN
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents\SQRKHNBNYN
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents\JSDNGYCOWY
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents\JSDNGYCOWY
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents\SQRKHNBNYN
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents\SQRKHNBNYN
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents\WKXEWIOTXI
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents\WKXEWIOTXI
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN

Yara detected Credential Stealer

Source: Yara match	File source: 0000000F.00000003.2681081649.0000000001018000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2680221886.0000000001018000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2673800698.0000000001018000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2646499229.0000000001011000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.2809295731.00000000011E3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.2713156874.00000000011D8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2678578144.0000000001018000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2673028661.0000000001017000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2675427284.0000000001018000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2682030732.000000000101F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2678009352.0000000001018000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2680574921.0000000001018000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2678906552.0000000001018000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2681445195.0000000001018000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.2803779137.00000000011DC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.2809371493.00000000011F2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2679263353.0000000001018000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.2803011829.00000000011D8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2675179858.0000000001018000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2679554542.0000000001018000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2678083034.0000000001018000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2678456559.0000000001018000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2678381424.0000000001018000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2680795575.0000000001018000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2680339133.0000000001018000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2679363395.0000000001018000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2646636082.0000000001017000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.2771485025.00000000011DD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2679980400.0000000001018000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2673739066.0000000001018000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2680696251.0000000001018000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.2742195555.00000000011D8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.2742444167.00000000011DB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2680117370.0000000001018000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2674348099.0000000001018000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.2809334415.00000000011EA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2672861730.0000000001011000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2678514734.0000000001018000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.2770447800.00000000011D8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2679869482.0000000001018000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.2713492473.00000000011D9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.2814773574.00000000011F3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2677615654.0000000001018000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2622538163.0000000001019000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2678714450.0000000001018000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.2776788243.00000000011DD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2679680520.0000000001018000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.2771976922.00000000011DD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2677513754.0000000001018000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2678158093.0000000001018000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2646669500.0000000001019000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2674962634.0000000001018000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2673677963.0000000001018000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2589686211.000000000100F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2673586366.0000000001018000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2675285735.0000000001018000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2679462403.0000000001018000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2679006727.0000000001018000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.2775962014.00000000011DD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2679087482.0000000001018000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2678304397.0000000001018000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2680932860.0000000001018000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2673513530.0000000001018000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2678818521.0000000001018000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2616118705.0000000001012000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 3152, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: f039f524ee.exe PID: 6696, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: f039f524ee.exe PID: 2840, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""

Yara detected Credential Flusher

Source: Yara match

File source: Process Memory Space: 18d00389b3.exe PID: 3284, type: MEMORYSTR

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: f039f524ee.exe PID: 6696, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: f039f524ee.exe PID: 2840, type: MEMORYSTR

Yara detected Stealc

Source: Yara match	File source: 00000000.00000003.1658639876.0000000005220000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000031.00000002.3117979567.0000000000DB1000.00000040.00000001.01000000.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.2848099754.0000000000DB1000.00000040.00000001.01000000.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2107422140.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.2629217512.00000000050B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.2861247425.0000000001A6B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000031.00000003.3020544677.0000000004B00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000003.2757599430.00000000056A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.2681962698.000000000155E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.2679338417.0000000000DB1000.00000040.00000001.01000000.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000031.00000002.3112834532.000000000068B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2107233640.0000000000DFE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 3152, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: f377015f96.exe PID: 8, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: f377015f96.exe PID: 5228, type: MEMORYSTR

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 3152, type: MEMORYSTR

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C640C40 sqlite3_bind_zeroblob,	0_2_6C640C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C640D60 sqlite3_bind_parameter_name,	0_2_6C640D60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C568EA0 sqlite3_clear_bindings,	0_2_6C568EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C640B40 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob,	0_2_6C640B40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C566410 bind,WSAGetLastError,	0_2_6C566410
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C56C050 sqlite3_bind_parameter_index,strlen,strncmp,strncmp,	0_2_6C56C050
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C566070 PR_Listen,	0_2_6C566070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C56C030 sqlite3_bind_parameter_count,	0_2_6C56C030
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5660B0 listen,WSAGetLastError,	0_2_6C5660B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4F22D0 sqlite3_bind_blob,	0_2_6C4F22D0

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
104.21.48.1	unknown	United States	13335	CLOUDFLARENETUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
172.217.19.238	unknown	United States	15169	GOOGLEUS	false
23.218.210.69	unknown	United States	6453	AS6453US	false
13.107.246.63	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
80.82.65.70	unknown	Netherlands	202425	INT-NETWORKSC	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
216.58.208.227	unknown	United States	15169	GOOGLEUS	false
142.250.181.110	unknown	United States	15169	GOOGLEUS	false
2.20.41.214	unknown	European Union	16625	AKAMAI-ASUS	false
216.58.208.234	unknown	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
142.250.181.68	unknown	United States	15169	GOOGLEUS	false
172.217.21.35	unknown	United States	15169	GOOGLEUS	false
64.233.162.84	unknown	United States	15169	GOOGLEUS	false
35.190.72.216	unknown	United States	15169	GOOGLEUS	false
172.217.21.36	unknown	United States	15169	GOOGLEUS	false
173.194.222.84	unknown	United States	15169	GOOGLEUS	false
31.41.244.11	unknown	Russian Federation	61974	AEROEXPRESS-ASRU	false

Private

IP
192.168.2.4
127.0.0.1

Contacted URLs

Name	Malicious	Reputation
dare-curbys.biz	false	high
formy-spill.biz	false	high
atten-supporse.biz	false	high

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://atten-supporse.biz/apiluv	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phppresolver.dll	Avira URL Cloud: Label: malware
Source: https://atten-supporse.biz/U	Avira URL Cloud: Label: malware
Source: https://atten-supporse.biz/#4	Avira URL Cloud: Label: malware
Source: https://atten-supporse.biz/s4p6	Avira URL Cloud: Label: malware
Source: https://atten-supporse.biz/apiEW	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/mine/random.exeg	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phper	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Avira: detection malicious, Label: HEUR/AGEN.1320706
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Avira: detection malicious, Label: TR/Crypt.XPACK.Gen
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Avira: detection malicious, Label: TR/ATRAPS.Gen
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Avira: detection malicious, Label: TR/Crypt.XPACK.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	Avira: detection malicious, Label: TR/ATRAPS.Gen
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Avira: detection malicious, Label: HEUR/AGEN.1320706

Found malware configuration

Source: 00000009.00000002.2153108799.0000000000481000.00000040.00000001.01000000.0000000B.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 00000010.00000002.2681962698.000000000155E000.00000004.00000020.00020000.00000000.sdmp	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/c4becf79229cb002.php"}
Source: f039f524ee.exe.2840.17.memstrmin	Malware Configuration Extractor: LummaC {"C2 url": ["impend-differ.biz", "dare-curbys.biz", "atten-supporse.biz", "formy-spill.biz", "se-blurry.biz", "covery-mover.biz", "print-vexer.biz", "dwell-exclaim.biz", "zinc-sneark.biz"], "Build id": "LOGS11--LiveTraffic"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	ReversingLabs: Detection: 44%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[2].exe	ReversingLabs: Detection: 23%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe	ReversingLabs: Detection: 34%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe	ReversingLabs: Detection: 44%
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	ReversingLabs: Detection: 34%
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	ReversingLabs: Detection: 44%
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	ReversingLabs: Detection: 23%
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	ReversingLabs: Detection: 44%

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 44%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Uses Microsoft's Enhanced Cryptographic Provider

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C466C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,	0_2_6C466C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5BA9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,	0_2_6C5BA9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5B4440 PK11_PrivDecrypt,	0_2_6C5B4440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C584420 SECKEY_DestroyEncryptedPrivateKeyInfo,memset,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,free,	0_2_6C584420
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5B44C0 PK11_PubEncrypt,	0_2_6C5B44C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6025B0 PK11_Encrypt,memcpy,PR_SetError,PK11_Encrypt,	0_2_6C6025B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5BA650 PK11SDR_Encrypt,PORT_NewArena_Util,PK11_GetInternalKeySlot,PK11_Authenticate,SECITEM_ZfreeItem_Util,TlsGetValue,EnterCriticalSection,PR_Unlock,PK11_CreateContextBySymKey,PK11_GetBlockSize,PORT_Alloc_Util,memcpy,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PORT_ArenaAlloc_Util,PK11_CipherOp,SEC_ASN1EncodeItem_Util,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,PK11_DestroyContext,	0_2_6C5BA650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C598670 PK11_ExportEncryptedPrivKeyInfo,	0_2_6C598670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C59E6E0 PK11_AEADOp,TlsGetValue,EnterCriticalSection,PORT_Alloc_Util,PK11_Encrypt,PORT_Alloc_Util,memcpy,memcpy,PR_SetError,PR_SetError,PR_Unlock,PR_SetError,PR_Unlock,PK11_Decrypt,PR_GetCurrentThread,PK11_Decrypt,PK11_Encrypt,memcpy,memcpy,PR_SetError,free,	0_2_6C59E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5DA730 SEC_PKCS12AddCertAndKey,PORT_ArenaMark_Util,PORT_ArenaMark_Util,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,PK11_GetInternalKeySlot,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,SECKEY_DestroyEncryptedPrivateKeyInfo,strlen,PR_SetError,PORT_FreeArena_Util,PORT_FreeArena_Util,PORT_ArenaAlloc_Util,PR_SetError,	0_2_6C5DA730
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E0180 SECMIME_DecryptionAllowed,SECOID_GetAlgorithmTag_Util,	0_2_6C5E0180

Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=f039f524ee.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=f039f524ee.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=f039f524ee.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon

Uses 32bit PE files

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2116362437.000000006C68F000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2116362437.000000006C68F000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: f039f524ee.exe, 00000011.00000003.3081089288.0000000008320000.00000004.00001000.00020000.00000000.sdmp, 9f6ad733e2.exe, 00000021.00000003.2802037515.0000000005190000.00000004.00001000.00020000.00000000.sdmp, 9f6ad733e2.exe, 00000021.00000002.2937994456.0000000000EF2000.00000040.00000001.01000000.00000014.sdmp
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmp

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: chrome.exe	Memory has grown: Private usage: 9MB later: 41MB
Source: firefox.exe	Memory has grown: Private usage: 1MB later: 95MB

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	URLs: impend-differ.biz
Source: Malware configuration extractor	URLs: dare-curbys.biz
Source: Malware configuration extractor	URLs: atten-supporse.biz
Source: Malware configuration extractor	URLs: formy-spill.biz
Source: Malware configuration extractor	URLs: se-blurry.biz
Source: Malware configuration extractor	URLs: covery-mover.biz
Source: Malware configuration extractor	URLs: print-vexer.biz
Source: Malware configuration extractor	URLs: dwell-exclaim.biz
Source: Malware configuration extractor	URLs: zinc-sneark.biz
Source: Malware configuration extractor	IPs: 185.215.113.43

IP address seen in connection with other malware

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 1.1.1.1 1.1.1.1
Source: Joe Sandbox View	IP Address: 1.1.1.1 1.1.1.1

Internet Provider seen in connection with other malware

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C56CC60 PR_Recv,

0_2_6C56CC60

Source: firefox.exe, 00000020.00000002.2914904234.0000017CD7978000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD6757000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD6703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "url": "https://www.facebook.com/", equals www.facebook.com (Facebook)
Source: firefox.exe, 00000020.00000002.2914904234.0000017CD7978000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD6757000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD6703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "url": "https://www.youtube.com/", equals www.youtube.com (Youtube)
Source: firefox.exe, 00000020.00000002.2914904234.0000017CD7978000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD6703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.facebook.com (Facebook)
Source: firefox.exe, 00000020.00000002.2914904234.0000017CD7978000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD6703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.twitter.com (Twitter)
Source: firefox.exe, 00000020.00000002.2914904234.0000017CD7978000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD6703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.youtube.com (Youtube)
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: BETWEEN 'www.' \|\| :strippedURL AND 'www.' \|\| :strippedURL \|\| X'FFFF'The timing of the exposure event depends on the experiment, but generally the event is recorded when the user first encounters onboarding UI for the shopping feature.[{incognito:null, tabId:null, types:["image"], urls:["https://smartblock.firefox.etp/facebook.svg", "https://smartblock.firefox.etp/play.svg"], windowId:null}, ["blocking"]][{incognito:null, tabId:null, types:["image"], urls:["https://smartblock.firefox.etp/facebook.svg", "https://smartblock.firefox.etp/play.svg"], windowId:null}, ["blocking"]]X!p equals www.facebook.com (Facebook)
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5AE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "://.adsafeprotected.com//Serving/""://.adsafeprotected.com/jload""://pubads.g.doubleclick.net/gampad/ad""://vast.adsafeprotected.com/vast""://.adsafeprotected.com/jsvid?""://.adsafeprotected.com/jsvid?""://.adsafeprotected.com/jsvid""://.adsafeprotected.com/tpl?""://cdn.cmp.advertising.com/firefox-etp""://pubads.g.doubleclick.net/gampad/ad-blk""://pixel.advertising.com/firefox-etp""://vast.adsafeprotected.com/vast""://.adsafeprotected.com/services/pub""://track.adform.net/Serving/TrackPoint/""://securepubads.g.doubleclick.net/gampad/ad""://securepubads.g.doubleclick.net/gampad/ad""https://ads.stickyadstv.com/firefox-etp""://ads.stickyadstv.com/user-matching""://.adsafeprotected.com//adj""://.adsafeprotected.com//unit/""://.adsafeprotected.com/.png""://.adsafeprotected.com/jload?""://pubads.g.doubleclick.net/gampad/ad-blk""://pixel.advertising.com/firefox-etp""://.adsafeprotected.com/.gif""://.adsafeprotected.com/services/pub""://track.adform.net/Serving/TrackPoint/""://.adsafeprotected.com/.js""://.adsafeprotected.com//imp/""://.adsafeprotected.com/tpl?""://www.facebook.com/platform/impression.php""://ads.stickyadstv.com/auto-user-sync"Invalid argument passed to defaultEngine setterWebExtension engine check completegetDefaultEngineInfo: No default engineaddEnginesFromExtension: installing:nimbusPrivateDefaultUrlbarResultEnabledCan't find engine to remove in _sortedEngines!["://trends.google.com/trends/embed"]"://.adsafeprotected.com/.js""://pubads.g.doubleclick.net/gampad/ad""://.adsafeprotected.com//Serving/""://ads.stickyadstv.com/user-matching""://.adsafeprotected.com/jload?"#buildSortedEngineList: using saved order"://.adsafeprotected.com//unit/""://trends.google.com/trends/embed"#buildSortedEngineList: using default orders"://.adsafeprotected.com/tpl?""://.adsafeprotected.com//adj""://.adsafeprotected.com//imp/""://.adsafeprotected.com/jload""://trends.google.com/trends/embed"["://trends.google.com/trends/embed"]"://.adsafeprotected.com/.png""://.adsafeprotected.com/jsvid""://ads.stickyadstv.com/auto-user-sync""://.adsafeprotected.com/jsvid?""https://ads.stickyadstv.com/firefox-etp""://.adsafeprotected.com/services/pub"Running check on WebExtension enginesCould not find a replacement default engine."://www.facebook.com/platform/impression.php""://.adsafeprotected.com/.gif"@mozilla.org/widget/useridleservice;1addEnginesFromExtension/inConfig<Engine with updates found, setting update timer_sortEnginesByDefaults/remainingEngines<#findAndSetNewDefaultEngine/firstVisible<resource://gre/modules/DeferredTask.sys.mjsresource://gre/modules/ObjectUtils.sys.mjs#upgradeExtensionEngine/configuration<resource://gre/modules/SearchUtils.sys.mjsget: No settings file exists, new profile?batchTask: Invalidating engine settingsseperatePrivateDefaultUrlbarResultEnabled#buildSortedEngineList/filteredEngines<write-preve
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5AE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "://securepubads.g.doubleclick.net/gampad/ad-blk""https://static.adsafeprotected.com/firefox-etp-pixel""://tpc.googlesyndication.com/safeframe//html/container.html""://pagead2.googlesyndication.com/pagead/.jsfcd=true""://pagead2.googlesyndication.com/pagead/js/.jsfcd=true""://pubads.g.doubleclick.net/gampad/xml_vmap2""://pubads.g.doubleclick.net/gampad/xml_vmap1"resource://gre/modules/SearchSuggestionController.sys.mjs"://id.rambler.ru/rambler-id-helper/auth_events.js""://pubads.g.doubleclick.net/gampad/xml_vmap2""https://static.adsafeprotected.com/firefox-etp-pixel""://securepubads.g.doubleclick.net/gampad/xml_vmap2""https://static.adsafeprotected.com/firefox-etp-js""://www.gstatic.com/firebasejs//firebase-messaging.js""://securepubads.g.doubleclick.net/gampad/xml_vmap2""://securepubads.g.doubleclick.net/gampad/xml_vmap1""://media.richrelevance.com/rrserver/js/1.2/p13n.js""://vdb-cdn-files.s3.amazonaws.com//vidible-min.js""://securepubads.g.doubleclick.net/gampad/ad-blk""://securepubads.g.doubleclick.net/gampad/xml_vmap2""://securepubads.g.doubleclick.net/gpt/pubads_impl_.js""://pagead2.googlesyndication.com/gpt/pubads_impl_.js""://pubads.g.doubleclick.net/gampad/xml_vmap1""://pagead2.googlesyndication.com/tag/js/gpt.js""://securepubads.g.doubleclick.net/gampad/xml_vmap1""://pubads.g.doubleclick.net/gampad/xml_vmap1""://pubads.g.doubleclick.net/gampad/xml_vmap2""https://static.adsafeprotected.com/firefox-etp-pixel""://www.googleadservices.com/pagead/conversion_async.js""://securepubads.g.doubleclick.net/tag/js/gpt.js""://securepubads.g.doubleclick.net/gampad/ad-blk""://securepubads.g.doubleclick.net/gampad/xml_vmap1"ifnull(b.title, iif(h.frecency <> 0, h.title, NULL)) AS title, equals www.rambler.ru (Rambler)
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5AE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "://www.facebook.com/platform/impression.php" equals www.facebook.com (Facebook)
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://pubads.g.doubleclick.net/gampad/xml_vmap2://www.facebook.com/platform/impression.php://pubads.g.doubleclick.net/gampad/ad://.adsafeprotected.com//unit/--panel-banner-item-update-supported-bgcolor--panel-banner-item-info-icon-bgcolor://cdn.cmp.advertising.com/firefox-etp://.adsafeprotected.com/services/pubexecuteIDB/promise</transaction.onerror equals www.facebook.com (Facebook)
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://www.facebook.com/platform/impression.php equals www.facebook.com (Facebook)
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://www.gstatic.com/firebasejs//firebase-messaging.js*://pagead2.googlesyndication.com/pagead/.jsfcd=true://pagead2.googlesyndication.com/pagead/js/.jsfcd=true://securepubads.g.doubleclick.net/gampad/ad-blk*://securepubads.g.doubleclick.net/gampad/xml_vmap1*://tpc.googlesyndication.com/safeframe//html/container.htmlcolor-mix(in srgb, currentColor 14%, transparent)color-mix(in srgb, currentColor 25%, transparent)://securepubads.g.doubleclick.net/tag/js/gpt.js*://id.rambler.ru/rambler-id-helper/auth_events.jsopenIDB/</request.onupgradeneeded/transaction.onabort equals www.rambler.ru (Rambler)
Source: firefox.exe, 00000020.00000002.2910130082.0000017CD677D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: -l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"Wikipedia"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.reddit.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="R"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/reddit-com@2x.png)"></div></div></div><div class="title"><span dir="auto">Reddit<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"Reddit"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer hide-for-narrow"><div class="top-site-inner"><a class="top-site-button" href="https://twitter.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="T"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/twitter-com@2x.png)"></div></div></div><div class="title"><span dir="auto">Twitter<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"Twitter"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer placeholder hide-for-narrow"><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li></ul><div class="edit-topsites-wrapper"></div></div></section></div></div></div></div><style data-styles="[[null]]"></style></div><div class="discovery-stream ds-layout"><div class="ds-column ds-column-12"><div class="ds-column-grid"><div></div></div></div><style data-styles="[[null]]"></style></div></div></main></div></div> equals www.twitter.com (Twitter)
Source: firefox.exe, 00000020.00000002.2933948328.0000017CDA0BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2931947413.0000017CD9EF7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2933948328.0000017CDA07C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: FileUtils_closeSafeFileOutputStreamFileUtils_openSafeFileOutputStreamresource://gre/modules/addons/XPIProvider.jsmFileUtils_openAtomicFileOutputStreamwebcompat-reporter@mozilla.org.xpi@mozilla.org/network/atomic-file-output-stream;1webcompat-reporter%40mozilla.org:1.5.1https://smartblock.firefox.etp/facebook.svg@mozilla.org/addons/addon-manager-startup;1://cdn.branch.io/branch-latest.min.js@mozilla.org/network/safe-file-output-stream;1@mozilla.org/network/file-output-stream;1://pub.doubleverify.com/signals/pub.js://www.google-analytics.com/analytics.js://www.google-analytics.com/gtm/js://www.googletagmanager.com/gtm.js://ssl.google-analytics.com/ga.js://pagead2.googlesyndication.com/tag/js/gpt.js*://cdn.adsafeprotected.com/iasPET.1.js://static.adsafeprotected.com/iasPET.1.js://.moatads.com//moatheader.js://cdn.optimizely.com/public/.js://js.maxmind.com/js/apis/geoip2//geoip2.js://imasdk.googleapis.com/js/sdkloader/ima3.js://s.webtrends.com/js/advancedLinkTracking.js*://s.webtrends.com/js/webtrends.jsresource://gre/modules/ConduitsParent.sys.mjs equals www.facebook.com (Facebook)
Source: firefox.exe, 00000020.00000002.2933675468.0000017CD9F08000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ["://track.adform.net/Serving/TrackPoint/", "://pagead2.googlesyndication.com/pagead/.jsfcd=true", "://pagead2.googlesyndication.com/pagead/js/.jsfcd=true", "://pixel.advertising.com/firefox-etp", "://cdn.cmp.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "https://static.adsafeprotected.com/firefox-etp-js", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/*"] equals www.facebook.com (Facebook)
Source: firefox.exe, 00000020.00000002.2933675468.0000017CD9F08000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ["://track.adform.net/Serving/TrackPoint/", "://pixel.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/"] equals www.facebook.com (Facebook)
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A46000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ["://webcompat-addon-testbed.herokuapp.com/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js", "://track.adform.net/serving/scripts/trackpoint/", "://track.adform.net/serving/scripts/trackpoint/async/", "://.adnxs.com//ast.js", "://.adnxs.com//pb.js", "://.adnxs.com//prebid", "://www.everestjs.net/static/st.v3.js", "://static.adsafeprotected.com/vans-adapter-google-ima.js", "://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "://cdn.branch.io/branch-latest.min.js", "://pub.doubleverify.com/signals/pub.js", "://c.amazon-adsystem.com/aax2/apstag.js", "://auth.9c9media.ca/auth/main.js", "://static.chartbeat.com/js/chartbeat.js", "://static.chartbeat.com/js/chartbeat_video.js", "://static.criteo.net/js/ld/publishertag.js", "://.imgur.com/js/vendor..bundle.js", "://.imgur.io/js/vendor..bundle.js", "://www.rva311.com/static/js/main..chunk.js", "://web-assets.toggl.com/app/assets/scripts/.js", "://libs.coremetrics.com/eluminate.js", "://connect.facebook.net//sdk.js", "://connect.facebook.net//all.js", "://secure.cdn.fastclick.net/js/cnvr-launcher//launcher-stub.min.js", "://www.google-analytics.com/analytics.js", "://www.google-analytics.com/gtm/js", "://www.googletagmanager.com/gtm.js", "://www.google-analytics.com/plugins/ua/ec.js", "://ssl.google-analytics.com/ga.js", "://s0.2mdn.net/instream/html5/ima3.js", "://imasdk.googleapis.com/js/sdkloader/ima3.js", "://www.googleadservices.com/pagead/conversion_async.js", "://www.googletagservices.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/gpt/pubads_impl_.js", "://securepubads.g.doubleclick.net/tag/js/gpt.js", "://securepubads.g.doubleclick.net/gpt/pubads_impl_.js", "://script.ioam.de/iam.js", "://cdn.adsafeprotected.com/iasPET.1.js", "://static.adsafeprotected.com/iasPET.1.js", "://adservex.media.net/videoAds.js", "://.moatads.com//moatad.js", "://.moatads.com//moatapi.js", "://.moatads.com//moatheader.js", "://.moatads.com//yi.js", "://.imrworldwide.com/v60.js", "://cdn.optimizely.com/js/.js", "://cdn.optimizely.com/public/.js", "://id.rambler.ru/rambler-id-helper/auth_events.js", "://media.richrelevance.com/rrserver/js/1.2/p13n.js", "://www.gstatic.com/firebasejs//firebase-messaging.js", "://.vidible.tv//vidible-min.js", "://vdb-cdn-files.s3.amazonaws.com//vidible-min.js", "://js.maxmind.com/js/apis/geoip2//geoip2.js", "://s.webtrends.com/js/advancedLinkTracking.js", "://s.webtrends.com/js/webtrends.js", "://s.webtrends.com/js/webtrends.min.js"] equals www.facebook.com (Facebook)
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A46000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ["://webcompat-addon-testbed.herokuapp.com/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js", "://track.adform.net/serving/scripts/trackpoint/", "://track.adform.net/serving/scripts/trackpoint/async/", "://.adnxs.com//ast.js", "://.adnxs.com//pb.js", "://.adnxs.com//prebid", "://www.everestjs.net/static/st.v3.js", "://static.adsafeprotected.com/vans-adapter-google-ima.js", "://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "://cdn.branch.io/branch-latest.min.js", "://pub.doubleverify.com/signals/pub.js", "://c.amazon-adsystem.com/aax2/apstag.js", "://auth.9c9media.ca/auth/main.js", "://static.chartbeat.com/js/chartbeat.js", "://static.chartbeat.com/js/chartbeat_video.js", "://static.criteo.net/js/ld/publishertag.js", "://.imgur.com/js/vendor..bundle.js", "://.imgur.io/js/vendor..bundle.js", "://www.rva311.com/static/js/main..chunk.js", "://web-assets.toggl.com/app/assets/scripts/.js", "://libs.coremetrics.com/eluminate.js", "://connect.facebook.net//sdk.js", "://connect.facebook.net//all.js", "://secure.cdn.fastclick.net/js/cnvr-launcher//launcher-stub.min.js", "://www.google-analytics.com/analytics.js", "://www.google-analytics.com/gtm/js", "://www.googletagmanager.com/gtm.js", "://www.google-analytics.com/plugins/ua/ec.js", "://ssl.google-analytics.com/ga.js", "://s0.2mdn.net/instream/html5/ima3.js", "://imasdk.googleapis.com/js/sdkloader/ima3.js", "://www.googleadservices.com/pagead/conversion_async.js", "://www.googletagservices.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/gpt/pubads_impl_.js", "://securepubads.g.doubleclick.net/tag/js/gpt.js", "://securepubads.g.doubleclick.net/gpt/pubads_impl_.js", "://script.ioam.de/iam.js", "://cdn.adsafeprotected.com/iasPET.1.js", "://static.adsafeprotected.com/iasPET.1.js", "://adservex.media.net/videoAds.js", "://.moatads.com//moatad.js", "://.moatads.com//moatapi.js", "://.moatads.com//moatheader.js", "://.moatads.com//yi.js", "://.imrworldwide.com/v60.js", "://cdn.optimizely.com/js/.js", "://cdn.optimizely.com/public/.js", "://id.rambler.ru/rambler-id-helper/auth_events.js", "://media.richrelevance.com/rrserver/js/1.2/p13n.js", "://www.gstatic.com/firebasejs//firebase-messaging.js", "://.vidible.tv//vidible-min.js", "://vdb-cdn-files.s3.amazonaws.com//vidible-min.js", "://js.maxmind.com/js/apis/geoip2//geoip2.js", "://s.webtrends.com/js/advancedLinkTracking.js", "://s.webtrends.com/js/webtrends.js", "://s.webtrends.com/js/webtrends.min.js"] equals www.rambler.ru (Rambler)
Source: firefox.exe, 00000020.00000002.2933675468.0000017CD9F03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["image"], urls:["://track.adform.net/Serving/TrackPoint/", "://pixel.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 00000020.00000002.2933675468.0000017CD9F08000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2933675468.0000017CD9F03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["imageset"], urls:["://track.adform.net/Serving/TrackPoint/", "://pixel.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["script"], urls:["://webcompat-addon-testbed.herokuapp.com/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js", "://track.adform.net/serving/scripts/trackpoint/", "://track.adform.net/serving/scripts/trackpoint/async/", "://.adnxs.com//ast.js", "://.adnxs.com//pb.js", "://.adnxs.com//prebid", "://www.everestjs.net/static/st.v3.js", "://static.adsafeprotected.com/vans-adapter-google-ima.js", "://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "://cdn.branch.io/branch-latest.min.js", "://pub.doubleverify.com/signals/pub.js", "://c.amazon-adsystem.com/aax2/apstag.js", "://auth.9c9media.ca/auth/main.js", "://static.chartbeat.com/js/chartbeat.js", "://static.chartbeat.com/js/chartbeat_video.js", "://static.criteo.net/js/ld/publishertag.js", "://.imgur.com/js/vendor..bundle.js", "://.imgur.io/js/vendor..bundle.js", "://www.rva311.com/static/js/main..chunk.js", "://web-assets.toggl.com/app/assets/scripts/.js", "://libs.coremetrics.com/eluminate.js", "://connect.facebook.net//sdk.js", "://connect.facebook.net//all.js", "://secure.cdn.fastclick.net/js/cnvr-launcher//launcher-stub.min.js", "://www.google-analytics.com/analytics.js", "://www.google-analytics.com/gtm/js", "://www.googletagmanager.com/gtm.js", "://www.google-analytics.com/plugins/ua/ec.js", "://ssl.google-analytics.com/ga.js", "://s0.2mdn.net/instream/html5/ima3.js", "://imasdk.googleapis.com/js/sdkloader/ima3.js", "://www.googleadservices.com/pagead/conversion_async.js", "://www.googletagservices.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/gpt/pubads_impl_.js", "://securepubads.g.doubleclick.net/tag/js/gpt.js", "://securepubads.g.doubleclick.net/gpt/pubads_impl_.js", "://script.ioam.de/iam.js", "://cdn.adsafeprotected.com/iasPET.1.js", "://static.adsafeprotected.com/iasPET.1.js", "://adservex.media.net/videoAds.js", "://.moatads.com//moatad.js", "://.moatads.com//moatapi.js", "://.moatads.com//moatheader.js", "://.moatads.com//yi.js", "://.imrworldwide.com/v60.js", "://cdn.optimizely.com/js/.js", "://cdn.optimizely.com/public/.js", "://id.rambler.ru/rambler-id-helper/auth_events.js", "://media.richrelevance.com/rrserver/js/1.2/p13n.js", "://www.gstatic.com/firebasejs//firebase-messaging.js", "://.vidible.tv//vidible-min.js", "://vdb-cdn-files.s3.amazonaws.com//vidible-min.js", "://js.maxmind.com/js/apis/geoip2//geoip2.js", "://s.webtrends.com/js/advancedLinkTracking.js", "://s.webtrends.com/js/webtrends.js", "://s.webtrends.com/js/webtrends.min.js"], windowId
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A46000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2908457770.0000017CD5A61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["script"], urls:["://webcompat-addon-testbed.herokuapp.com/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js", "://track.adform.net/serving/scripts/trackpoint/", "://track.adform.net/serving/scripts/trackpoint/async/", "://.adnxs.com//ast.js", "://.adnxs.com//pb.js", "://.adnxs.com//prebid", "://www.everestjs.net/static/st.v3.js", "://static.adsafeprotected.com/vans-adapter-google-ima.js", "://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "://cdn.branch.io/branch-latest.min.js", "://pub.doubleverify.com/signals/pub.js", "://c.amazon-adsystem.com/aax2/apstag.js", "://auth.9c9media.ca/auth/main.js", "://static.chartbeat.com/js/chartbeat.js", "://static.chartbeat.com/js/chartbeat_video.js", "://static.criteo.net/js/ld/publishertag.js", "://.imgur.com/js/vendor..bundle.js", "://.imgur.io/js/vendor..bundle.js", "://www.rva311.com/static/js/main..chunk.js", "://web-assets.toggl.com/app/assets/scripts/.js", "://libs.coremetrics.com/eluminate.js", "://connect.facebook.net//sdk.js", "://connect.facebook.net//all.js", "://secure.cdn.fastclick.net/js/cnvr-launcher//launcher-stub.min.js", "://www.google-analytics.com/analytics.js", "://www.google-analytics.com/gtm/js", "://www.googletagmanager.com/gtm.js", "://www.google-analytics.com/plugins/ua/ec.js", "://ssl.google-analytics.com/ga.js", "://s0.2mdn.net/instream/html5/ima3.js", "://imasdk.googleapis.com/js/sdkloader/ima3.js", "://www.googleadservices.com/pagead/conversion_async.js", "://www.googletagservices.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/gpt/pubads_impl_.js", "://securepubads.g.doubleclick.net/tag/js/gpt.js", "://securepubads.g.doubleclick.net/gpt/pubads_impl_.js", "://script.ioam.de/iam.js", "://cdn.adsafeprotected.com/iasPET.1.js", "://static.adsafeprotected.com/iasPET.1.js", "://adservex.media.net/videoAds.js", "://.moatads.com//moatad.js", "://.moatads.com//moatapi.js", "://.moatads.com//moatheader.js", "://.moatads.com//yi.js", "://.imrworldwide.com/v60.js", "://cdn.optimizely.com/js/.js", "://cdn.optimizely.com/public/.js", "://id.rambler.ru/rambler-id-helper/auth_events.js", "://media.richrelevance.com/rrserver/js/1.2/p13n.js", "://www.gstatic.com/firebasejs//firebase-messaging.js", "://.vidible.tv//vidible-min.js", "://vdb-cdn-files.s3.amazonaws.com//vidible-min.js", "://js.maxmind.com/js/apis/geoip2//geoip2.js", "://s.webtrends.com/js/advancedLinkTracking.js", "://s.webtrends.com/js/webtrends.js", "://s.webtrends.com/js/webtrends.min.js"], windowId
Source: firefox.exe, 00000020.00000002.2933675468.0000017CD9F08000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["xmlhttprequest"], urls:["://track.adform.net/Serving/TrackPoint/", "://pagead2.googlesyndication.com/pagead/.jsfcd=true", "://pagead2.googlesyndication.com/pagead/js/.jsfcd=true", "://pixel.advertising.com/firefox-etp", "://cdn.cmp.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "https://static.adsafeprotected.com/firefox-etp-js", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/*"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 00000020.00000002.2910130082.0000017CD6725000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: doff-text" data-l10n-args="{"engine": "Google"}"></div><input type="search" class="fake-editable" tabindex="-1" aria-hidden="true"/><div class="fake-caret"></div></button></div></div></div><div class="body-wrapper on"><div class="discovery-stream ds-layout"><div class="ds-column ds-column-12"><div class="ds-column-grid"><div><div class="ds-top-sites"><section class="collapsible-section top-sites" data-section-id="topsites"><div class="section-top-bar"><h3 class="section-title-container " style="visibility:hidden"><span class="section-title"><span data-l10n-id="newtab-section-header-topsites"></span></span><span class="learn-more-link-wrapper"></span></h3></div><div><ul class="top-sites-list"><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.youtube.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="Y"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/youtube-com@2x.png)"></div></div></div><div class="title"><span dir="auto">YouTube<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"YouTube"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.facebook.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="F"><div class="top-site-icon rich-icon" style="backgroun
Source: firefox.exe, 00000020.00000002.2910130082.0000017CD6725000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: doff-text" data-l10n-args="{"engine": "Google"}"></div><input type="search" class="fake-editable" tabindex="-1" aria-hidden="true"/><div class="fake-caret"></div></button></div></div></div><div class="body-wrapper on"><div class="discovery-stream ds-layout"><div class="ds-column ds-column-12"><div class="ds-column-grid"><div><div class="ds-top-sites"><section class="collapsible-section top-sites" data-section-id="topsites"><div class="section-top-bar"><h3 class="section-title-container " style="visibility:hidden"><span class="section-title"><span data-l10n-id="newtab-section-header-topsites"></span></span><span class="learn-more-link-wrapper"></span></h3></div><div><ul class="top-sites-list"><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.youtube.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="Y"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/youtube-com@2x.png)"></div></div></div><div class="title"><span dir="auto">YouTube<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"YouTube"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.facebook.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="F"><div class="top-site-icon rich-icon" style="backgroun
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: startup - adding clearkey CDM failedmedia.{0}.allow-x64-plugin-on-arm64media.gmp-manager.cert.checkAttributesstartup - adding clearkey CDM directory onPrefEMEGlobalEnabledChanged() id=media.gmp-manager.checkContentSignatureresource://gre/modules/UpdateUtils.sys.mjsdom.sitepermsaddon-provider.enabledfindUpdates() - updateTask succeeded for uninstallPlugin() - unregistering gmp directory ://static.chartbeat.com/js/chartbeat.js://static.chartbeat.com/js/chartbeat_video.jspictureinpicture%40mozilla.org:1.0.0://track.adform.net/serving/scripts/trackpoint/FileUtils_closeAtomicFileOutputStreamresource://gre/modules/FileUtils.sys.mjshttps://smartblock.firefox.etp/play.svg://auth.9c9media.ca/auth/main.js://.imgur.com/js/vendor..bundle.js://.imgur.io/js/vendor..bundle.js://static.criteo.net/js/ld/publishertag.js://www.rva311.com/static/js/main..chunk.js://web-assets.toggl.com/app/assets/scripts/.js://libs.coremetrics.com/eluminate.js://connect.facebook.net//sdk.js://www.everestjs.net/static/st.v3.js://connect.facebook.net//all.js*://c.amazon-adsystem.com/aax2/apstag.jsresource://gre/modules/AsyncShutdown.sys.mjs equals www.facebook.com (Facebook)
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5AE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: webRequest asyncPromptAuth failure resource://gre/modules/SecurityInfo.sys.mjsresource://gre/modules/ExtensionDNR.sys.mjsUnable to set host header to restricted url.resource://gre/modules/WebRequestUpload.sys.mjsresource://gre/modules/WebRequest.sys.mjsDisallowed change restricted response header 115062f8-92f1-11e5-8b7f-080027b0f7ecresource://gre/modules/ExtensionParent.sys.mjswebRequestFilterResponse.serviceWorkerScriptwebRequest onAuthCancelled failure @mozilla.org/network/http-activity-distributor;1ACTIVITY_SUBTYPE_RESPONSE_COMPLETEACTIVITY_SUBTYPE_TRANSACTION_CLOSEasyncPromptAuth/wrapper.authPromptForwardasyncPromptAuth/wrapper.authPromptCallbackwebRequestBlockingPermissionRequired"://login.microsoftonline.com/""://www.everestjs.net/static/st.v3.js"resource://gre/modules/ExtensionUtils.sys.mjs on service worker imported script removeBootstrappedManifestLocationwebRequestBlockingPermissionRequired@mozilla.org/webrequest/channel-event-sink;1webRequestBlockingPermissionRequiredwebRequest onAuthAvailable failure "https://smartblock.firefox.etp/facebook.svg"BLOCKING_REASON_EXTENSION_WEBREQUEST"https://smartblock.firefox.etp/play.svg"TYPE_INTERNAL_WORKER_IMPORT_SCRIPTSwebRequestBlockingPermissionRequiredTYPE_INTERNAL_WORKER_STATIC_MODULE"://.vidible.tv//vidible-min.js""://www.rva311.com/static/js/main..chunk.js""://js.maxmind.com/js/apis/geoip2//geoip2.js""://s.webtrends.com/js/webtrends.js""://libs.coremetrics.com/eluminate.js""://s.webtrends.com/js/webtrends.min.js""://cdn.branch.io/branch-latest.min.js""://static.criteo.net/js/ld/publishertag.js""://ssl.google-analytics.com/ga.js""://cdn.optimizely.com/public/.js""://static.adsafeprotected.com/iasPET.1.js""://.imgur.com/js/vendor..bundle.js""://www.google-analytics.com/gtm/js""://s0.2mdn.net/instream/html5/ima3.js""://cdn.adsafeprotected.com/iasPET.1.js""://connect.facebook.net//all.js""://c.amazon-adsystem.com/aax2/apstag.js""://.moatads.com//moatheader.js""://www.googletagservices.com/tag/js/gpt.js""://s.webtrends.com/js/advancedLinkTracking.js""://imasdk.googleapis.com/js/sdkloader/ima3.js""://auth.9c9media.ca/auth/main.js""://static.chartbeat.com/js/chartbeat.js""://pub.doubleverify.com/signals/pub.js""://.imgur.io/js/vendor..bundle.js""://connect.facebook.net//sdk.js""://www.google-analytics.com/plugins/ua/ec.js""://static.chartbeat.com/js/chartbeat_video.js""://www.google-analytics.com/analytics.js""://adservex.media.net/videoAds.js""://.moatads.com//moatapi.js""://www.googletagmanager.com/gtm.js""://track.adform.net/Serving/TrackPoint/""://pubads.g.doubleclick.net/gampad/ad-blk""://pubads.g.doubleclick.net/gampad/ad""://www.facebook.com/platform/impression.php""://ads.stickyadstv.com/auto-user-sync""://ads.stickyadstv.com/user-matching""://.adsafeprotected.com/.gif""://vast.adsafeprotected.com/vast""://securepubads.g.doubleclick.net/gampad/ad""://.adsafeprotected.com/.png""https://ads.stickyadstv.com
Source: firefox.exe, 00000020.00000002.2933948328.0000017CDA0BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2931947413.0000017CD9EF7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2933948328.0000017CDA07C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 00000020.00000002.2933948328.0000017CDA036000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2931947413.0000017CD9ECE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2933948328.0000017CDA07C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: x://www.facebook.com/platform/impression.php equals www.facebook.com (Facebook)
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: {9e9a9283-0ce9-4e4a-8f1c-ba129a032c32}Got invalid request to save JSON dataFailed to listen. Callback argument missing.@mozilla.org/network/protocol;1?name=default^([a-z][a-z0-9.+\t-])(:\|;)?(\/\/)?get FIXUP_FLAGS_MAKE_ALTERNATE_URI@mozilla.org/uriloader/handler-service;1Failed to listen. Listener already attached.@mozilla.org/network/protocol;1?name=filebrowser.urlbar.dnsResolveFullyQualifiedNamesdevtools.debugger.remote-websocketresource://devtools/shared/security/socket.jsJSON Viewer's onSave failed in startPersistencedevtools.performance.popup.feature-flagUnable to start devtools server on devtools.performance.recording.ui-base-urldevtools/client/framework/devtoolsresource://devtools/server/devtools-server.jsNo callback set for this channel.WebChannel/this._originCheckCallbackbrowser.fixup.dns_first_for_single_words^([a-z+.-]+:\/{0,3})([^\/@]+@).+DevToolsStartup.jsm:handleDebuggerFlagreleaseDistinctSystemPrincipalLoader^[a-z0-9-]+(\.[a-z0-9-]+)*:[0-9]{1,5}([/?#]\|$)Can't invoke URIFixup in the content processextractScheme/fixupChangedProtocol<https://mail.inbox.lv/compose?to=%sresource://gre/modules/DeferredTask.sys.mjsresource://gre/modules/FileUtils.sys.mjshttps://poczta.interia.pl/mh/?mailto=%shttp://poczta.interia.pl/mh/?mailto=%sresource://gre/modules/ExtHandlerService.sys.mjshttp://win.mail.ru/cgi-bin/sentmsg?mailto=%s@mozilla.org/network/file-input-stream;1{c6cf88b7-452e-47eb-bdc9-86e3561648ef}https://mail.yahoo.co.jp/compose/?To=%shttp://www.inbox.lv/rfc2368/?value=%sresource://gre/modules/URIFixup.sys.mjsScheme should be either http or https@mozilla.org/uriloader/dbus-handler-app;1resource://gre/modules/DeferredTask.sys.mjs@mozilla.org/network/async-stream-copier;1http://compose.mail.yahoo.co.jp/ym/Compose?To=%s_injectDefaultProtocolHandlersIfNeededisDownloadsImprovementsAlreadyMigratedhttps://e.mail.ru/cgi-bin/sentmsg?mailto=%sresource://gre/modules/NetUtil.sys.mjs{33d75835-722f-42c0-89cc-44f328e56a86}@mozilla.org/uriloader/local-handler-app;1resource://gre/modules/FileUtils.sys.mjs_finalizeInternal/this._finalizePromise<@mozilla.org/uriloader/web-handler-app;1resource://gre/modules/JSONFile.sys.mjsgecko.handlerService.defaultHandlersVersionresource://gre/modules/JSONFile.sys.mjshandlerSvc fillHandlerInfo: don't know this typeMust have a source and a callback@mozilla.org/network/input-stream-pump;1newChannel requires a single object argumentSEC_ALLOW_CROSS_ORIGIN_SEC_CONTEXT_IS_NULL@mozilla.org/scriptableinputstream;1https://mail.yahoo.co.jp/compose/?To=%sNon-zero amount of bytes must be specifiedhttps://mail.yandex.ru/compose?mailto=%shttps://e.mail.ru/cgi-bin/sentmsg?mailto=%spdfjs.previousHandler.preferredActionpdfjs.previousHandler.alwaysAskBeforeHandlinghttps://mail.inbox.lv/compose?to=%shttps://poczta.interia.pl/mh/?mailto=%s@mozilla.org/uriloader/handler-service;1VALIDATE_DONT_COLLAPSE_WHITESPACE@mozilla.org/network/simple-stream-listener;1@mozilla.org/intl/converter-input-stream;1First argument should be an nsIInputStream@mo
Source: firefox.exe, 00000020.00000002.2933675468.0000017CD9F08000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: {incognito:null, tabId:null, types:["image"], urls:["://track.adform.net/Serving/TrackPoint/", "://pixel.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/"], windowId:null} equals www.facebook.com (Facebook)
Source: firefox.exe, 00000020.00000002.2933675468.0000017CD9F06000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: {incognito:null, tabId:null, types:["imageset"], urls:["://track.adform.net/Serving/TrackPoint/", "://pixel.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/"], windowId:null} equals www.facebook.com (Facebook)
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A46000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: {incognito:null, tabId:null, types:["script"], urls:["://webcompat-addon-testbed.herokuapp.com/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js", "://track.adform.net/serving/scripts/trackpoint/", "://track.adform.net/serving/scripts/trackpoint/async/", "://.adnxs.com//ast.js", "://.adnxs.com//pb.js", "://.adnxs.com//prebid", "://www.everestjs.net/static/st.v3.js", "://static.adsafeprotected.com/vans-adapter-google-ima.js", "://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "://cdn.branch.io/branch-latest.min.js", "://pub.doubleverify.com/signals/pub.js", "://c.amazon-adsystem.com/aax2/apstag.js", "://auth.9c9media.ca/auth/main.js", "://static.chartbeat.com/js/chartbeat.js", "://static.chartbeat.com/js/chartbeat_video.js", "://static.criteo.net/js/ld/publishertag.js", "://.imgur.com/js/vendor..bundle.js", "://.imgur.io/js/vendor..bundle.js", "://www.rva311.com/static/js/main..chunk.js", "://web-assets.toggl.com/app/assets/scripts/.js", "://libs.coremetrics.com/eluminate.js", "://connect.facebook.net//sdk.js", "://connect.facebook.net//all.js", "://secure.cdn.fastclick.net/js/cnvr-launcher//launcher-stub.min.js", "://www.google-analytics.com/analytics.js", "://www.google-analytics.com/gtm/js", "://www.googletagmanager.com/gtm.js", "://www.google-analytics.com/plugins/ua/ec.js", "://ssl.google-analytics.com/ga.js", "://s0.2mdn.net/instream/html5/ima3.js", "://imasdk.googleapis.com/js/sdkloader/ima3.js", "://www.googleadservices.com/pagead/conversion_async.js", "://www.googletagservices.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/gpt/pubads_impl_.js", "://securepubads.g.doubleclick.net/tag/js/gpt.js", "://securepubads.g.doubleclick.net/gpt/pubads_impl_.js", "://script.ioam.de/iam.js", "://cdn.adsafeprotected.com/iasPET.1.js", "://static.adsafeprotected.com/iasPET.1.js", "://adservex.media.net/videoAds.js", "://.moatads.com//moatad.js", "://.moatads.com//moatapi.js", "://.moatads.com//moatheader.js", "://.moatads.com//yi.js", "://.imrworldwide.com/v60.js", "://cdn.optimizely.com/js/.js", "://cdn.optimizely.com/public/.js", "://id.rambler.ru/rambler-id-helper/auth_events.js", "://media.richrelevance.com/rrserver/js/1.2/p13n.js", "://www.gstatic.com/firebasejs//firebase-messaging.js", "://.vidible.tv//vidible-min.js", "://vdb-cdn-files.s3.amazonaws.com//vidible-min.js", "://js.maxmind.com/js/apis/geoip2//geoip2.js", "://s.webtrends.com/js/advancedLinkTracking.js", "://s.webtrends.com/js/webtrends.js", "://s.webtrends.com/js/webtrends.min.js"], windowId:
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A46000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: {incognito:null, tabId:null, types:["script"], urls:["://webcompat-addon-testbed.herokuapp.com/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js", "://track.adform.net/serving/scripts/trackpoint/", "://track.adform.net/serving/scripts/trackpoint/async/", "://.adnxs.com//ast.js", "://.adnxs.com//pb.js", "://.adnxs.com//prebid", "://www.everestjs.net/static/st.v3.js", "://static.adsafeprotected.com/vans-adapter-google-ima.js", "://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "://cdn.branch.io/branch-latest.min.js", "://pub.doubleverify.com/signals/pub.js", "://c.amazon-adsystem.com/aax2/apstag.js", "://auth.9c9media.ca/auth/main.js", "://static.chartbeat.com/js/chartbeat.js", "://static.chartbeat.com/js/chartbeat_video.js", "://static.criteo.net/js/ld/publishertag.js", "://.imgur.com/js/vendor..bundle.js", "://.imgur.io/js/vendor..bundle.js", "://www.rva311.com/static/js/main..chunk.js", "://web-assets.toggl.com/app/assets/scripts/.js", "://libs.coremetrics.com/eluminate.js", "://connect.facebook.net//sdk.js", "://connect.facebook.net//all.js", "://secure.cdn.fastclick.net/js/cnvr-launcher//launcher-stub.min.js", "://www.google-analytics.com/analytics.js", "://www.google-analytics.com/gtm/js", "://www.googletagmanager.com/gtm.js", "://www.google-analytics.com/plugins/ua/ec.js", "://ssl.google-analytics.com/ga.js", "://s0.2mdn.net/instream/html5/ima3.js", "://imasdk.googleapis.com/js/sdkloader/ima3.js", "://www.googleadservices.com/pagead/conversion_async.js", "://www.googletagservices.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/gpt/pubads_impl_.js", "://securepubads.g.doubleclick.net/tag/js/gpt.js", "://securepubads.g.doubleclick.net/gpt/pubads_impl_.js", "://script.ioam.de/iam.js", "://cdn.adsafeprotected.com/iasPET.1.js", "://static.adsafeprotected.com/iasPET.1.js", "://adservex.media.net/videoAds.js", "://.moatads.com//moatad.js", "://.moatads.com//moatapi.js", "://.moatads.com//moatheader.js", "://.moatads.com//yi.js", "://.imrworldwide.com/v60.js", "://cdn.optimizely.com/js/.js", "://cdn.optimizely.com/public/.js", "://id.rambler.ru/rambler-id-helper/auth_events.js", "://media.richrelevance.com/rrserver/js/1.2/p13n.js", "://www.gstatic.com/firebasejs//firebase-messaging.js", "://.vidible.tv//vidible-min.js", "://vdb-cdn-files.s3.amazonaws.com//vidible-min.js", "://js.maxmind.com/js/apis/geoip2//geoip2.js", "://s.webtrends.com/js/advancedLinkTracking.js", "://s.webtrends.com/js/webtrends.js", "://s.webtrends.com/js/webtrends.min.js"], windowId:
Source: firefox.exe, 00000020.00000002.2933675468.0000017CD9F08000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: {incognito:null, tabId:null, types:["xmlhttprequest"], urls:["://track.adform.net/Serving/TrackPoint/", "://pagead2.googlesyndication.com/pagead/.jsfcd=true", "://pagead2.googlesyndication.com/pagead/js/.jsfcd=true", "://pixel.advertising.com/firefox-etp", "://cdn.cmp.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "https://static.adsafeprotected.com/firefox-etp-js", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/*"], windowId:null} equals www.facebook.com (Facebook)

Source: firefox.exe, 00000020.00000002.2919639043.0000017CD92A2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.2900114787.0000017CC985D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:
Source: f039f524ee.exe, 0000000F.00000003.2837717203.0000000001029000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/
Source: f039f524ee.exe, 0000000F.00000003.2837717203.0000000001029000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/9t
Source: f039f524ee.exe, 0000000F.00000003.2837717203.0000000001029000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/k
Source: file.exe, 00000000.00000002.2107233640.0000000000E57000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2107233640.0000000000ED6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: file.exe, 00000000.00000002.2107233640.0000000000E57000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exeg
Source: f039f524ee.exe, 0000000F.00000003.2848661309.0000000000FE5000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2848661309.0000000000FB0000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2849666702.0000000001004000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.3084418747.00000000011F9000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.3072941768.00000000011F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe
Source: f039f524ee.exe, 0000000F.00000003.2848661309.0000000000FE5000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2849666702.0000000001004000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exee
Source: f039f524ee.exe, 0000000F.00000003.2848661309.0000000000FE5000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2849666702.0000000001004000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exeq
Source: f039f524ee.exe, 0000000F.00000003.2848661309.0000000000FE5000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2837717203.0000000001029000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2849666702.0000000001004000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.3084418747.00000000011F9000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.3072941768.00000000011F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe
Source: f039f524ee.exe, 0000000F.00000003.2837717203.0000000001029000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exet_
Source: f039f524ee.exe, 0000000F.00000003.2848661309.0000000000FE5000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2849666702.0000000001004000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16:80/off/def.exeCLSID
Source: file.exe, 00000000.00000002.2107422140.0000000001117000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2107233640.0000000000DFE000.00000004.00000020.00020000.00000000.sdmp, f377015f96.exe, 00000010.00000002.2681962698.000000000155E000.00000004.00000020.00020000.00000000.sdmp, f377015f96.exe, 00000019.00000002.2861247425.0000000001A6B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: f377015f96.exe, 00000019.00000002.2861247425.0000000001A6B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206(K
Source: f377015f96.exe, 00000010.00000002.2681962698.00000000015B7000.00000004.00000020.00020000.00000000.sdmp, f377015f96.exe, 00000019.00000002.2861247425.0000000001A6B000.00000004.00000020.00020000.00000000.sdmp, f377015f96.exe, 00000019.00000002.2861247425.0000000001ABE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000000.00000002.2107233640.0000000000E57000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/1
Source: file.exe, 00000000.00000002.2107233640.0000000000E71000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll
Source: file.exe, 00000000.00000002.2107233640.0000000000E71000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll0
Source: file.exe, 00000000.00000002.2107233640.0000000000E71000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dllH
Source: file.exe, 00000000.00000002.2107233640.0000000000E57000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll
Source: file.exe, 00000000.00000002.2107233640.0000000000E71000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll
Source: file.exe, 00000000.00000002.2107233640.0000000000E57000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll
Source: file.exe, 00000000.00000002.2107233640.0000000000E57000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dllG
Source: file.exe, 00000000.00000002.2107233640.0000000000E71000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll
Source: file.exe, 00000000.00000002.2107233640.0000000000E71000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dllt
Source: file.exe, 00000000.00000002.2107233640.0000000000DFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll
Source: f377015f96.exe, 00000019.00000002.2861247425.0000000001ABE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/?
Source: f377015f96.exe, 00000019.00000002.2861247425.0000000001ABE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/H
Source: f377015f96.exe, 00000019.00000002.2861247425.0000000001ABE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/L
Source: f377015f96.exe, 00000010.00000002.2681962698.00000000015B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/V
Source: f377015f96.exe, 00000019.00000002.2861247425.0000000001ABE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: file.exe, 00000000.00000002.2112319814.000000000BD1A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php-
Source: f377015f96.exe, 00000010.00000002.2681962698.00000000015B7000.00000004.00000020.00020000.00000000.sdmp, f377015f96.exe, 00000019.00000002.2861247425.0000000001ABE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php/
Source: f377015f96.exe, 00000010.00000002.2681962698.00000000015B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php2
Source: f377015f96.exe, 00000019.00000002.2861247425.0000000001ABE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpV
Source: f377015f96.exe, 00000010.00000002.2681962698.000000000155E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpa-7368302a1ad4
Source: file.exe, 00000000.00000002.2107233640.0000000000E45000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpbK
Source: file.exe, 00000000.00000002.2107233640.0000000000E71000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpd
Source: file.exe, 00000000.00000002.2107422140.0000000001117000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phper
Source: f377015f96.exe, 00000010.00000002.2681962698.00000000015B7000.00000004.00000020.00020000.00000000.sdmp, f377015f96.exe, 00000019.00000002.2861247425.0000000001ABE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpn
Source: file.exe, 00000000.00000002.2112319814.000000000BD1A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phppresolver.dll
Source: f377015f96.exe, 00000010.00000002.2681962698.00000000015B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpr
Source: file.exe, 00000000.00000002.2107233640.0000000000E57000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/i
Source: f377015f96.exe, 00000019.00000002.2861247425.0000000001ABE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/ocal
Source: f377015f96.exe, 00000010.00000002.2681962698.000000000155E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/~
Source: f377015f96.exe, 00000019.00000002.2861247425.0000000001A6B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206H
Source: file.exe, 00000000.00000002.2107233640.0000000000DFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206M
Source: file.exe, 00000000.00000002.2107422140.0000000001117000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206c4becf79229cb002.phpser
Source: f377015f96.exe, 00000010.00000002.2681962698.000000000155E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206y
Source: a17088d8c7.exe, 0000000D.00000003.3117232730.00000000055B2000.00000004.00000020.00020000.00000000.sdmp, a17088d8c7.exe, 0000000D.00000003.3117232730.00000000055D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/
Source: a17088d8c7.exe, 0000000D.00000003.3117232730.00000000055D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/b%_
Source: a17088d8c7.exe, 0000000D.00000003.3117232730.00000000055CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/cdb-53011b87bd06
Source: a17088d8c7.exe, 0000000D.00000003.3078884337.00000000055B2000.00000004.00000020.00020000.00000000.sdmp, a17088d8c7.exe, 0000000D.00000003.3117232730.00000000055B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/dll/downloadhqos.dll.mui
Source: a17088d8c7.exe, 0000000D.00000003.3117232730.00000000055D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/dll/key
Source: a17088d8c7.exe, 0000000D.00000003.3117232730.00000000055D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/files/download
Source: a17088d8c7.exe, 0000000D.00000003.3078884337.00000000055D4000.00000004.00000020.00020000.00000000.sdmp, a17088d8c7.exe, 0000000D.00000003.3117232730.00000000055D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/files/download3&l
Source: a17088d8c7.exe, 0000000D.00000003.3078884337.00000000055D4000.00000004.00000020.00020000.00000000.sdmp, a17088d8c7.exe, 0000000D.00000003.3117232730.00000000055D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/files/download=&b
Source: a17088d8c7.exe, 0000000D.00000003.3078884337.00000000055D4000.00000004.00000020.00020000.00000000.sdmp, a17088d8c7.exe, 0000000D.00000003.3117232730.00000000055D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/files/downloadi
Source: f039f524ee.exe, 0000000F.00000003.2647391727.000000000574A000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2771585453.00000000058D5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2937492782.0000017CDA7C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: f039f524ee.exe, 0000000F.00000003.2647391727.000000000574A000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2771585453.00000000058D5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2937492782.0000017CDA7C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: firefox.exe, 00000020.00000002.2907178707.0000017CD557D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%s
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%s_injectDefaultProtocolHandlersIfNeeded
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%s_injectDefaultProtocolHandlersIfNeededisDownloadsImp
Source: firefox.exe, 00000020.00000002.2914904234.0000017CD79B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%ss
Source: f039f524ee.exe, 0000000F.00000003.2647391727.000000000574A000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2771585453.00000000058D5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2937492782.0000017CDA7C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: f039f524ee.exe, 0000000F.00000003.2647391727.000000000574A000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2771585453.00000000058D5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2937492782.0000017CDA7C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: f039f524ee.exe, 0000000F.00000003.2647391727.000000000574A000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2771585453.00000000058D5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2937492782.0000017CDA7C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: f039f524ee.exe, 0000000F.00000003.2647391727.000000000574A000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2771585453.00000000058D5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2937492782.0000017CDA7C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: f039f524ee.exe, 0000000F.00000003.2647391727.000000000574A000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2771585453.00000000058D5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2937492782.0000017CDA7C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: firefox.exe, 00000020.00000002.2944247945.0000017CDBA28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/canonical.html
Source: firefox.exe, 00000020.00000002.2933675468.0000017CD9F17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/canonical.htmlACTIVITY_SUBTYPE_REQUEST_BODY_SENTACTIVITY_SUBTYPE_PRO
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv4
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv6
Source: firefox.exe, 00000020.00000002.2908012090.0000017CD5912000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2908012090.0000017CD592C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.addEventListener
Source: firefox.exe, 00000020.00000002.2908012090.0000017CD5912000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2908012090.0000017CD592C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.removeEventListener
Source: firefox.exe, 00000020.00000002.2904680065.0000017CD4F26000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/common
Source: firefox.exe, 00000020.00000002.2904680065.0000017CD4F61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/dates-and-times$
Source: firefox.exe, 00000020.00000002.2904680065.0000017CD4F26000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/math
Source: firefox.exe, 00000020.00000002.2904680065.0000017CD4F61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/regular-expressionsh
Source: firefox.exe, 00000020.00000002.2904680065.0000017CD4F26000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/sets
Source: firefox.exe, 00000020.00000002.2900114787.0000017CC9803000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/strings
Source: firefox.exe, 00000020.00000002.2951694809.0000017CDCB2F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2944247945.0000017CDBACF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2923664473.0000017CD98DD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2831846902.0000017CD98C1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2906223989.0000017CD50B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2944247945.0000017CDBA62000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2935328508.0000017CDA103000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2943062764.0000017CDB31B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2949018481.0000017CDC044000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2951694809.0000017CDCB40000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2919639043.0000017CD9203000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2944247945.0000017CDBA51000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2924396777.0000017CD9988000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2937492782.0000017CDA71D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/MPL/2.0/.
Source: f039f524ee.exe, 0000000F.00000003.2647391727.000000000574A000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2771585453.00000000058D5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2937492782.0000017CDA7C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: f039f524ee.exe, 0000000F.00000003.2647391727.000000000574A000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2771585453.00000000058D5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2937492782.0000017CDA7C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2907178707.0000017CD557D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 00000020.00000002.2914904234.0000017CD79B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://poczta.interia.pl/mh/?mailto=%sw
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2907178707.0000017CD557D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 00000020.00000002.2914904234.0000017CD79B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%sy
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2907178707.0000017CD557D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.inbox.lv/rfc2368/?value=%s
Source: firefox.exe, 00000020.00000002.2914904234.0000017CD79B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.inbox.lv/rfc2368/?value=%su
Source: file.exe, file.exe, 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: firefox.exe, 00000020.00000002.2924396777.0000017CD9988000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2908457770.0000017CD5A9E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5AAF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulchrome://browser/content/browser-tabsin
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A9E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulchrome://browser/content/places/browser
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulchrome://global/content/elements/moz-me
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A9E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulchrome://passwordmgr/locale/passwordmgr
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A9E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulhttp://www.mozilla.org/keymaster/gateke
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5AE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulresource:///modules/UrlbarProviderTopSi
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5AE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulresource:///modules/sessionstore/Sessio
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5AE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulresource://gre/modules/PrivateBrowsingU
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A46000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulresource://gre/modules/URLDecorationAnn
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5AE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulsrc=image
Source: file.exe, 00000000.00000002.2109410050.0000000005CE9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2115895916.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: f039f524ee.exe, 0000000F.00000003.2647391727.000000000574A000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2771585453.00000000058D5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2937492782.0000017CDA7C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: f039f524ee.exe, 0000000F.00000003.2647391727.000000000574A000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2771585453.00000000058D5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2937492782.0000017CDA7C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.malware-error.mozilla.com/?url=
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.phish-error.mozilla.com/?url=
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.phish-report.mozilla.com/?url=
Source: firefox.exe, 00000020.00000002.2916806678.0000017CD8B70000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000003.2818869675.0000017CD945A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2817374710.0000017CD9200000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2817893137.0000017CD941F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2819165160.0000017CD9477000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2818486632.0000017CD943C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.duckduckgo.com/ac/
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.duckduckgo.com/ac/defaultPreventedByContenthttps://www.google.com/searchget
Source: file.exe, 00000000.00000003.1863399988.0000000000ED0000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2589952496.000000000573F000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2590072407.0000000005728000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2713287494.00000000058EB000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2713694037.00000000058E9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: firefox.exe, 00000020.00000002.2951694809.0000017CDCB78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://account.bellmedia.c
Source: firefox.exe, 00000020.00000002.2949018481.0000017CDC0E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://account.bellmedia.ca
Source: firefox.exe, 00000020.00000002.2914904234.0000017CD7978000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD6703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com/
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com/settings/clients
Source: firefox.exe, 00000020.00000002.2918847879.0000017CD9133000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2908457770.0000017CD5A03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2914904234.0000017CD79F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/language-tools/
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search-engines/
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search?q=%TERMS%&platform=%OS%&appver=%VERSION%
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/themes
Source: firefox.exe, 00000020.00000002.2933675468.0000017CD9F03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ads.stickyadstv.com/firefox-etp
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ads.stickyadstv.com/firefox-etpresource://gre/modules/ShortcutUtils.sys.mjs
Source: firefox.exe, 00000020.00000002.2914904234.0000017CD7978000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD677D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://amazon.com
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://api.accounts.firefox.com/v1
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://apps.apple.com/app/firefox-private-safe-browser/id989804926
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://apps.apple.com/us/app/firefox-private-network-vpn/id1489407738
Source: f039f524ee.exe, 0000000F.00000003.2848661309.0000000000FE5000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2646499229.0000000001011000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2843200148.0000000001012000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2848661309.0000000000FA5000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2589842358.0000000001013000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2589686211.000000000100F000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2590354965.0000000001013000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2616118705.0000000001012000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2777000037.0000000001012000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2904185884.00000000011FA000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2803779137.00000000011DC000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2771485025.00000000011DD000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2862654694.00000000011DE000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2742444167.00000000011DB000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2742195555.00000000011D8000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2770447800.00000000011D8000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2776788243.00000000011DD000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2771976922.00000000011DD000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2847569257.00000000011DC000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2889643830.00000000011FA000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2775962014.00000000011DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/
Source: f039f524ee.exe, 00000011.00000003.2889643830.00000000011E5000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2816854374.00000000011E7000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.3072941768.00000000011E8000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2809295731.00000000011E3000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2803779137.00000000011DC000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2803011829.00000000011D8000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2903405613.00000000011E8000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2771485025.00000000011DD000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2742444167.00000000011DB000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2742195555.00000000011D8000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2845300625.00000000011E8000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2770447800.00000000011D8000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2713492473.00000000011D9000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2776788243.00000000011DD000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2771976922.00000000011DD000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2775962014.00000000011DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/#
Source: f039f524ee.exe, 0000000F.00000003.2707665355.0000000001011000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/#4
Source: f039f524ee.exe, 0000000F.00000003.2848661309.0000000000FE5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/0
Source: f039f524ee.exe, 00000011.00000003.2803011829.00000000011D8000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2742444167.00000000011DB000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2742195555.00000000011D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/T
Source: f039f524ee.exe, 00000011.00000003.2713156874.00000000011D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/U
Source: f039f524ee.exe, 00000011.00000003.2904185884.00000000011FA000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2889643830.00000000011FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/VV
Source: f039f524ee.exe, 0000000F.00000003.2646499229.0000000001011000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2678578144.0000000001018000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2673028661.0000000001017000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2675427284.0000000001018000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2682193338.000000000101A000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2680574921.0000000001018000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2678009352.0000000001018000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2776383187.0000000001032000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2681445195.0000000001018000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2678906552.0000000001018000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2679263353.0000000001018000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2678083034.0000000001018000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2675179858.0000000001018000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2679554542.0000000001018000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2678456559.0000000001018000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2678381424.0000000001018000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2680795575.0000000001018000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2680339133.0000000001018000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2679363395.0000000001018000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2837717203.0000000001029000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2646636082.0000000001017000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/api
Source: f039f524ee.exe, 0000000F.00000003.2672861730.0000000001028000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/api.a
Source: f039f524ee.exe, 0000000F.00000003.2848661309.0000000000FE5000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2849666702.0000000001004000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/apiC
Source: f039f524ee.exe, 00000011.00000003.2904185884.00000000011FA000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.3084418747.00000000011F9000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2809295731.00000000011E3000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2861815157.00000000011F2000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2803779137.00000000011DC000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2803011829.00000000011D8000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2809371493.00000000011F2000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.3072941768.00000000011F9000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2842457103.00000000011F9000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2809334415.00000000011EA000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2814773574.00000000011F3000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2889643830.00000000011FA000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2817596296.00000000011FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/apiEW
Source: f039f524ee.exe, 00000011.00000003.2742444167.00000000011DB000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2742195555.00000000011D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/apiR
Source: f039f524ee.exe, 0000000F.00000003.2714506979.0000000001037000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2713837367.000000000102A000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2708103066.0000000001037000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/apiluv
Source: f039f524ee.exe, 00000011.00000003.2904185884.00000000011FA000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2889643830.00000000011FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/nV
Source: f039f524ee.exe, 0000000F.00000003.2672861730.0000000001011000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/s4p6
Source: f039f524ee.exe, 0000000F.00000003.2671657527.000000000571C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz:443/api
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/3/GMP/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%OS_VER
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/3/SystemAddons/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL
Source: firefox.exe, 00000020.00000002.2900114787.0000017CC9811000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/6/%PRODUCT%/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://blocked.cdn.mozilla.net/
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://blocked.cdn.mozilla.net/%blockID%.html
Source: file.exe, 00000000.00000002.2112319814.000000000BD12000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2107233640.0000000000ED6000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2649157391.0000000001027000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2776788243.00000000011D8000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2914904234.0000017CD7978000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD6757000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2904680065.0000017CD4FAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD677D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: file.exe, 00000000.00000002.2112319814.000000000BD12000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2107233640.0000000000ED6000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2649157391.0000000001027000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2914904234.0000017CD7978000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD6757000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2904680065.0000017CD4FAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD677D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: firefox.exe, 00000020.00000002.2931947413.0000017CD9E8B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD6725000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2929235826.0000017CD9B64000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mo
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5AAF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1238180
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5AAF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1238180Required
Source: file.exe, 00000000.00000003.1863399988.0000000000ED0000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2589952496.000000000573F000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2590072407.0000000005728000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2713287494.00000000058EB000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2713694037.00000000058E9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.1863399988.0000000000ED0000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2589952496.000000000573F000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2590072407.0000000005728000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2713287494.00000000058EB000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2713694037.00000000058E9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.1863399988.0000000000ED0000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2589952496.000000000573F000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2590072407.0000000005728000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2713287494.00000000058EB000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2713694037.00000000058E9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2819165160.0000017CD9477000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2818486632.0000017CD943C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://completion.amazon.com/search/complete?q=
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://content.cdn.mozilla.net
Source: file.exe, 00000000.00000002.2112319814.000000000BD12000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2107233640.0000000000ED6000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2649157391.0000000001027000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2776788243.00000000011D8000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2914904234.0000017CD7978000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD6757000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD6703000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2904680065.0000017CD4FAD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: file.exe, 00000000.00000002.2112319814.000000000BD12000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2107233640.0000000000ED6000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2649157391.0000000001027000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2914904234.0000017CD7978000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD6757000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2904680065.0000017CD4FAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD677D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com/v1/tiles
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://coverage.mozilla.org
Source: firefox.exe, 00000020.00000002.2900114787.0000017CC9811000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2900114787.0000017CC9830000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://crash-reports.mozilla.com/submit?id=
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://crash-stats.mozilla.org/report/index/
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://dap-02.api.divviup.org
Source: firefox.exe, 00000020.00000002.2908012090.0000017CD5912000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2908012090.0000017CD592C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/tabs/captureTab
Source: firefox.exe, 00000020.00000002.2908012090.0000017CD592C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/releasePointerCapture
Source: firefox.exe, 00000020.00000002.2908012090.0000017CD5912000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2908012090.0000017CD592C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/setPointerCapture
Source: firefox.exe, 00000020.00000002.2908012090.0000017CD5912000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2908012090.0000017CD592C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Push_API/Using_the_Push_API#Encryption
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/Add-ons/WebExtensions/manifest.json/commands#Key_combinations
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/Add-ons/WebExtensions/manifest.json/commands#Key_combinationsbro
Source: firefox.exe, 00000020.00000002.2908012090.0000017CD5912000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2908012090.0000017CD592C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsing
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developers.google.com/safe-browsing/v4/advisory
Source: firefox.exe, 00000020.00000002.2914904234.0000017CD7978000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD677D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com
Source: firefox.exe, 00000020.00000002.2916806678.0000017CD8B70000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.2962001308.000033A27A704000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2818869675.0000017CD945A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2817374710.0000017CD9200000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2931947413.0000017CD9E75000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2817893137.0000017CD941F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2819165160.0000017CD9477000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2961160758.00000D1113504000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2961027699.00000C5949A04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2818486632.0000017CD943C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/
Source: firefox.exe, 00000020.00000002.2962001308.000033A27A704000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/Z
Source: file.exe, 00000000.00000003.1863399988.0000000000ED0000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2589952496.000000000573F000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2590072407.0000000005728000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2713287494.00000000058EB000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2713694037.00000000058E9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.1863399988.0000000000ED0000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2589952496.000000000573F000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2590072407.0000000005728000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2713287494.00000000058EB000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2713694037.00000000058E9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.1863399988.0000000000ED0000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2589952496.000000000573F000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2590072407.0000000005728000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2713287494.00000000058EB000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2713694037.00000000058E9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: firefox.exe, 00000020.00000003.2821382400.0000017CD7A33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2823903373.0000017CD7A28000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2914904234.0000017CD79B1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2916219970.0000017CD7A28000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2907178707.0000017CD557D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 00000020.00000002.2914904234.0000017CD79B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%sz
Source: firefox.exe, 00000020.00000002.2914904234.0000017CD79B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%szw
Source: firefox.exe, 00000020.00000003.2821382400.0000017CD7A33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2823903373.0000017CD7A28000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2914904234.0000017CD79B1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2916219970.0000017CD7A28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://email.seznam.cz/newMessageScreen?mailto=%s
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://email.seznam.cz/newMessageScreen?mailto=%sAttempted
Source: firefox.exe, 00000020.00000002.2908012090.0000017CD5912000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2908012090.0000017CD592C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://extensionworkshop.com/documentation/publish/self-distribution/
Source: firefox.exe, 00000020.00000002.2914904234.0000017CD7978000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD6703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-api-proxy.cdn.mozilla.net/
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://firefox-source-docs.mozilla.org/networking/dns/trr-skip-reasons.html#
Source: firefox.exe, 00000020.00000002.2908012090.0000017CD5912000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-source-docs.mozilla.org/performance/scroll-linked_effects.html
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A26000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-source-docs.mozilla.org/remote/Security.html
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.allizom.org/v1/buckets/main-preview/collections/search-config/reco
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/records
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main-preview/collections/search-config/reco
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/search-config/records
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1AIzaSyB2h2OuRcUgy5N-5hsZqiPW6sH3n_rptiQ
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1AIzaSyB2h2OuRcUgy5N-5hsZqiPW6sH3n_rptiQPopulating
Source: firefox.exe, 00000020.00000002.2910130082.0000017CD6757000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2962100177.0000360BFBE04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2900114787.0000017CC988F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fpn.firefox.com
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://fpn.firefox.com/browser?utm_source=firefox-desktop&utm_medium=referral&utm_campaign=about-pr
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://ftp.mozilla.org/pub/labs/devtools/adb-extension/#OS#/adb-extension-latest-#OS#.xpi
Source: firefox.exe, 00000020.00000002.2914904234.0000017CD7978000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD6703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/
Source: firefox.exe, 00000020.00000002.2910130082.0000017CD6703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=
Source: firefox.exe, 00000020.00000002.2910130082.0000017CD6703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_l
Source: firefox.exe, 00000020.00000002.2914904234.0000017CD7978000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD6703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=bas
Source: firefox.exe, 00000020.00000002.2914904234.0000017CD7978000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD6703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=40249-e88c401e1b1f2242d9e4
Source: firefox.exe, 00000020.00000002.2914904234.0000017CD7978000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD6703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/career?utm_source=pocket-newtab
Source: firefox.exe, 00000020.00000002.2914904234.0000017CD7978000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD6703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/entertainment?utm_source=pocket-newtab
Source: firefox.exe, 00000020.00000002.2914904234.0000017CD7978000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD6703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/food?utm_source=pocket-newtab
Source: firefox.exe, 00000020.00000002.2914904234.0000017CD7978000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD6703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/health?utm_source=pocket-newtab
Source: firefox.exe, 00000020.00000002.2914904234.0000017CD7978000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD6703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/science?utm_source=pocket-newtab
Source: firefox.exe, 00000020.00000002.2914904234.0000017CD7978000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD6703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/self-improvement?utm_source=pocket-newtab
Source: firefox.exe, 00000020.00000002.2914904234.0000017CD7978000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD6703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/technology?utm_source=pocket-newtab
Source: firefox.exe, 00000020.00000002.2910130082.0000017CD6703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tab
Source: firefox.exe, 00000020.00000002.2914904234.0000017CD7978000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD6703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore?utm_source=pocket-newtab
Source: firefox.exe, 00000020.00000002.2910130082.0000017CD6703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_more
Source: firefox.exe, 00000020.00000002.2910130082.0000017CD6703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendations
Source: firefox.exe, 00000020.00000002.2913093502.0000017CD6903000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/
Source: firefox.exe, 00000020.00000002.2916806678.0000017CD8B70000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000003.2818869675.0000017CD945A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2817374710.0000017CD9200000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2817893137.0000017CD941F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2819165160.0000017CD9477000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2818486632.0000017CD943C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mozilla-services/screenshots
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mozilla-services/screenshots/shims/google-analytics-ecommerce-plugin.jsasyncEmitM
Source: firefox.exe, 00000020.00000002.2914904234.0000017CD7978000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD677D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://helper1.dap.cloudflareresearch.com/v02
Source: firefox.exe, 00000020.00000002.2900114787.0000017CC9811000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2908457770.0000017CD5A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881No
Source: firefox.exe, 00000020.00000002.2900114787.0000017CC9811000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881w
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://ideas.mozilla.org/
Source: firefox.exe, 00000020.00000002.2910130082.0000017CD677D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: firefox.exe, 00000020.00000002.2906223989.0000017CD50FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org
Source: firefox.exe, 00000020.00000002.2914904234.0000017CD7978000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD6703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submit
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://install.mozilla.org
Source: firefox.exe, 00000020.00000002.2929235826.0000017CD9B64000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com
Source: firefox.exe, 00000020.00000002.2937492782.0000017CDA71D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.2908457770.0000017CD5AE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/v1/country?key=%MOZILLA_API_KEY%
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5AE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/v1/country?key=%MOZILLA_API_KEY%primeBackground/extension.term
Source: firefox.exe, 00000020.00000002.2937492782.0000017CDA71D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/v1/country?key=7e40f68c-7938-4c5d-9f95-e61647c213eb
Source: firefox.exe, 00000020.00000002.2894411295.0000001882C3B000.00000004.00000010.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2949018481.0000017CDC0E4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2951694809.0000017CDCB78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: firefox.exe, 00000020.00000002.2949018481.0000017CDC0E4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2949018481.0000017CDC01C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2951694809.0000017CDCB78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com
Source: firefox.exe, 00000020.00000003.2821382400.0000017CD7A33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD67C8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2913093502.0000017CD6921000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2823903373.0000017CD7A28000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2914904234.0000017CD79B1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2916219970.0000017CD7A28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%s
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%sMicrosoft
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%shttps://outlook.live.com/default.aspx?rru=compose&
Source: firefox.exe, 00000020.00000003.2821382400.0000017CD7A33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2823903373.0000017CD7A28000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2914904234.0000017CD79B1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2916219970.0000017CD7A28000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2907178707.0000017CD557D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.inbox.lv/compose?to=%s
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.inbox.lv/compose?to=%sresource://gre/modules/DeferredTask.sys.mjsresource://gre/modules
Source: firefox.exe, 00000020.00000002.2914904234.0000017CD79B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.inbox.lv/compose?to=%sv
Source: firefox.exe, 00000020.00000003.2821382400.0000017CD7A33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2823903373.0000017CD7A28000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2914904234.0000017CD79B1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2916219970.0000017CD7A28000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2907178707.0000017CD557D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%s
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%sNon-zero
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%shttp://www.inbox.lv/rfc2368/?value=%sresource://gre/modules/U
Source: firefox.exe, 00000020.00000002.2914904234.0000017CD79B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%st
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2900114787.0000017CC98D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://merino.services.mozilla.com/api/v1/suggest
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://mitmdetection.services.mozilla.com/
Source: firefox.exe, 00000020.00000002.2918847879.0000017CD9133000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2908457770.0000017CD5A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/?entrypoint=protection_report_monitor&utm_source=about-protections
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/about
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/breach-details/
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/oauth/init?entrypoint=protection_report_monitor&utm_source=about-protect
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/breach-stats?includeResolved=true
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/dashboard
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/preferences
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://mozilla-ohttp-fakespot.fastly-edge.com/
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://mozilla.cloudflare-dns.com/dns-query
Source: firefox.exe, 00000020.00000002.2960702471.0000041B45E04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mozilla.org/
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mzl.la/3NS9KJd
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://normandy.cdn.mozilla.net/api/v1
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://oauth.accounts.firefox.com/v1
Source: firefox.exe, 00000020.00000003.2821382400.0000017CD7A33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2823903373.0000017CD7A28000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2914904234.0000017CD79B1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2916219970.0000017CD7A28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://outlook.live.com/default.aspx?rru=compose&to=%s
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox&referrer=utm_source%3Dprotection_r
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-
Source: firefox.exe, 00000020.00000003.2821382400.0000017CD7A33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2823903373.0000017CD7A28000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2914904234.0000017CD79B1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2916219970.0000017CD7A28000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2907178707.0000017CD557D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 00000020.00000002.2914904234.0000017CD79B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%sx
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://prod.ohttp-gateway.prod.webservices.mozgcp.net/ohttp-configs
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://profile.accounts.firefox.com/v1
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://profiler.firefox.com
Source: firefox.exe, 00000020.00000002.2914904234.0000017CD7978000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://profiler.firefox.com/
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://profiler.firefox.comFound
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://relay.firefox.com/accounts/profile/?utm_medium=firefox-desktop&utm_source=modal&utm_campaign
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://relay.firefox.com/api/v1/
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/diagnostic?site=
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&p
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/fullHashes:find?$ct=application/x-protobuf&key=%GOOGLE_SAFEBR
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatHits?$ct=application/x-protobuf&key=%GOOGLE_SAFEBROWSIN
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=%GOOGL
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://sb-ssl.google.com/safebrowsing/clientreport/download?key=%GOOGLE_SAFEBROWSING_API_KEY%
Source: firefox.exe, 00000020.00000002.2918847879.0000017CD9133000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2908457770.0000017CD5A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com
Source: firefox.exe, 00000020.00000003.2818486632.0000017CD943C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com/
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com/defineCursorUpdateMethods
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.comError:
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/abuse/report/addon/
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/addon/
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/language-tools/?app=firefox&type=language&appversi
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/discovery/?lang=%LOCALE%&edition=%DISTRIBUTION%
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5AE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://smartblock.firefox.etp/facebook.svg
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5AE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://smartblock.firefox.etp/play.svg
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://snippets.cdn.mozilla.net/%STARTPAGE_VERSION%/%NAME%/%VERSION%/%APPBUILDID%/%BUILD_TARGET%/%L
Source: firefox.exe, 00000020.00000002.2914904234.0000017CD7978000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD6703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/
Source: firefox.exe, 00000020.00000002.2914904234.0000017CD7978000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD6703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/spocs
Source: firefox.exe, 00000020.00000002.2914904234.0000017CD7978000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD6703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/user
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5AE0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2933948328.0000017CDA07C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-js
Source: firefox.exe, 00000020.00000002.2933675468.0000017CD9F03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-pixel
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-pixelhttps://static.adsafeprotected.com/firefox-etp-j
Source: f039f524ee.exe, 0000000F.00000003.2590447061.000000000576E000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2714415572.0000000005945000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.microsof
Source: firefox.exe, 00000020.00000002.2918847879.0000017CD9133000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2908457770.0000017CD5A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org
Source: firefox.exe, 00000020.00000002.2933675468.0000017CD9F17000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/
Source: firefox.exe, 00000020.00000002.2933675468.0000017CD9F17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/Master
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cryptominers-report
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/firefox-relay-integration
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/password-manager-report
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/search-engine-removal
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/send-tab
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/shield
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/social-media-tracking-report
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/tracking-content-report
Source: firefox.exe, 00000020.00000002.2933675468.0000017CD9F17000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2945286285.0000017CDBBA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/118.0.1/WINNT/en-US/
Source: firefox.exe, 00000020.00000002.2933675468.0000017CD9F17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/118.0.1/WINNT/en-US/browser.newtabpage.activity-stream.feeds.s
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5AE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/captive-portal
Source: f039f524ee.exe, 00000011.00000003.2776079766.00000000059C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: firefox.exe, 00000020.00000002.2908012090.0000017CD592C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windows
Source: firefox.exe, 00000020.00000002.2933675468.0000017CD9F17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/website-translation
Source: firefox.exe, 00000020.00000002.2933675468.0000017CD9F17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/website-translationtranslations-panel-settings-always-translate-langu
Source: f039f524ee.exe, 00000011.00000003.2776079766.00000000059C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: file.exe, 00000000.00000003.1990378087.000000000C0AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.orgbookmarksToolbarWasVisiblehttps://monitor.firefox.comnetwork.proxy.backup
Source: file.exe, 00000000.00000002.2107422140.0000000001034000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1850065167.0000000005BDD000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2590447061.000000000576C000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2615864764.0000000005765000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2590570427.0000000005765000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2615626694.0000000005765000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2714885498.00000000058F7000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2714415572.0000000005943000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2741888141.00000000058F7000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2742266532.00000000058F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: f039f524ee.exe, 0000000F.00000003.2590570427.0000000005740000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2714885498.00000000058D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: file.exe, 00000000.00000002.2107422140.0000000001034000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1850065167.0000000005BDD000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2590447061.000000000576C000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2615864764.0000000005765000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2590570427.0000000005765000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2615626694.0000000005765000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2714885498.00000000058F7000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2714415572.0000000005943000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2741888141.00000000058F7000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2742266532.00000000058F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: f039f524ee.exe, 0000000F.00000003.2590570427.0000000005740000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2714885498.00000000058D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://token.services.mozilla.com/1.0/sync/1.5
Source: firefox.exe, 00000020.00000002.2908012090.0000017CD592C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-2
Source: firefox.exe, 00000020.00000002.2908012090.0000017CD592C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-3.1
Source: firefox.exe, 00000020.00000002.2908012090.0000017CD592C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-4
Source: firefox.exe, 00000020.00000002.2908012090.0000017CD592C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc7515#appendix-C)
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://topsites.services.mozilla.com/cid/
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://tracking-protection-issues.herokuapp.com/new
Source: firefox.exe, 00000020.00000002.2918847879.0000017CD9133000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2908457770.0000017CD5A03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2914904234.0000017CD79F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://truecolors.firefox.com
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://truecolors.firefox.comhttps://addons.mozilla.orgpictureinpicture.settingsaccount-connection-
Source: firefox.exe, 00000020.00000002.2914904234.0000017CD7978000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD6757000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD6703000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD677D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://versioncheck.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM_ID
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-%CHANNEL%-browser&utm_campaig
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campaign=about-pr
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://webcompat.com/issues/new
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://webextensions.settings.services.mozilla.com/v1
Source: file.exe, 00000000.00000002.2112319814.000000000BD12000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2107233640.0000000000ED6000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2649157391.0000000001027000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2914904234.0000017CD7978000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD6757000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2904680065.0000017CD4FAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD677D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2819165160.0000017CD9477000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2818486632.0000017CD943C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/moz-extension://e2beb7c2-ef50-4ddd-9210-92a40514d
Source: firefox.exe, 00000020.00000002.2910130082.0000017CD6725000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.de/
Source: file.exe, 00000000.00000003.1863399988.0000000000ED0000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2589952496.000000000573F000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2590072407.0000000005728000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2713287494.00000000058EB000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2713694037.00000000058E9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe, 00000000.00000002.2112319814.000000000BD12000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2107233640.0000000000ED6000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2649157391.0000000001027000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2776788243.00000000011D8000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2914904234.0000017CD7978000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD6757000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2904680065.0000017CD4FAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD677D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2819165160.0000017CD9477000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2818486632.0000017CD943C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/search?client=firefox&q=
Source: file.exe, 00000000.00000003.1863399988.0000000000ED0000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2589952496.000000000573F000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2590072407.0000000005728000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2713287494.00000000058EB000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2713694037.00000000058E9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/policies/privacy/
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2819165160.0000017CD9477000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2818486632.0000017CD943C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/geolocation/v1/geolocate?key=%GOOGLE_LOCATION_SERVICE_API_KEY%
Source: firefox.exe, 00000020.00000002.2910130082.0000017CD679E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2962100177.0000360BFBE04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2900114787.0000017CC988F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2896531875.0000001889D3C000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/about/legal/terms/subscription-services/
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/releasenotes/?utm_source=firefox-browser&utm_medi
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/tour/
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/geolocation/
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/new?reason=manual-update
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/notes
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/set-as-default/thanks/
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/xr/
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/privacy/subscription-services/
Source: file.exe, 00000000.00000002.2107422140.0000000001117000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: f039f524ee.exe, 00000011.00000003.2776079766.00000000059C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: file.exe, 00000000.00000002.2107422140.0000000001117000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/t.exe
Source: file.exe, 00000000.00000002.2107422140.0000000001117000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: f039f524ee.exe, 00000011.00000003.2776079766.00000000059C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: file.exe, 00000000.00000002.2107422140.0000000001117000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: file.exe, 00000000.00000003.1990378087.000000000C0AA000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2648581024.0000000005834000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2776079766.00000000059C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: f039f524ee.exe, 00000011.00000003.2776079766.00000000059C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/android/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/ios/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campa
Source: firefox.exe, 00000020.00000002.2933675468.0000017CD9F17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/new/
Source: firefox.exe, 00000020.00000002.2933675468.0000017CD9F17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/new/resource:///modules/UrlbarPrefs.sys.mjsdelete-browsing-search-do
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#crash-reporter
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#health-report
Source: file.exe, 00000000.00000002.2107422140.0000000001117000.00000040.00000001.01000000.00000003.sdmp, firefox.exe, 00000020.00000002.2904680065.0000017CD4F5F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: firefox.exe, 00000020.00000002.2914904234.0000017CD7978000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD6703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/#suggest-relevant-content
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: file.exe, 00000000.00000003.1990378087.000000000C0AA000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2648581024.0000000005834000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2776079766.00000000059C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: file.exe, 00000000.00000002.2107422140.0000000001117000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/host.exe
Source: firefox.exe, 00000020.00000002.2896531875.0000001889D3C000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.orgo
Source: firefox.exe, 00000020.00000002.2918847879.0000017CD9176000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2894411295.0000001882C3B000.00000004.00000010.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2949018481.0000017CDC0E4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2951694809.0000017CDCB78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5AAF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2908457770.0000017CD5A03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2906223989.0000017CD50B5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.openh264.org/
Source: firefox.exe, 00000020.00000002.2914904234.0000017CD7978000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD6757000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD6703000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD677D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.reddit.com/
Source: firefox.exe, 00000020.00000002.2949018481.0000017CDC0E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.tsn.ca
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.widevine.com/
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.widevine.com/cleanupTemporaryAddons/existing
Source: firefox.exe, 00000020.00000002.2910130082.0000017CD6703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/
Source: firefox.exe, 00000020.00000002.2908012090.0000017CD5912000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2908012090.0000017CD592C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://xhr.spec.whatwg.org/#sync-warning
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5AE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com
Source: firefox.exe, 00000020.00000002.2943062764.0000017CDB3A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/
Source: firefox.exe, 00000020.00000002.2933675468.0000017CD9F17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5AE0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2899835765.0000017CC9630000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd#PlacesToolbarItems
Source: firefox.exe, 0000001E.00000002.2771235389.0000022DFE241000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2797673549.0000029CCDEEF000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2899622099.0000017CC9529000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd--no-default-browser
Source: 18d00389b3.exe, 00000012.00000003.2823899502.00000000017C2000.00000004.00000020.00020000.00000000.sdmp, 18d00389b3.exe, 00000012.00000002.2848331214.00000000017C6000.00000004.00000020.00020000.00000000.sdmp, 18d00389b3.exe, 00000012.00000003.2820838942.00000000017C1000.00000004.00000020.00020000.00000000.sdmp, 18d00389b3.exe, 00000012.00000003.2820621960.00000000017BC000.00000004.00000020.00020000.00000000.sdmp, 18d00389b3.exe, 00000012.00000003.2831596841.00000000017C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdBx
Source: firefox.exe, 00000020.00000002.2902487228.0000017CCB47F000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2902487228.0000017CCB43A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdMOZ_CRASHREPORTER_RE
Source: firefox.exe, 00000020.00000002.2900114787.0000017CC9803000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdg
Source: firefox.exe, 00000020.00000002.2900114787.0000017CC9811000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdhttps://crash-report
Source: firefox.exe, 00000020.00000002.2900114787.0000017CC985D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdx
Source: firefox.exe, 00000020.00000002.2933675468.0000017CD9F17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/accountgWindowsWithUnloadHandlerensureUnloadHandlerRegisteredstrippedUrlToTopPre
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5AE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.comFirefoxViewNotificationManager
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5AE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.comLOAD_FLAGS_FORCE_ALLOW_COOKIES
Source: firefox.exe, 00000020.00000002.2961359117.00000F1AEFE00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.comZ

System Summary

Binary is likely a compiled AutoIt script file

Source: 18d00389b3.exe, 00000012.00000000.2682081483.00000000008E2000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.		memstr_2b9b1b8b-e
Source: 18d00389b3.exe, 00000012.00000000.2682081483.00000000008E2000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer		memstr_8d194914-e

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: BAKFCBFHJD.exe.0.dr	Static PE information: section name:
Source: BAKFCBFHJD.exe.0.dr	Static PE information: section name: .idata
Source: skotes.exe.9.dr	Static PE information: section name:
Source: skotes.exe.9.dr	Static PE information: section name: .idata
Source: random[1].exe.12.dr	Static PE information: section name:
Source: random[1].exe.12.dr	Static PE information: section name: .idata
Source: random[1].exe.12.dr	Static PE information: section name:
Source: a17088d8c7.exe.12.dr	Static PE information: section name:
Source: a17088d8c7.exe.12.dr	Static PE information: section name: .idata
Source: a17088d8c7.exe.12.dr	Static PE information: section name:
Source: random[1].exe0.12.dr	Static PE information: section name:
Source: random[1].exe0.12.dr	Static PE information: section name: .idata
Source: random[1].exe0.12.dr	Static PE information: section name:
Source: f039f524ee.exe.12.dr	Static PE information: section name:
Source: f039f524ee.exe.12.dr	Static PE information: section name: .idata
Source: f039f524ee.exe.12.dr	Static PE information: section name:
Source: random[1].exe1.12.dr	Static PE information: section name:
Source: random[1].exe1.12.dr	Static PE information: section name: .idata
Source: random[1].exe1.12.dr	Static PE information: section name:
Source: f377015f96.exe.12.dr	Static PE information: section name:
Source: f377015f96.exe.12.dr	Static PE information: section name: .idata
Source: f377015f96.exe.12.dr	Static PE information: section name:
Source: random[2].exe0.12.dr	Static PE information: section name:
Source: random[2].exe0.12.dr	Static PE information: section name: .idata
Source: 9f6ad733e2.exe.12.dr	Static PE information: section name:
Source: 9f6ad733e2.exe.12.dr	Static PE information: section name: .idata

Abnormal high CPU Usage

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Process Stats: CPU usage > 49%

Contains functionality to call native functions

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C47ED10 malloc,NtFlushVirtualMemory,memset,memset,memset,memset,memset,memcpy,free,memset,memset,memcpy,memset,memset,memset,memset,memset,	0_2_6C47ED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4BB700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C4BB700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4BB8C0 rand_s,NtQueryVirtualMemory,	0_2_6C4BB8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4BB910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6C4BB910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C45F280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C45F280
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6862C0 PR_dtoa,PR_GetCurrentThread,strlen,NtFlushVirtualMemory,PR_GetCurrentThread,memcpy,memcpy,	0_2_6C6862C0

Creates files inside the system directory

Source: C:\Users\user\Documents\BAKFCBFHJD.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Detected potential crypto function

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4535A0	0_2_6C4535A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C465440	0_2_6C465440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4C545C	0_2_6C4C545C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4CAC00	0_2_6C4CAC00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C495C10	0_2_6C495C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4A2C10	0_2_6C4A2C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4C542B	0_2_6C4C542B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4664C0	0_2_6C4664C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C47D4D0	0_2_6C47D4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C45D4E0	0_2_6C45D4E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C496CF0	0_2_6C496CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C466C80	0_2_6C466C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4B34A0	0_2_6C4B34A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4BC4A0	0_2_6C4BC4A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C46FD00	0_2_6C46FD00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C47ED10	0_2_6C47ED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C480512	0_2_6C480512
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C490DD0	0_2_6C490DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4B85F0	0_2_6C4B85F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4A2E4E	0_2_6C4A2E4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C474640	0_2_6C474640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C479E50	0_2_6C479E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C493E50	0_2_6C493E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4C6E63	0_2_6C4C6E63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C45C670	0_2_6C45C670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4A5600	0_2_6C4A5600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C497E10	0_2_6C497E10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4B9E30	0_2_6C4B9E30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4C76E3	0_2_6C4C76E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C45BEF0	0_2_6C45BEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C46FEF0	0_2_6C46FEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4BE680	0_2_6C4BE680
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C475E90	0_2_6C475E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4B4EA0	0_2_6C4B4EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C469F00	0_2_6C469F00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C497710	0_2_6C497710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C45DFE0	0_2_6C45DFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C486FF0	0_2_6C486FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4A77A0	0_2_6C4A77A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C478850	0_2_6C478850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C47D850	0_2_6C47D850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C49F070	0_2_6C49F070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C467810	0_2_6C467810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C49B820	0_2_6C49B820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4A4820	0_2_6C4A4820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4C50C7	0_2_6C4C50C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C47C0E0	0_2_6C47C0E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4958E0	0_2_6C4958E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4860A0	0_2_6C4860A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C47A940	0_2_6C47A940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C46D960	0_2_6C46D960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4AB970	0_2_6C4AB970
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4CB170	0_2_6C4CB170
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C495190	0_2_6C495190
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4B2990	0_2_6C4B2990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C45C9A0	0_2_6C45C9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C48D9B0	0_2_6C48D9B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C499A60	0_2_6C499A60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C498AC0	0_2_6C498AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C471AF0	0_2_6C471AF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C49E2F0	0_2_6C49E2F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4CBA90	0_2_6C4CBA90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4522A0	0_2_6C4522A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C484AA0	0_2_6C484AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C46CAB0	0_2_6C46CAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4C2AB0	0_2_6C4C2AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C455340	0_2_6C455340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C46C370	0_2_6C46C370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C49D320	0_2_6C49D320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4C53C8	0_2_6C4C53C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C45F380	0_2_6C45F380
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C50AC60	0_2_6C50AC60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5C6C00	0_2_6C5C6C00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5DAC30	0_2_6C5DAC30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C55ECD0	0_2_6C55ECD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4FECC0	0_2_6C4FECC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5CED70	0_2_6C5CED70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C62AD50	0_2_6C62AD50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C688D20	0_2_6C688D20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68CDC0	0_2_6C68CDC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C596D90	0_2_6C596D90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C504DB0	0_2_6C504DB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C59EE70	0_2_6C59EE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E0E20	0_2_6C5E0E20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C50AEC0	0_2_6C50AEC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5A0EC0	0_2_6C5A0EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C586E90	0_2_6C586E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C56EF40	0_2_6C56EF40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5C2F70	0_2_6C5C2F70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C506F10	0_2_6C506F10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C640F20	0_2_6C640F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5DEFF0	0_2_6C5DEFF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C500FE0	0_2_6C500FE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C648FB0	0_2_6C648FB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C50EFB0	0_2_6C50EFB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D4840	0_2_6C5D4840
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C550820	0_2_6C550820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C58A820	0_2_6C58A820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6068E0	0_2_6C6068E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C538960	0_2_6C538960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C556900	0_2_6C556900
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C61C9E0	0_2_6C61C9E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5349F0	0_2_6C5349F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5C09B0	0_2_6C5C09B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5909A0	0_2_6C5909A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5BA9A0	0_2_6C5BA9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C57CA70	0_2_6C57CA70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5AEA00	0_2_6C5AEA00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5B8A30	0_2_6C5B8A30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C57EA80	0_2_6C57EA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C606BE0	0_2_6C606BE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5A0BA0	0_2_6C5A0BA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C518460	0_2_6C518460
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C58A430	0_2_6C58A430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C564420	0_2_6C564420
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5464D0	0_2_6C5464D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C59A4D0	0_2_6C59A4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C62A480	0_2_6C62A480
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C558540	0_2_6C558540
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C604540	0_2_6C604540
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5A0570	0_2_6C5A0570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C648550	0_2_6C648550
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C562560	0_2_6C562560
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C58E5F0	0_2_6C58E5F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5CA5E0	0_2_6C5CA5E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4F45B0	0_2_6C4F45B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C55C650	0_2_6C55C650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5246D0	0_2_6C5246D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C55E6E0	0_2_6C55E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C59E6E0	0_2_6C59E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C580700	0_2_6C580700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C52A7D0	0_2_6C52A7D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C54E070	0_2_6C54E070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5C8010	0_2_6C5C8010
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5CC000	0_2_6C5CC000
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4F8090	0_2_6C4F8090
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5100B0	0_2_6C5100B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5DC0B0	0_2_6C5DC0B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C568140	0_2_6C568140
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C576130	0_2_6C576130
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E4130	0_2_6C5E4130
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5001E0	0_2_6C5001E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C598250	0_2_6C598250
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C588260	0_2_6C588260
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5CA210	0_2_6C5CA210
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D8220	0_2_6C5D8220
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6862C0	0_2_6C6862C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5CE2B0	0_2_6C5CE2B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D22A0	0_2_6C5D22A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C61C360	0_2_6C61C360
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C508340	0_2_6C508340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C642370	0_2_6C642370
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Code function: 9_2_004C7049	9_2_004C7049
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Code function: 9_2_004C8860	9_2_004C8860
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Code function: 9_2_004C78BB	9_2_004C78BB
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Code function: 9_2_00598101	9_2_00598101
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Code function: 9_2_004C31A8	9_2_004C31A8
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Code function: 9_2_00484B30	9_2_00484B30
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Code function: 9_2_004C2D10	9_2_004C2D10
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Code function: 9_2_00484DE0	9_2_00484DE0
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Code function: 9_2_004B7F36	9_2_004B7F36
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Code function: 9_2_004C779B	9_2_004C779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 10_2_00F878BB	10_2_00F878BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 10_2_00F88860	10_2_00F88860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 10_2_00F87049	10_2_00F87049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 10_2_00F831A8	10_2_00F831A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 10_2_00F44B30	10_2_00F44B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 10_2_00F44DE0	10_2_00F44DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 10_2_00F82D10	10_2_00F82D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 10_2_00F8779B	10_2_00F8779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 10_2_00F77F36	10_2_00F77F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 11_2_00F878BB	11_2_00F878BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 11_2_00F88860	11_2_00F88860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 11_2_00F87049	11_2_00F87049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 11_2_00F831A8	11_2_00F831A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 11_2_00F44B30	11_2_00F44B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 11_2_00F44DE0	11_2_00F44DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 11_2_00F82D10	11_2_00F82D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 11_2_00F8779B	11_2_00F8779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 11_2_00F77F36	11_2_00F77F36

Dropped file seen in connection with other malware

Source: Joe Sandbox View

Dropped File: C:\ProgramData\freebl3.dll EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA

Found potential string decryption / allocating functions

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C523620 appears 52 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C6809D0 appears 203 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C529B10 appears 46 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C4994D0 appears 90 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C48CBE8 appears 134 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C68D930 appears 38 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C68DAE0 appears 47 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00F580C0 appears 260 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00F5DF80 appears 36 times
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Code function: String function: 004980C0 appears 130 times

PE file contains executable resources (Code or Archives)

Source: random[1].exe.12.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: a17088d8c7.exe.12.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Sample file is different than original file name gathered from version info

Source: file.exe, 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2116507763.000000006C6D5000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2112319814.000000000BD1A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs file.exe

Uses 32bit PE files

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: ipnqzgkg ZLIB complexity 0.9949173823395884
Source: random[1].exe0.12.dr	Static PE information: Section: ZLIB complexity 0.997627865484429
Source: random[1].exe0.12.dr	Static PE information: Section: xyjapqsh ZLIB complexity 0.9942076156859846
Source: f039f524ee.exe.12.dr	Static PE information: Section: ZLIB complexity 0.997627865484429
Source: f039f524ee.exe.12.dr	Static PE information: Section: xyjapqsh ZLIB complexity 0.9942076156859846
Source: random[1].exe1.12.dr	Static PE information: Section: ipnqzgkg ZLIB complexity 0.9949173823395884
Source: f377015f96.exe.12.dr	Static PE information: Section: ipnqzgkg ZLIB complexity 0.9949173823395884

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@135/49@0/23

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C4B7030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6C4B7030

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\EQMKVR6S.htm

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5664:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3752:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4428:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7724:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3964:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3588:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:980:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5472:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4556:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3192:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3848:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7624:64:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5904:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8148:120:WilError_03

Source: C:\Users\user\Documents\BAKFCBFHJD.exe

File created: C:\Users\user\AppData\Local\Temp\abc3bc1985

Jump to behavior

Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe, 00000000.00000002.2109410050.0000000005CE9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2115820620.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2116362437.000000006C68F000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: file.exe, 00000000.00000002.2109410050.0000000005CE9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2115820620.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2116362437.000000006C68F000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2109410050.0000000005CE9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2115820620.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2116362437.000000006C68F000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2109410050.0000000005CE9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2115820620.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2116362437.000000006C68F000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: file.exe, file.exe, 00000000.00000002.2109410050.0000000005CE9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2115820620.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2116362437.000000006C68F000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2109410050.0000000005CE9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2115820620.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000000.00000002.2109410050.0000000005CE9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2115820620.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2116362437.000000006C68F000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: file.exe, 00000000.00000003.1863137759.0000000005BD5000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2590687838.0000000005720000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2741888141.00000000058B9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2109410050.0000000005CE9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2115820620.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: file.exe, 00000000.00000002.2109410050.0000000005CE9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2115820620.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);

Source: file.exe

ReversingLabs: Detection: 44%

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2588 --field-trial-handle=2076,i,11101187424602966218,1363370709843346949,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\BAKFCBFHJD.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Documents\BAKFCBFHJD.exe "C:\Users\user\Documents\BAKFCBFHJD.exe"
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe "C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe "C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe "C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe "C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe "C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe"
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe "C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe"
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: unknown	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe "C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe"
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2272 -parentBuildID 20230927232528 -prefsHandle 2196 -prefMapHandle 2176 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0e2b88bc-fb1b-4ee6-b399-2d0b61fdaa7d} 7196 "\\.\pipe\gecko-crash-server-pipe.7196" 17cc9869f10 socket
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe "C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe"
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4500 -parentBuildID 20230927232528 -prefsHandle 4492 -prefMapHandle 4488 -prefsLen 26374 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {91de2f66-b71a-414e-a97d-01546071d5ac} 7196 "\\.\pipe\gecko-crash-server-pipe.7196" 17cc987e310 rdd
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe "C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe"
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe "C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe"
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=f039f524ee.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2448 --field-trial-handle=2280,i,510515106440553161,2480043565169282240,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2320 -parentBuildID 20230927232528 -prefsHandle 2264 -prefMapHandle 2260 -prefsLen 25359 -prefMapSize 238769 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2b17f485-0e86-472e-88cf-afe23e104bea} 280 "\\.\pipe\gecko-crash-server-pipe.280" 234f4b6a910 socket
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=f039f524ee.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2084 --field-trial-handle=1932,i,2083666299261817870,13908559142850350553,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe "C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe"
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=f039f524ee.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1956 --field-trial-handle=1860,i,10040747374664479283,16727769951129841397,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=f039f524ee.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\BAKFCBFHJD.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2588 --field-trial-handle=2076,i,11101187424602966218,1363370709843346949,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Documents\BAKFCBFHJD.exe "C:\Users\user\Documents\BAKFCBFHJD.exe"	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe "C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe "C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe "C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe "C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe "C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=f039f524ee.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=f039f524ee.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=f039f524ee.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=f039f524ee.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2272 -parentBuildID 20230927232528 -prefsHandle 2196 -prefMapHandle 2176 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0e2b88bc-fb1b-4ee6-b399-2d0b61fdaa7d} 7196 "\\.\pipe\gecko-crash-server-pipe.7196" 17cc9869f10 socket
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4500 -parentBuildID 20230927232528 -prefsHandle 4492 -prefMapHandle 4488 -prefsLen 26374 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {91de2f66-b71a-414e-a97d-01546071d5ac} 7196 "\\.\pipe\gecko-crash-server-pipe.7196" 17cc987e310 rdd
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2320 -parentBuildID 20230927232528 -prefsHandle 2264 -prefMapHandle 2260 -prefsLen 25359 -prefMapSize 238769 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2b17f485-0e86-472e-88cf-afe23e104bea} 280 "\\.\pipe\gecko-crash-server-pipe.280" 234f4b6a910 socket
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2448 --field-trial-handle=2280,i,510515106440553161,2480043565169282240,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2084 --field-trial-handle=1932,i,2083666299261817870,13908559142850350553,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1956 --field-trial-handle=1860,i,10040747374664479283,16727769951129841397,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: windows.shell.servicehostbuilder.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: ieframe.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: wkscli.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: mlang.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: policymanager.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: msvcp110_win.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: ieframe.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: wkscli.dll
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: windows.shell.servicehostbuilder.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: ieframe.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: wkscli.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: mlang.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: policymanager.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: msvcp110_win.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: ieframe.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: wkscli.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Program Files\Mozilla Firefox\firefox.exe

File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\compatibility.ini

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1799168 > 1048576

Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: file.exe

Static PE information: Raw size of ipnqzgkg is bigger than: 0x100000 < 0x19d000

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2116362437.000000006C68F000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2116362437.000000006C68F000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: f039f524ee.exe, 00000011.00000003.3081089288.0000000008320000.00000004.00001000.00020000.00000000.sdmp, 9f6ad733e2.exe, 00000021.00000003.2802037515.0000000005190000.00000004.00001000.00020000.00000000.sdmp, 9f6ad733e2.exe, 00000021.00000002.2937994456.0000000000EF2000.00000040.00000001.01000000.00000014.sdmp
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.fb0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ipnqzgkg:EW;equqovlh:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;ipnqzgkg:EW;equqovlh:EW;.taggant:EW;
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Unpacked PE file: 9.2.BAKFCBFHJD.exe.480000.0.unpack :EW;.rsrc:W;.idata :W;nnwaoodm:EW;ocwkoyql:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;nnwaoodm:EW;ocwkoyql:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 10.2.skotes.exe.f40000.0.unpack :EW;.rsrc:W;.idata :W;nnwaoodm:EW;ocwkoyql:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;nnwaoodm:EW;ocwkoyql:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 11.2.skotes.exe.f40000.0.unpack :EW;.rsrc:W;.idata :W;nnwaoodm:EW;ocwkoyql:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;nnwaoodm:EW;ocwkoyql:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Unpacked PE file: 16.2.f377015f96.exe.db0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ipnqzgkg:EW;equqovlh:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;ipnqzgkg:EW;equqovlh:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Unpacked PE file: 25.2.f377015f96.exe.db0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ipnqzgkg:EW;equqovlh:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;ipnqzgkg:EW;equqovlh:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Unpacked PE file: 33.2.9f6ad733e2.exe.ef0000.0.unpack :EW;.rsrc:W;.idata :W;cdtvwakf:EW;qjmihuav:EW;.taggant:EW; vs :ER;.rsrc:W;
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Unpacked PE file: 49.2.f377015f96.exe.db0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ipnqzgkg:EW;equqovlh:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;ipnqzgkg:EW;equqovlh:EW;.taggant:EW;

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C4BC410 LoadLibraryW,GetProcAddress,FreeLibrary,

0_2_6C4BC410

Entry point lies outside standard sections

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

PE file contains an invalid checksum

Source: random[1].exe.12.dr	Static PE information: real checksum: 0x1eebf3 should be: 0x1f2626
Source: a17088d8c7.exe.12.dr	Static PE information: real checksum: 0x1eebf3 should be: 0x1f2626
Source: random[1].exe.0.dr	Static PE information: real checksum: 0x31c073 should be: 0x31a034
Source: 9f6ad733e2.exe.12.dr	Static PE information: real checksum: 0x2cb988 should be: 0x2ccccb
Source: BAKFCBFHJD.exe.0.dr	Static PE information: real checksum: 0x31c073 should be: 0x31a034
Source: f377015f96.exe.12.dr	Static PE information: real checksum: 0x1bd78b should be: 0x1bf97a
Source: f039f524ee.exe.12.dr	Static PE information: real checksum: 0x1de5a6 should be: 0x1de476
Source: random[2].exe0.12.dr	Static PE information: real checksum: 0x2cb988 should be: 0x2ccccb
Source: random[1].exe0.12.dr	Static PE information: real checksum: 0x1de5a6 should be: 0x1de476
Source: random[1].exe1.12.dr	Static PE information: real checksum: 0x1bd78b should be: 0x1bf97a
Source: file.exe	Static PE information: real checksum: 0x1bd78b should be: 0x1bf97a
Source: skotes.exe.9.dr	Static PE information: real checksum: 0x31c073 should be: 0x31a034

PE file contains sections with non-standard names

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: ipnqzgkg
Source: file.exe	Static PE information: section name: equqovlh
Source: file.exe	Static PE information: section name: .taggant
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name: nnwaoodm
Source: random[1].exe.0.dr	Static PE information: section name: ocwkoyql
Source: random[1].exe.0.dr	Static PE information: section name: .taggant
Source: BAKFCBFHJD.exe.0.dr	Static PE information: section name:
Source: BAKFCBFHJD.exe.0.dr	Static PE information: section name: .idata
Source: BAKFCBFHJD.exe.0.dr	Static PE information: section name: nnwaoodm
Source: BAKFCBFHJD.exe.0.dr	Static PE information: section name: ocwkoyql
Source: BAKFCBFHJD.exe.0.dr	Static PE information: section name: .taggant
Source: skotes.exe.9.dr	Static PE information: section name:
Source: skotes.exe.9.dr	Static PE information: section name: .idata
Source: skotes.exe.9.dr	Static PE information: section name: nnwaoodm
Source: skotes.exe.9.dr	Static PE information: section name: ocwkoyql
Source: skotes.exe.9.dr	Static PE information: section name: .taggant
Source: random[1].exe.12.dr	Static PE information: section name:
Source: random[1].exe.12.dr	Static PE information: section name: .idata
Source: random[1].exe.12.dr	Static PE information: section name:
Source: random[1].exe.12.dr	Static PE information: section name: mkxflzam
Source: random[1].exe.12.dr	Static PE information: section name: ntycqcrd
Source: random[1].exe.12.dr	Static PE information: section name: .taggant
Source: a17088d8c7.exe.12.dr	Static PE information: section name:
Source: a17088d8c7.exe.12.dr	Static PE information: section name: .idata
Source: a17088d8c7.exe.12.dr	Static PE information: section name:
Source: a17088d8c7.exe.12.dr	Static PE information: section name: mkxflzam
Source: a17088d8c7.exe.12.dr	Static PE information: section name: ntycqcrd
Source: a17088d8c7.exe.12.dr	Static PE information: section name: .taggant
Source: random[1].exe0.12.dr	Static PE information: section name:
Source: random[1].exe0.12.dr	Static PE information: section name: .idata
Source: random[1].exe0.12.dr	Static PE information: section name:
Source: random[1].exe0.12.dr	Static PE information: section name: xyjapqsh
Source: random[1].exe0.12.dr	Static PE information: section name: fjnsenoe
Source: random[1].exe0.12.dr	Static PE information: section name: .taggant
Source: f039f524ee.exe.12.dr	Static PE information: section name:
Source: f039f524ee.exe.12.dr	Static PE information: section name: .idata
Source: f039f524ee.exe.12.dr	Static PE information: section name:
Source: f039f524ee.exe.12.dr	Static PE information: section name: xyjapqsh
Source: f039f524ee.exe.12.dr	Static PE information: section name: fjnsenoe
Source: f039f524ee.exe.12.dr	Static PE information: section name: .taggant
Source: random[1].exe1.12.dr	Static PE information: section name:
Source: random[1].exe1.12.dr	Static PE information: section name: .idata
Source: random[1].exe1.12.dr	Static PE information: section name:
Source: random[1].exe1.12.dr	Static PE information: section name: ipnqzgkg
Source: random[1].exe1.12.dr	Static PE information: section name: equqovlh
Source: random[1].exe1.12.dr	Static PE information: section name: .taggant
Source: f377015f96.exe.12.dr	Static PE information: section name:
Source: f377015f96.exe.12.dr	Static PE information: section name: .idata
Source: f377015f96.exe.12.dr	Static PE information: section name:
Source: f377015f96.exe.12.dr	Static PE information: section name: ipnqzgkg
Source: f377015f96.exe.12.dr	Static PE information: section name: equqovlh
Source: f377015f96.exe.12.dr	Static PE information: section name: .taggant
Source: random[2].exe0.12.dr	Static PE information: section name:
Source: random[2].exe0.12.dr	Static PE information: section name: .idata
Source: random[2].exe0.12.dr	Static PE information: section name: cdtvwakf
Source: random[2].exe0.12.dr	Static PE information: section name: qjmihuav
Source: random[2].exe0.12.dr	Static PE information: section name: .taggant
Source: 9f6ad733e2.exe.12.dr	Static PE information: section name:
Source: 9f6ad733e2.exe.12.dr	Static PE information: section name: .idata
Source: 9f6ad733e2.exe.12.dr	Static PE information: section name: cdtvwakf
Source: 9f6ad733e2.exe.12.dr	Static PE information: section name: qjmihuav
Source: 9f6ad733e2.exe.12.dr	Static PE information: section name: .taggant

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C48B536 push ecx; ret	0_2_6C48B549
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Code function: 9_2_0049D91C push ecx; ret	9_2_0049D92F
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Code function: 9_2_00491359 push es; ret	9_2_0049135A
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 10_2_00F5D91C push ecx; ret	10_2_00F5D92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 11_2_00F5D91C push ecx; ret	11_2_00F5D92F

Source: file.exe	Static PE information: section name: ipnqzgkg entropy: 7.954190185075461
Source: random[1].exe.0.dr	Static PE information: section name: entropy: 7.067745136702224
Source: BAKFCBFHJD.exe.0.dr	Static PE information: section name: entropy: 7.067745136702224
Source: skotes.exe.9.dr	Static PE information: section name: entropy: 7.067745136702224
Source: random[1].exe.12.dr	Static PE information: section name: mkxflzam entropy: 7.941774290386521
Source: a17088d8c7.exe.12.dr	Static PE information: section name: mkxflzam entropy: 7.941774290386521
Source: random[1].exe0.12.dr	Static PE information: section name: entropy: 7.97823310420282
Source: random[1].exe0.12.dr	Static PE information: section name: xyjapqsh entropy: 7.953197683807969
Source: f039f524ee.exe.12.dr	Static PE information: section name: entropy: 7.97823310420282
Source: f039f524ee.exe.12.dr	Static PE information: section name: xyjapqsh entropy: 7.953197683807969
Source: random[1].exe1.12.dr	Static PE information: section name: ipnqzgkg entropy: 7.954190185075461
Source: f377015f96.exe.12.dr	Static PE information: section name: ipnqzgkg entropy: 7.954190185075461
Source: random[2].exe0.12.dr	Static PE information: section name: entropy: 7.79776762494654
Source: 9f6ad733e2.exe.12.dr	Static PE information: section name: entropy: 7.79776762494654

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\Documents\BAKFCBFHJD.exe

Jump to dropped file

Drops PE files

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[2].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Jump to dropped file
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\Documents\BAKFCBFHJD.exe	Jump to dropped file

Drops PE files to the application program directory (C:\ProgramData)

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Creates multiple autostart registry keys

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 18d00389b3.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run f039f524ee.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run f377015f96.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 9f6ad733e2.exe	Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Creates job files (autostart)

Source: C:\Users\user\Documents\BAKFCBFHJD.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run f039f524ee.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run f039f524ee.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run f377015f96.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run f377015f96.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 18d00389b3.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 18d00389b3.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 9f6ad733e2.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 9f6ad733e2.exe	Jump to behavior

Extensive use of GetProcAddress (often used to hide API calls)

Source: C:\Users\user\Desktop\file.exe

0_2_6C4B55F0

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	System information queried: FirmwareTableInformation
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	System information queried: FirmwareTableInformation
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	System information queried: FirmwareTableInformation
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	System information queried: FirmwareTableInformation

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1383678 second address: 138367C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138367C second address: 1383684 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1383684 second address: 138369A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F06B90E9DDCh 0x00000009 jne 00007F06B90E9DD6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138369A second address: 13836DE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F06B852D3C8h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edi 0x0000000c jg 00007F06B852D3B6h 0x00000012 pop edi 0x00000013 pop edx 0x00000014 pop eax 0x00000015 push eax 0x00000016 push edx 0x00000017 jns 00007F06B852D3BCh 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007F06B852D3BCh 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13836DE second address: 13836F8 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F06B90E9DD6h 0x00000008 jmp 00007F06B90E9DE0h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13836F8 second address: 13836FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138383D second address: 138384D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jl 00007F06B90E9DDEh 0x0000000c push eax 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1383B59 second address: 1383B5F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1383B5F second address: 1383B6D instructions: 0x00000000 rdtsc 0x00000002 jne 00007F06B90E9DD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1385F46 second address: 1385F4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1385F4A second address: 1385F60 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F06B90E9DD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e ja 00007F06B90E9DD8h 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1385F60 second address: 1385F65 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1385F65 second address: 1385F7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b push eax 0x0000000c push edx 0x0000000d jo 00007F06B90E9DD8h 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1385F7A second address: 1385F9A instructions: 0x00000000 rdtsc 0x00000002 jns 00007F06B852D3C0h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [eax] 0x0000000c push eax 0x0000000d push edx 0x0000000e js 00007F06B852D3BCh 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1385F9A second address: 1385F9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1385F9E second address: 1385FA4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1386028 second address: 1386073 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c jmp 00007F06B90E9DE0h 0x00000011 mov eax, dword ptr [eax] 0x00000013 push edi 0x00000014 jnl 00007F06B90E9DD8h 0x0000001a pop edi 0x0000001b mov dword ptr [esp+04h], eax 0x0000001f jnp 00007F06B90E9E04h 0x00000025 push eax 0x00000026 push edx 0x00000027 jmp 00007F06B90E9DE7h 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1386073 second address: 1386104 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B852D3C1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a mov esi, dword ptr [ebp+122D3A6Fh] 0x00000010 jmp 00007F06B852D3C8h 0x00000015 push 00000003h 0x00000017 push 00000000h 0x00000019 push esi 0x0000001a call 00007F06B852D3B8h 0x0000001f pop esi 0x00000020 mov dword ptr [esp+04h], esi 0x00000024 add dword ptr [esp+04h], 0000001Bh 0x0000002c inc esi 0x0000002d push esi 0x0000002e ret 0x0000002f pop esi 0x00000030 ret 0x00000031 push 00000000h 0x00000033 mov dword ptr [ebp+122D21ABh], ebx 0x00000039 push 00000003h 0x0000003b xor esi, dword ptr [ebp+122D39B3h] 0x00000041 or edx, 3201D4B3h 0x00000047 push 85D03809h 0x0000004c push eax 0x0000004d push edx 0x0000004e push ecx 0x0000004f jmp 00007F06B852D3C9h 0x00000054 pop ecx 0x00000055 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1386104 second address: 1386143 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F06B90E9DDCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xor dword ptr [esp], 45D03809h 0x00000011 jl 00007F06B90E9DD7h 0x00000017 lea ebx, dword ptr [ebp+12459E99h] 0x0000001d jng 00007F06B90E9DDCh 0x00000023 push eax 0x00000024 jns 00007F06B90E9DE2h 0x0000002a jnp 00007F06B90E9DDCh 0x00000030 push eax 0x00000031 push edx 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138619D second address: 13861A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13861A1 second address: 13861AB instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F06B90E9DD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13861AB second address: 1386256 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F06B852D3CFh 0x00000008 jmp 00007F06B852D3C9h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f nop 0x00000010 jnl 00007F06B852D3CEh 0x00000016 push 00000000h 0x00000018 xor ecx, dword ptr [ebp+122D2580h] 0x0000001e push 5C6D8844h 0x00000023 jng 00007F06B852D3BCh 0x00000029 pushad 0x0000002a push edx 0x0000002b pop edx 0x0000002c push eax 0x0000002d pop eax 0x0000002e popad 0x0000002f xor dword ptr [esp], 5C6D88C4h 0x00000036 mov edx, 57C5A234h 0x0000003b push 00000003h 0x0000003d jmp 00007F06B852D3BBh 0x00000042 push 00000000h 0x00000044 push eax 0x00000045 mov esi, ebx 0x00000047 pop esi 0x00000048 call 00007F06B852D3C2h 0x0000004d mov si, E982h 0x00000051 pop esi 0x00000052 push 00000003h 0x00000054 or esi, 3EF67F8Ah 0x0000005a call 00007F06B852D3B9h 0x0000005f pushad 0x00000060 push eax 0x00000061 push edx 0x00000062 jns 00007F06B852D3B6h 0x00000068 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1386256 second address: 1386276 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F06B90E9DDEh 0x0000000b popad 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push ecx 0x00000010 jo 00007F06B90E9DD6h 0x00000016 pop ecx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1386276 second address: 138631F instructions: 0x00000000 rdtsc 0x00000002 jno 00007F06B852D3CAh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e jmp 00007F06B852D3C8h 0x00000013 mov eax, dword ptr [eax] 0x00000015 push edx 0x00000016 jmp 00007F06B852D3BBh 0x0000001b pop edx 0x0000001c mov dword ptr [esp+04h], eax 0x00000020 jmp 00007F06B852D3C8h 0x00000025 pop eax 0x00000026 adc edx, 140D7800h 0x0000002c lea ebx, dword ptr [ebp+12459EA2h] 0x00000032 push 00000000h 0x00000034 push esi 0x00000035 call 00007F06B852D3B8h 0x0000003a pop esi 0x0000003b mov dword ptr [esp+04h], esi 0x0000003f add dword ptr [esp+04h], 00000019h 0x00000047 inc esi 0x00000048 push esi 0x00000049 ret 0x0000004a pop esi 0x0000004b ret 0x0000004c and cx, A046h 0x00000051 xchg eax, ebx 0x00000052 push eax 0x00000053 push edx 0x00000054 pushad 0x00000055 jbe 00007F06B852D3B6h 0x0000005b jbe 00007F06B852D3B6h 0x00000061 popad 0x00000062 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1397C0E second address: 1397C2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 jmp 00007F06B90E9DE5h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1397C2B second address: 1397C45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F06B852D3C0h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137284F second address: 1372855 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A44C1 second address: 13A44D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F06B852D3B6h 0x0000000a jc 00007F06B852D3B6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A44D1 second address: 13A450F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F06B90E9DE1h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jp 00007F06B90E9DDCh 0x00000011 pop edx 0x00000012 pop eax 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 push esi 0x00000017 pop esi 0x00000018 push ebx 0x00000019 pop ebx 0x0000001a jmp 00007F06B90E9DE1h 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A4659 second address: 13A465F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A4A78 second address: 13A4A88 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push edi 0x00000004 pop edi 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 pop ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a jnp 00007F06B90E9DD6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A4D03 second address: 13A4D0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F06B852D3B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A4D0D second address: 13A4D34 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 js 00007F06B90E9DEFh 0x0000000e jmp 00007F06B90E9DE9h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A5149 second address: 13A5167 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F06B852D3C7h 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A5167 second address: 13A5182 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B90E9DE1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A5182 second address: 13A5190 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnp 00007F06B852D3B6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A5190 second address: 13A5194 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A5194 second address: 13A51A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F06B852D3B6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1374288 second address: 13742A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007F06B90E9DE3h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13742A5 second address: 13742A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A559E second address: 13A55AA instructions: 0x00000000 rdtsc 0x00000002 jc 00007F06B90E9DD6h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A5C97 second address: 13A5C9D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A5C9D second address: 13A5CA4 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A5E20 second address: 13A5E36 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B852D3BFh 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A5F99 second address: 13A5FB0 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F06B90E9DD6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f jne 00007F06B90E9DD6h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A63DA second address: 13A63DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13AACD1 second address: 13AACD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13AACD5 second address: 13AACFB instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jc 00007F06B852D3B6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edi 0x0000000d jmp 00007F06B852D3C2h 0x00000012 pop edi 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13AACFB second address: 13AACFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13AACFF second address: 13AAD03 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13AAD03 second address: 13AAD15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jg 00007F06B90E9DD6h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13AAD15 second address: 13AAD19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13AAD19 second address: 13AAD1D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13AAD1D second address: 13AAD23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13AAD23 second address: 13AAD29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13AAD29 second address: 13AAD2F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13AAD2F second address: 13AAD33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137E3CE second address: 137E3D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137E3D2 second address: 137E3DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137E3DC second address: 137E3E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137E3E0 second address: 137E3EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F06B90E9DD6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13AD469 second address: 13AD483 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B852D3BFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13AD483 second address: 13AD489 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13AD489 second address: 13AD48F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B11F5 second address: 13B120F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push esi 0x00000006 push eax 0x00000007 pop eax 0x00000008 pushad 0x00000009 popad 0x0000000a pop esi 0x0000000b pop edi 0x0000000c push eax 0x0000000d push edx 0x0000000e jne 00007F06B90E9DDCh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B065D second address: 13B0671 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push ebx 0x00000006 jmp 00007F06B852D3BCh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B0807 second address: 13B0812 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F06B90E9DD6h 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B0959 second address: 13B095D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B0DD4 second address: 13B0DD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B0DD9 second address: 13B0DDE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B0DDE second address: 13B0DEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F06B90E9DD6h 0x0000000a push edi 0x0000000b pop edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B0DEC second address: 13B0E05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F06B852D3C1h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B0E05 second address: 13B0E0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B395B second address: 13B395F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1375CB4 second address: 1375CBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F06B90E9DD6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B5B67 second address: 13B5B6B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B5D69 second address: 13B5D73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B6214 second address: 13B6248 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 mov dword ptr [esp], ebx 0x00000009 push 00000000h 0x0000000b push ecx 0x0000000c call 00007F06B852D3B8h 0x00000011 pop ecx 0x00000012 mov dword ptr [esp+04h], ecx 0x00000016 add dword ptr [esp+04h], 00000018h 0x0000001e inc ecx 0x0000001f push ecx 0x00000020 ret 0x00000021 pop ecx 0x00000022 ret 0x00000023 nop 0x00000024 push eax 0x00000025 push edx 0x00000026 jc 00007F06B852D3BCh 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B6248 second address: 13B624C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B624C second address: 13B626D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B852D3C8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push ecx 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B6716 second address: 13B671C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B671C second address: 13B6733 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 jo 00007F06B852D3BCh 0x0000000e jc 00007F06B852D3B6h 0x00000014 push esi 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B67D5 second address: 13B67DF instructions: 0x00000000 rdtsc 0x00000002 jp 00007F06B90E9DD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B67DF second address: 13B67E4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B769C second address: 13B771F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B90E9DDBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push ebx 0x0000000e call 00007F06B90E9DD8h 0x00000013 pop ebx 0x00000014 mov dword ptr [esp+04h], ebx 0x00000018 add dword ptr [esp+04h], 0000001Bh 0x00000020 inc ebx 0x00000021 push ebx 0x00000022 ret 0x00000023 pop ebx 0x00000024 ret 0x00000025 jnl 00007F06B90E9DDCh 0x0000002b jbe 00007F06B90E9DD6h 0x00000031 push edx 0x00000032 add dword ptr [ebp+122D29FAh], eax 0x00000038 pop esi 0x00000039 push 00000000h 0x0000003b push 00000000h 0x0000003d push edx 0x0000003e call 00007F06B90E9DD8h 0x00000043 pop edx 0x00000044 mov dword ptr [esp+04h], edx 0x00000048 add dword ptr [esp+04h], 00000016h 0x00000050 inc edx 0x00000051 push edx 0x00000052 ret 0x00000053 pop edx 0x00000054 ret 0x00000055 or esi, 5BD013E9h 0x0000005b push 00000000h 0x0000005d mov dword ptr [ebp+122D2271h], edx 0x00000063 push eax 0x00000064 push eax 0x00000065 push edx 0x00000066 push eax 0x00000067 push edx 0x00000068 push eax 0x00000069 push edx 0x0000006a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B771F second address: 13B7723 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B7723 second address: 13B7729 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BA6CF second address: 13BA6DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F06B852D3BBh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BB0D8 second address: 13BB0DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BB174 second address: 13BB178 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BB178 second address: 13BB1C2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B90E9DE0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jo 00007F06B90E9DD6h 0x00000010 jmp 00007F06B90E9DE3h 0x00000015 popad 0x00000016 popad 0x00000017 push eax 0x00000018 pushad 0x00000019 pushad 0x0000001a jmp 00007F06B90E9DE1h 0x0000001f pushad 0x00000020 popad 0x00000021 popad 0x00000022 pushad 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BBC75 second address: 13BBC87 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B852D3BEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BC77B second address: 13BC782 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BC4B1 second address: 13BC4B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BC4B5 second address: 13BC4BF instructions: 0x00000000 rdtsc 0x00000002 jo 00007F06B90E9DD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BF938 second address: 13BF99A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F06B852D3C7h 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e push eax 0x0000000f mov edi, eax 0x00000011 pop edi 0x00000012 push 00000000h 0x00000014 pushad 0x00000015 push edx 0x00000016 mov dword ptr [ebp+122D33BEh], ecx 0x0000001c pop ecx 0x0000001d sub dword ptr [ebp+122D2AD8h], edx 0x00000023 popad 0x00000024 push 00000000h 0x00000026 mov dword ptr [ebp+122D29D9h], esi 0x0000002c mov di, 2C81h 0x00000030 xchg eax, esi 0x00000031 ja 00007F06B852D3C4h 0x00000037 push eax 0x00000038 jo 00007F06B852D3C4h 0x0000003e push eax 0x0000003f push edx 0x00000040 push ebx 0x00000041 pop ebx 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C597D second address: 13C5981 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C6AE3 second address: 13C6B45 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d jmp 00007F06B852D3BDh 0x00000012 push 00000000h 0x00000014 mov edi, 77A0BB0Eh 0x00000019 push 00000000h 0x0000001b push 00000000h 0x0000001d push ebp 0x0000001e call 00007F06B852D3B8h 0x00000023 pop ebp 0x00000024 mov dword ptr [esp+04h], ebp 0x00000028 add dword ptr [esp+04h], 0000001Bh 0x00000030 inc ebp 0x00000031 push ebp 0x00000032 ret 0x00000033 pop ebp 0x00000034 ret 0x00000035 jp 00007F06B852D3B9h 0x0000003b jnl 00007F06B852D3BCh 0x00000041 push eax 0x00000042 push eax 0x00000043 push edx 0x00000044 push eax 0x00000045 push edx 0x00000046 push eax 0x00000047 pop eax 0x00000048 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C0AE7 second address: 13C0AEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C1AA7 second address: 13C1AAB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C6B45 second address: 13C6B49 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C2B66 second address: 13C2B6A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C0AEB second address: 13C0B10 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 pushad 0x00000009 jmp 00007F06B90E9DE9h 0x0000000e push ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C1AAB second address: 13C1AB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a pushad 0x0000000b popad 0x0000000c pop ebx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C6B49 second address: 13C6B4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C2B6A second address: 13C2B70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C0BB1 second address: 13C0BB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C7BBE second address: 13C7BDD instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jo 00007F06B852D3B6h 0x0000000d ja 00007F06B852D3B6h 0x00000013 popad 0x00000014 popad 0x00000015 push eax 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 jl 00007F06B852D3B6h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C7BDD second address: 13C7BF6 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F06B90E9DD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F06B90E9DDDh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C6DBE second address: 13C6DC3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C8B05 second address: 13C8B5D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push edx 0x0000000a call 00007F06B90E9DD8h 0x0000000f pop edx 0x00000010 mov dword ptr [esp+04h], edx 0x00000014 add dword ptr [esp+04h], 00000016h 0x0000001c inc edx 0x0000001d push edx 0x0000001e ret 0x0000001f pop edx 0x00000020 ret 0x00000021 jmp 00007F06B90E9DDFh 0x00000026 push 00000000h 0x00000028 movzx ebx, si 0x0000002b add ebx, 5BD01066h 0x00000031 push 00000000h 0x00000033 sbb ebx, 30780C84h 0x00000039 push eax 0x0000003a push eax 0x0000003b push edx 0x0000003c pushad 0x0000003d ja 00007F06B90E9DD6h 0x00000043 jne 00007F06B90E9DD6h 0x00000049 popad 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C8B5D second address: 13C8B7B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F06B852D3C9h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CAB5C second address: 13CAB62 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CAB62 second address: 13CAB66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CBC78 second address: 13CBD1E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F06B90E9DDCh 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e ja 00007F06B90E9DEFh 0x00000014 push 00000000h 0x00000016 push 00000000h 0x00000018 push edi 0x00000019 call 00007F06B90E9DD8h 0x0000001e pop edi 0x0000001f mov dword ptr [esp+04h], edi 0x00000023 add dword ptr [esp+04h], 0000001Dh 0x0000002b inc edi 0x0000002c push edi 0x0000002d ret 0x0000002e pop edi 0x0000002f ret 0x00000030 mov bx, dx 0x00000033 push 00000000h 0x00000035 push 00000000h 0x00000037 push ebx 0x00000038 call 00007F06B90E9DD8h 0x0000003d pop ebx 0x0000003e mov dword ptr [esp+04h], ebx 0x00000042 add dword ptr [esp+04h], 00000014h 0x0000004a inc ebx 0x0000004b push ebx 0x0000004c ret 0x0000004d pop ebx 0x0000004e ret 0x0000004f mov ebx, dword ptr [ebp+122D180Ah] 0x00000055 xchg eax, esi 0x00000056 push eax 0x00000057 push edx 0x00000058 pushad 0x00000059 jmp 00007F06B90E9DE9h 0x0000005e ja 00007F06B90E9DD6h 0x00000064 popad 0x00000065 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CBD1E second address: 13CBD31 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F06B852D3BFh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CBD31 second address: 13CBD35 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CBD35 second address: 13CBD44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push ebx 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C9DFE second address: 13C9E04 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C9E04 second address: 13C9E0E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F06B852D3B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CCCAF second address: 13CCD25 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B90E9DDBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a mov edi, dword ptr [ebp+122D2203h] 0x00000010 push 00000000h 0x00000012 mov edi, dword ptr [ebp+122D3AABh] 0x00000018 push 00000000h 0x0000001a push 00000000h 0x0000001c push edx 0x0000001d call 00007F06B90E9DD8h 0x00000022 pop edx 0x00000023 mov dword ptr [esp+04h], edx 0x00000027 add dword ptr [esp+04h], 00000015h 0x0000002f inc edx 0x00000030 push edx 0x00000031 ret 0x00000032 pop edx 0x00000033 ret 0x00000034 jg 00007F06B90E9DDCh 0x0000003a xchg eax, esi 0x0000003b pushad 0x0000003c jmp 00007F06B90E9DE0h 0x00000041 push eax 0x00000042 push edx 0x00000043 jmp 00007F06B90E9DE9h 0x00000048 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CF360 second address: 13CF37E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F06B852D3C9h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CF37E second address: 13CF390 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push esi 0x0000000b jc 00007F06B90E9DD6h 0x00000011 pop esi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CF390 second address: 13CF396 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CF396 second address: 13CF39A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D0553 second address: 13D0557 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D9F40 second address: 13D9F46 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D9F46 second address: 13D9F4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D9F4A second address: 13D9F54 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D9F54 second address: 13D9F5A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D9A8E second address: 13D9AA4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F06B90E9DDCh 0x0000000d push edi 0x0000000e pop edi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D9AA4 second address: 13D9ABA instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F06B852D3BAh 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D9ABA second address: 13D9AF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F06B90E9DE3h 0x00000009 pushad 0x0000000a popad 0x0000000b push edx 0x0000000c pop edx 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F06B90E9DE8h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D9AF0 second address: 13D9AFA instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F06B852D3B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D9AFA second address: 13D9B15 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F06B90E9DEDh 0x00000008 jmp 00007F06B90E9DE1h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DCF18 second address: 13DCF22 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F06B852D3B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DCF22 second address: 13DCF40 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B90E9DE3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d pushad 0x0000000e popad 0x0000000f pop ecx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DCF40 second address: 13DCF45 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DCF45 second address: 13DCF58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DCF58 second address: 13DCF5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DCF5C second address: 13DCF78 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B90E9DE8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DCF78 second address: 13DCF8B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F06B852D3BFh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DCF8B second address: 13DCF9E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a jns 00007F06B90E9DDEh 0x00000010 push edi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DCF9E second address: 13DCFB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 mov dword ptr [esp+04h], eax 0x00000009 pushad 0x0000000a jmp 00007F06B852D3BDh 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DCFB8 second address: 13DCFBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DD07F second address: 13DD083 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DD083 second address: 13DD092 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E3BF0 second address: 13E3BFA instructions: 0x00000000 rdtsc 0x00000002 je 00007F06B852D3BCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136D78E second address: 136D793 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136D793 second address: 136D7B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F06B852D3C3h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 ja 00007F06B852D3B6h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E28AC second address: 13E28B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E28B0 second address: 13E28C1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B852D3BDh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E28C1 second address: 13E28D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jns 00007F06B90E9DD6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E28D1 second address: 13E28D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E28D5 second address: 13E28EC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B90E9DE3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E3029 second address: 13E3033 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E3033 second address: 13E303A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E303A second address: 13E3060 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007F06B852D3BEh 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F06B852D3BCh 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E3060 second address: 13E306E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 ja 00007F06B90E9DDCh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E306E second address: 13E3072 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E3072 second address: 13E3077 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E31C5 second address: 13E31D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 ja 00007F06B852D3BCh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E31D4 second address: 13E31DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E31DE second address: 13E31E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E31E2 second address: 13E31E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E3330 second address: 13E3334 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E3334 second address: 13E333A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E34BF second address: 13E34C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E34C3 second address: 13E34F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F06B90E9DE8h 0x0000000b pop esi 0x0000000c push edi 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F06B90E9DDFh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E9160 second address: 13E9166 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E7F7A second address: 13E7F91 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F06B90E9DE2h 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E80E2 second address: 13E80E7 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E80E7 second address: 13E8111 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F06B90E9DD6h 0x0000000a pop ebx 0x0000000b pushad 0x0000000c jmp 00007F06B90E9DDFh 0x00000011 jmp 00007F06B90E9DDDh 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E83A3 second address: 13E83D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 jmp 00007F06B852D3C6h 0x0000000d jmp 00007F06B852D3C0h 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E83D6 second address: 13E83DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E8513 second address: 13E852F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F06B852D3C1h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d pop esi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E852F second address: 13E8533 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E8533 second address: 13E8550 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 jp 00007F06B852D3C1h 0x0000000e push eax 0x0000000f push edx 0x00000010 push edi 0x00000011 pop edi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E79FC second address: 13E7A17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 pushad 0x00000008 jc 00007F06B90E9DD6h 0x0000000e jp 00007F06B90E9DD6h 0x00000014 jnl 00007F06B90E9DD6h 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E7A17 second address: 13E7A36 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 jmp 00007F06B852D3C9h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E7A36 second address: 13E7A3A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E8863 second address: 13E886B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E886B second address: 13E8870 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E8870 second address: 13E888C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F06B852D3C2h 0x00000009 jg 00007F06B852D3B6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E888C second address: 13E8890 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E89FB second address: 13E8A03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E8B90 second address: 13E8BA7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B90E9DE1h 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E8BA7 second address: 13E8BAB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E8E81 second address: 13E8EA1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B90E9DE8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13EA70F second address: 13EA714 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13EA714 second address: 13EA71C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F27A4 second address: 13F27D9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jp 00007F06B852D3B6h 0x00000009 jmp 00007F06B852D3C7h 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 pushad 0x00000012 jmp 00007F06B852D3BDh 0x00000017 pushad 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B4138 second address: 13B4180 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push esi 0x00000006 pop esi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b jmp 00007F06B90E9DE6h 0x00000010 lea eax, dword ptr [ebp+12487E7Ch] 0x00000016 push esi 0x00000017 xor dword ptr [ebp+122D29F4h], esi 0x0000001d pop ecx 0x0000001e push eax 0x0000001f pushad 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007F06B90E9DE5h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B4180 second address: 139BBE0 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 push eax 0x0000000a pop eax 0x0000000b popad 0x0000000c popad 0x0000000d mov dword ptr [esp], eax 0x00000010 sub dl, 00000000h 0x00000013 call dword ptr [ebp+122D212Eh] 0x00000019 jmp 00007F06B852D3C5h 0x0000001e push edi 0x0000001f pushad 0x00000020 pushad 0x00000021 popad 0x00000022 jmp 00007F06B852D3C4h 0x00000027 popad 0x00000028 push eax 0x00000029 push edx 0x0000002a jmp 00007F06B852D3C8h 0x0000002f jg 00007F06B852D3B6h 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B435D second address: 13B4391 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B90E9DE9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F06B90E9DE3h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B4391 second address: 13B439B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F06B852D3B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B4736 second address: 13B4771 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 ja 00007F06B90E9DDEh 0x0000000d jng 00007F06B90E9DD8h 0x00000013 pushad 0x00000014 popad 0x00000015 mov eax, dword ptr [esp+04h] 0x00000019 jmp 00007F06B90E9DE6h 0x0000001e mov eax, dword ptr [eax] 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 jnc 00007F06B90E9DD6h 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B4771 second address: 13B477B instructions: 0x00000000 rdtsc 0x00000002 jns 00007F06B852D3B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B477B second address: 13B47A2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B90E9DE5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d js 00007F06B90E9DE4h 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B47A2 second address: 13B47A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B4893 second address: 13B4899 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B4978 second address: 13B498F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B852D3C3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B4BCF second address: 13B4BD3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B526D second address: 13B5315 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F06B852D3B8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c pushad 0x0000000d jg 00007F06B852D3B6h 0x00000013 jg 00007F06B852D3B6h 0x00000019 popad 0x0000001a pop eax 0x0000001b nop 0x0000001c push 00000000h 0x0000001e push ebp 0x0000001f call 00007F06B852D3B8h 0x00000024 pop ebp 0x00000025 mov dword ptr [esp+04h], ebp 0x00000029 add dword ptr [esp+04h], 00000018h 0x00000031 inc ebp 0x00000032 push ebp 0x00000033 ret 0x00000034 pop ebp 0x00000035 ret 0x00000036 sub edx, dword ptr [ebp+122D389Fh] 0x0000003c jmp 00007F06B852D3BBh 0x00000041 lea eax, dword ptr [ebp+12487EC0h] 0x00000047 push 00000000h 0x00000049 push ebp 0x0000004a call 00007F06B852D3B8h 0x0000004f pop ebp 0x00000050 mov dword ptr [esp+04h], ebp 0x00000054 add dword ptr [esp+04h], 0000001Dh 0x0000005c inc ebp 0x0000005d push ebp 0x0000005e ret 0x0000005f pop ebp 0x00000060 ret 0x00000061 or dword ptr [ebp+122D2B00h], edx 0x00000067 nop 0x00000068 jno 00007F06B852D3C2h 0x0000006e push eax 0x0000006f push eax 0x00000070 pushad 0x00000071 jmp 00007F06B852D3C0h 0x00000076 push eax 0x00000077 push edx 0x00000078 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B5315 second address: 139C5D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 nop 0x00000007 mov edi, 213E84B9h 0x0000000c lea eax, dword ptr [ebp+12487E7Ch] 0x00000012 clc 0x00000013 push eax 0x00000014 jmp 00007F06B90E9DE2h 0x00000019 mov dword ptr [esp], eax 0x0000001c and edi, dword ptr [ebp+122D2B15h] 0x00000022 call dword ptr [ebp+122D2507h] 0x00000028 jo 00007F06B90E9DEEh 0x0000002e push eax 0x0000002f push edx 0x00000030 push eax 0x00000031 push edx 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 139C5D9 second address: 139C5E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F06B852D3B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 139C5E3 second address: 139C5E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1370D3E second address: 1370D42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1370D42 second address: 1370D59 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B90E9DE3h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1370D59 second address: 1370D8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 jg 00007F06B852D3B6h 0x0000000d pop ecx 0x0000000e jnp 00007F06B852D3DBh 0x00000014 pushad 0x00000015 jmp 00007F06B852D3BAh 0x0000001a jmp 00007F06B852D3C1h 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F1C88 second address: 13F1C8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F1C8C second address: 13F1CBB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F06B852D3BFh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jng 00007F06B852D3BEh 0x00000011 jc 00007F06B852D3B6h 0x00000017 push ecx 0x00000018 pop ecx 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F06B852D3BAh 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F206E second address: 13F2072 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F2072 second address: 13F2078 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F21EB second address: 13F21F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 pop eax 0x00000008 push edi 0x00000009 pop edi 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F21F6 second address: 13F2212 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F06B852D3C1h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d push ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F7F6A second address: 13F7F6E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F7F6E second address: 13F7F77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F6BE0 second address: 13F6BF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F06B90E9DDFh 0x00000009 pop edx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F6F16 second address: 13F6F2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F06B852D3C2h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F6F2C second address: 13F6F4D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B90E9DDBh 0x00000007 jmp 00007F06B90E9DE2h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F70D0 second address: 13F70E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jng 00007F06B852D3BCh 0x0000000b jnl 00007F06B852D3B6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F725F second address: 13F7288 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pushad 0x0000000a jmp 00007F06B90E9DDEh 0x0000000f jp 00007F06B90E9DD6h 0x00000015 push edx 0x00000016 pop edx 0x00000017 popad 0x00000018 pop esi 0x00000019 push eax 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d pop eax 0x0000001e push edi 0x0000001f pop edi 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F7288 second address: 13F72A4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B852D3C8h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F72A4 second address: 13F72B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnp 00007F06B90E9DE2h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F72B2 second address: 13F72B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F753C second address: 13F7546 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F06B90E9DD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F768B second address: 13F7691 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F7691 second address: 13F76AB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B90E9DE0h 0x00000007 jnp 00007F06B90E9DD6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F782C second address: 13F7834 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F7834 second address: 13F7838 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F7838 second address: 13F783C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FAF1F second address: 13FAF53 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007F06B90E9DE6h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F06B90E9DE8h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FDF98 second address: 13FDFA8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007F06B852D3B6h 0x0000000a jl 00007F06B852D3B6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1400DA1 second address: 1400DA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1400DA5 second address: 1400DA9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14005DF second address: 14005F3 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F06B90E9DD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b push ecx 0x0000000c js 00007F06B90E9DDEh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140075D second address: 1400777 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B852D3BDh 0x00000007 jnc 00007F06B852D3B6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1400777 second address: 140077F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140077F second address: 1400788 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1400788 second address: 1400797 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B90E9DDBh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1400797 second address: 14007A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14007A1 second address: 14007A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1408AEB second address: 1408AF8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 jns 00007F06B852D3B6h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140749C second address: 14074A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14078DB second address: 14078F9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B852D3BCh 0x00000007 jmp 00007F06B852D3BBh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14078F9 second address: 1407917 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F06B90E9DE8h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1407917 second address: 140794D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F06B852D3C6h 0x0000000a popad 0x0000000b pushad 0x0000000c push ebx 0x0000000d pushad 0x0000000e popad 0x0000000f pop ebx 0x00000010 jmp 00007F06B852D3BFh 0x00000015 push eax 0x00000016 push edx 0x00000017 push ebx 0x00000018 pop ebx 0x00000019 push edx 0x0000001a pop edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B4E0F second address: 13B4E30 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 jmp 00007F06B90E9DE3h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push esi 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B4E30 second address: 13B4E34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B4E34 second address: 13B4E38 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1407D1B second address: 1407D22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1407D22 second address: 1407D55 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 pushad 0x00000006 popad 0x00000007 jmp 00007F06B90E9DDCh 0x0000000c push edx 0x0000000d pop edx 0x0000000e popad 0x0000000f js 00007F06B90E9DD8h 0x00000015 push esi 0x00000016 pop esi 0x00000017 pop edx 0x00000018 pop eax 0x00000019 push edi 0x0000001a jmp 00007F06B90E9DDAh 0x0000001f push eax 0x00000020 push edx 0x00000021 jnl 00007F06B90E9DD6h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137C820 second address: 137C826 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137C826 second address: 137C84E instructions: 0x00000000 rdtsc 0x00000002 js 00007F06B90E9DD6h 0x00000008 jp 00007F06B90E9DD6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F06B90E9DE4h 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137C84E second address: 137C87B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F06B852D3C0h 0x0000000d push eax 0x0000000e push edx 0x0000000f jbe 00007F06B852D3B6h 0x00000015 jmp 00007F06B852D3BDh 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140CF40 second address: 140CF44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140CF44 second address: 140CF48 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140CF48 second address: 140CF4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140C9C6 second address: 140C9CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140C9CC second address: 140C9D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140FFC6 second address: 140FFE5 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jmp 00007F06B852D3BFh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b js 00007F06B852D3BEh 0x00000011 push edi 0x00000012 pop edi 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14100F9 second address: 1410104 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1410104 second address: 1410108 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1410108 second address: 1410117 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B90E9DDBh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1410117 second address: 1410136 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 jp 00007F06B852D3D8h 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F06B852D3BEh 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1410702 second address: 1410708 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14108A4 second address: 14108AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14108AA second address: 14108B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14108B0 second address: 14108B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1417822 second address: 1417847 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B90E9DE5h 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f jnc 00007F06B90E9DD6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1417847 second address: 141786A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B852D3C6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edi 0x0000000b pop edi 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e pop eax 0x0000000f push ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141786A second address: 1417885 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 popad 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F06B90E9DDEh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1417885 second address: 1417889 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1417889 second address: 1417892 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1417892 second address: 1417898 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1419394 second address: 141939A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141939A second address: 14193A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14193A0 second address: 14193C2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B90E9DDAh 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F06B90E9DE2h 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14193C2 second address: 14193C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141DD6D second address: 141DD72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1420B4F second address: 1420B55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1420B55 second address: 1420B95 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B90E9DDCh 0x00000007 jmp 00007F06B90E9DE8h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F06B90E9DE0h 0x00000015 jl 00007F06B90E9DD6h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1420CF1 second address: 1420CF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1420CF5 second address: 1420D69 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B90E9DDDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007F06B90E9DEAh 0x0000000f jmp 00007F06B90E9DE7h 0x00000014 pushad 0x00000015 pushad 0x00000016 popad 0x00000017 jmp 00007F06B90E9DDDh 0x0000001c popad 0x0000001d popad 0x0000001e push eax 0x0000001f push edx 0x00000020 ja 00007F06B90E9DDAh 0x00000026 pushad 0x00000027 popad 0x00000028 push edx 0x00000029 pop edx 0x0000002a jmp 00007F06B90E9DE4h 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1420ECA second address: 1420ED6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F06B852D3C2h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1420ED6 second address: 1420EFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F06B90E9DD6h 0x0000000a pop eax 0x0000000b push eax 0x0000000c jnp 00007F06B90E9DE5h 0x00000012 jmp 00007F06B90E9DDFh 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1420EFA second address: 1420F00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1421076 second address: 1421093 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F06B90E9DDBh 0x00000009 jmp 00007F06B90E9DDEh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1421093 second address: 1421099 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14215E9 second address: 14215ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14215ED second address: 14215F3 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14215F3 second address: 142160B instructions: 0x00000000 rdtsc 0x00000002 jns 00007F06B90E9DE2h 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142160B second address: 1421611 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142175E second address: 1421764 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1421764 second address: 1421769 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1429291 second address: 142929B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F06B90E9DD6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14293C4 second address: 14293F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnc 00007F06B852D3BCh 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F06B852D3C7h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14293F0 second address: 14293F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14293F4 second address: 14293F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14293F8 second address: 1429408 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F06B90E9DD6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142971D second address: 1429758 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F06B852D3C3h 0x00000009 popad 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jno 00007F06B852D3C8h 0x00000013 push eax 0x00000014 push edx 0x00000015 je 00007F06B852D3B6h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1429758 second address: 142975E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14298CC second address: 14298E6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 jmp 00007F06B852D3C1h 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1429A49 second address: 1429A4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142A134 second address: 142A14C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 jmp 00007F06B852D3C1h 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143011C second address: 1430120 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1430120 second address: 1430148 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jp 00007F06B852D3B6h 0x0000000f jmp 00007F06B852D3C6h 0x00000014 pushad 0x00000015 popad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1430148 second address: 1430181 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F06B90E9DE2h 0x00000008 pushad 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push ebx 0x00000015 jmp 00007F06B90E9DE1h 0x0000001a jnc 00007F06B90E9DD6h 0x00000020 pop ebx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14302E2 second address: 14302E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14302E9 second address: 1430311 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F06B90E9DE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jo 00007F06B90E9DD8h 0x00000012 push edi 0x00000013 pop edi 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 pop eax 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1430311 second address: 1430319 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1430319 second address: 1430333 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F06B90E9DE6h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1430333 second address: 1430337 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143DEFF second address: 143DF09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop ebx 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1443492 second address: 14434B4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push edx 0x00000006 pop edx 0x00000007 pushad 0x00000008 popad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jno 00007F06B852D3BCh 0x00000014 jo 00007F06B852D3B8h 0x0000001a push eax 0x0000001b pop eax 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14434B4 second address: 14434D2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B90E9DE2h 0x00000007 push eax 0x00000008 push edx 0x00000009 jnl 00007F06B90E9DD6h 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1449429 second address: 1449436 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jo 00007F06B852D3B6h 0x00000009 pop edi 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1449436 second address: 1449454 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F06B90E9DDAh 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jnp 00007F06B90E9DD8h 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1449454 second address: 144945A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144945A second address: 1449461 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1449461 second address: 144946D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jbe 00007F06B852D3B6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1459B69 second address: 1459B80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 jmp 00007F06B90E9DDEh 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1459DA9 second address: 1459DAD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1459F2F second address: 1459F35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 145ADF3 second address: 145AE0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F06B852D3C6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1466788 second address: 146678E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 146678E second address: 1466793 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1466793 second address: 14667AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F06B90E9DE8h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14667AF second address: 14667B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1368836 second address: 1368842 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jns 00007F06B90E9DD6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1368842 second address: 1368846 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 147FBB8 second address: 147FBC4 instructions: 0x00000000 rdtsc 0x00000002 js 00007F06B90E9DD6h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14943E5 second address: 14943FC instructions: 0x00000000 rdtsc 0x00000002 jp 00007F06B852D3B6h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f je 00007F06B852D3B6h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1494CAB second address: 1494CB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1494CB1 second address: 1494CCA instructions: 0x00000000 rdtsc 0x00000002 ja 00007F06B852D3B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F06B852D3BFh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1494CCA second address: 1494CD0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1494CD0 second address: 1494CD6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1498FE1 second address: 1498FE7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14994AB second address: 14994AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 149C7B7 second address: 149C7BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop eax 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137AE38 second address: 137AE3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0283 second address: 53B0287 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0287 second address: 53B0299 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B852D3BEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B02FA second address: 53B02FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B02FE second address: 53B0304 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B8043 second address: 13B804D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B820D second address: 13B8211 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B83F6 second address: 13B8400 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B8400 second address: 13B8404 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B03F9 second address: 53B0431 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F06B90E9DE5h 0x00000008 pop ecx 0x00000009 push ebx 0x0000000a pop esi 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e xchg eax, ebp 0x0000000f jmp 00007F06B90E9DE3h 0x00000014 mov ebp, esp 0x00000016 pushad 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B04B9 second address: 53B04BF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B04BF second address: 53B051A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edi, ax 0x00000006 mov cx, AF13h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d xor dword ptr [esp], 48BA3DABh 0x00000014 jmp 00007F06B90E9DE6h 0x00000019 call 00007F0728B2D8DFh 0x0000001e push 74DF27D0h 0x00000023 push dword ptr fs:[00000000h] 0x0000002a mov eax, dword ptr [esp+10h] 0x0000002e mov dword ptr [esp+10h], ebp 0x00000032 lea ebp, dword ptr [esp+10h] 0x00000036 sub esp, eax 0x00000038 push ebx 0x00000039 push esi 0x0000003a push edi 0x0000003b mov eax, dword ptr [74E80140h] 0x00000040 xor dword ptr [ebp-04h], eax 0x00000043 xor eax, ebp 0x00000045 push eax 0x00000046 mov dword ptr [ebp-18h], esp 0x00000049 push dword ptr [ebp-08h] 0x0000004c mov eax, dword ptr [ebp-04h] 0x0000004f mov dword ptr [ebp-04h], FFFFFFFEh 0x00000056 mov dword ptr [ebp-08h], eax 0x00000059 lea eax, dword ptr [ebp-10h] 0x0000005c mov dword ptr fs:[00000000h], eax 0x00000062 ret 0x00000063 jmp 00007F06B90E9DE0h 0x00000068 and dword ptr [ebp-04h], 00000000h 0x0000006c jmp 00007F06B90E9DE0h 0x00000071 mov edx, dword ptr [ebp+0Ch] 0x00000074 push eax 0x00000075 push edx 0x00000076 pushad 0x00000077 push eax 0x00000078 push edx 0x00000079 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B051A second address: 53B0521 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov esi, edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0521 second address: 53B0530 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F06B90E9DDBh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0530 second address: 53B0579 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov esi, edx 0x0000000a jmp 00007F06B852D3C5h 0x0000000f mov al, byte ptr [edx] 0x00000011 jmp 00007F06B852D3BEh 0x00000016 inc edx 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F06B852D3C7h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0579 second address: 53B057E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B057E second address: 53B0584 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0584 second address: 53B0579 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 test al, al 0x00000009 jmp 00007F06B90E9DE1h 0x0000000e jne 00007F06B90E9D81h 0x00000014 mov al, byte ptr [edx] 0x00000016 jmp 00007F06B90E9DDEh 0x0000001b inc edx 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007F06B90E9DE7h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B065B second address: 53B0661 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0661 second address: 53B0665 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0665 second address: 53B0669 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0669 second address: 53B06EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov al, byte ptr [edi+01h] 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007F06B90E9DE4h 0x00000012 or eax, 1FFF8888h 0x00000018 jmp 00007F06B90E9DDBh 0x0000001d popfd 0x0000001e push eax 0x0000001f pushfd 0x00000020 jmp 00007F06B90E9DDFh 0x00000025 sub ch, FFFFFFCEh 0x00000028 jmp 00007F06B90E9DE9h 0x0000002d popfd 0x0000002e pop esi 0x0000002f popad 0x00000030 inc edi 0x00000031 pushad 0x00000032 push edx 0x00000033 mov ch, C1h 0x00000035 pop edx 0x00000036 mov esi, 416BF7E1h 0x0000003b popad 0x0000003c test al, al 0x0000003e push eax 0x0000003f push edx 0x00000040 jmp 00007F06B90E9DE3h 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B06EF second address: 53B06F5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B06F5 second address: 53B078B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jne 00007F0728B22158h 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007F06B90E9DDDh 0x00000015 add cx, 9116h 0x0000001a jmp 00007F06B90E9DE1h 0x0000001f popfd 0x00000020 popad 0x00000021 mov ecx, edx 0x00000023 jmp 00007F06B90E9DDAh 0x00000028 shr ecx, 02h 0x0000002b jmp 00007F06B90E9DE0h 0x00000030 rep movsd 0x00000032 rep movsd 0x00000034 rep movsd 0x00000036 rep movsd 0x00000038 rep movsd 0x0000003a jmp 00007F06B90E9DE0h 0x0000003f mov ecx, edx 0x00000041 pushad 0x00000042 jmp 00007F06B90E9DDEh 0x00000047 movzx ecx, bx 0x0000004a popad 0x0000004b and ecx, 03h 0x0000004e push eax 0x0000004f push edx 0x00000050 pushad 0x00000051 push eax 0x00000052 pop ebx 0x00000053 jmp 00007F06B90E9DE2h 0x00000058 popad 0x00000059 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B078B second address: 53B0790 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0790 second address: 53B07D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov cx, di 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rep movsb 0x0000000c pushad 0x0000000d mov eax, edi 0x0000000f pushfd 0x00000010 jmp 00007F06B90E9DDBh 0x00000015 sub eax, 6F31026Eh 0x0000001b jmp 00007F06B90E9DE9h 0x00000020 popfd 0x00000021 popad 0x00000022 mov dword ptr [ebp-04h], FFFFFFFEh 0x00000029 push eax 0x0000002a push edx 0x0000002b push eax 0x0000002c push edx 0x0000002d pushad 0x0000002e popad 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B07D9 second address: 53B07DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B07DD second address: 53B07E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B07E3 second address: 53B0800 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B852D3C2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, ebx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e push ecx 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0800 second address: 53B0804 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0804 second address: 53B084D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushfd 0x00000007 jmp 00007F06B852D3C6h 0x0000000c add ax, 5B78h 0x00000011 jmp 00007F06B852D3BBh 0x00000016 popfd 0x00000017 popad 0x00000018 mov ecx, dword ptr [ebp-10h] 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007F06B852D3C5h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B084D second address: 53B08C1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B90E9DE1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr fs:[00000000h], ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 pushfd 0x00000014 jmp 00007F06B90E9DE3h 0x00000019 sbb esi, 743D654Eh 0x0000001f jmp 00007F06B90E9DE9h 0x00000024 popfd 0x00000025 pushfd 0x00000026 jmp 00007F06B90E9DE0h 0x0000002b add cl, FFFFFFC8h 0x0000002e jmp 00007F06B90E9DDBh 0x00000033 popfd 0x00000034 popad 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B08C1 second address: 53B094F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F06B852D3BFh 0x00000009 xor si, 100Eh 0x0000000e jmp 00007F06B852D3C9h 0x00000013 popfd 0x00000014 jmp 00007F06B852D3C0h 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c pop ecx 0x0000001d pushad 0x0000001e pushad 0x0000001f mov cx, 63A3h 0x00000023 pushfd 0x00000024 jmp 00007F06B852D3C8h 0x00000029 and cx, 90E8h 0x0000002e jmp 00007F06B852D3BBh 0x00000033 popfd 0x00000034 popad 0x00000035 movzx ecx, bx 0x00000038 popad 0x00000039 pop edi 0x0000003a jmp 00007F06B852D3BBh 0x0000003f pop esi 0x00000040 push eax 0x00000041 push edx 0x00000042 push eax 0x00000043 push edx 0x00000044 pushad 0x00000045 popad 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B094F second address: 53B096A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B90E9DE7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B096A second address: 53B099A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cx, bx 0x00000006 pushfd 0x00000007 jmp 00007F06B852D3BBh 0x0000000c jmp 00007F06B852D3C3h 0x00000011 popfd 0x00000012 popad 0x00000013 pop edx 0x00000014 pop eax 0x00000015 pop ebx 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B099A second address: 53B099E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B099E second address: 53B09B9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B852D3C7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B09B9 second address: 53B04B9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B90E9DE9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 leave 0x0000000a pushad 0x0000000b mov ax, AEF3h 0x0000000f mov esi, 4312474Fh 0x00000014 popad 0x00000015 retn 0008h 0x00000018 cmp dword ptr [ebp-2Ch], 10h 0x0000001c mov eax, dword ptr [ebp-40h] 0x0000001f jnc 00007F06B90E9DD5h 0x00000021 push eax 0x00000022 lea edx, dword ptr [ebp-00000590h] 0x00000028 push edx 0x00000029 call esi 0x0000002b push 00000008h 0x0000002d jmp 00007F06B90E9DE6h 0x00000032 push 3C5C2183h 0x00000037 push eax 0x00000038 push edx 0x00000039 push eax 0x0000003a push edx 0x0000003b pushad 0x0000003c popad 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0ACE second address: 53B0B0C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B852D3C9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F06B852D3BEh 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F06B852D3BDh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0B0C second address: 53B0B12 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0B12 second address: 53B0B32 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B852D3BCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b mov di, ax 0x0000000e mov edx, esi 0x00000010 popad 0x00000011 mov ebp, esp 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0B32 second address: 53B0B36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0B36 second address: 53B0B3A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0B3A second address: 53B0B40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 4EF8C1 second address: 4EF8C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 4EF8C6 second address: 4EF8CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 658A44 second address: 658A6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 push eax 0x00000007 pop eax 0x00000008 jmp 00007F06B852D3C9h 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 pop eax 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 6696DF second address: 669701 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F06B90E9DD6h 0x0000000a pop ebx 0x0000000b pop esi 0x0000000c push esi 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F06B90E9DE1h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 669701 second address: 669705 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 66997B second address: 669981 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 669981 second address: 669985 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 669985 second address: 6699A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F06B90E9DDDh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop eax 0x0000000c push eax 0x0000000d jne 00007F06B90E9DE9h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 669AE3 second address: 669AE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 669AE9 second address: 669AEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 669D54 second address: 669D5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 669D5F second address: 669D65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 669D65 second address: 669D69 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 669E95 second address: 669ED8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F06B90E9DE9h 0x00000009 popad 0x0000000a pushad 0x0000000b push esi 0x0000000c pushad 0x0000000d popad 0x0000000e pop esi 0x0000000f jng 00007F06B90E9DDAh 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F06B90E9DE4h 0x0000001c rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 669ED8 second address: 669EF5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B852D3C9h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 66CF8D second address: 66CF92 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 66CF92 second address: 66CFAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [eax] 0x00000009 jmp 00007F06B852D3BBh 0x0000000e mov dword ptr [esp+04h], eax 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 push esi 0x00000016 pop esi 0x00000017 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 66CFAF second address: 66CFBC instructions: 0x00000000 rdtsc 0x00000002 je 00007F06B90E9DD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 66CFF7 second address: 66CFFB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 66D174 second address: 66D198 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B90E9DE3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F06B90E9DDBh 0x00000010 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 66D198 second address: 66D209 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 add dword ptr [esp], 6603B300h 0x0000000e mov edx, dword ptr [ebp+122D1CE1h] 0x00000014 jmp 00007F06B852D3BFh 0x00000019 push 00000003h 0x0000001b mov ecx, dword ptr [ebp+122D3DDCh] 0x00000021 push 00000000h 0x00000023 and edx, 72EB46EEh 0x00000029 push 00000003h 0x0000002b jmp 00007F06B852D3C7h 0x00000030 push 6887205Fh 0x00000035 js 00007F06B852D3DEh 0x0000003b push eax 0x0000003c push edx 0x0000003d jmp 00007F06B852D3C8h 0x00000042 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 66D209 second address: 66D27C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B90E9DDAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 add dword ptr [esp], 5778DFA1h 0x00000010 push ebx 0x00000011 mov ecx, dword ptr [ebp+122D3E44h] 0x00000017 pop edi 0x00000018 push eax 0x00000019 mov edx, dword ptr [ebp+122D3DACh] 0x0000001f pop ecx 0x00000020 lea ebx, dword ptr [ebp+12451E5Fh] 0x00000026 jmp 00007F06B90E9DE2h 0x0000002b mov esi, dword ptr [ebp+122D39CCh] 0x00000031 xchg eax, ebx 0x00000032 jmp 00007F06B90E9DE9h 0x00000037 push eax 0x00000038 push eax 0x00000039 push edx 0x0000003a pushad 0x0000003b js 00007F06B90E9DD6h 0x00000041 jmp 00007F06B90E9DDBh 0x00000046 popad 0x00000047 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 66D27C second address: 66D286 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F06B852D3BCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 66D35F second address: 66D3BC instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push ebx 0x0000000b call 00007F06B90E9DD8h 0x00000010 pop ebx 0x00000011 mov dword ptr [esp+04h], ebx 0x00000015 add dword ptr [esp+04h], 00000015h 0x0000001d inc ebx 0x0000001e push ebx 0x0000001f ret 0x00000020 pop ebx 0x00000021 ret 0x00000022 sub dword ptr [ebp+122D1CDCh], ecx 0x00000028 push 00000000h 0x0000002a push 00000000h 0x0000002c push ebx 0x0000002d call 00007F06B90E9DD8h 0x00000032 pop ebx 0x00000033 mov dword ptr [esp+04h], ebx 0x00000037 add dword ptr [esp+04h], 00000017h 0x0000003f inc ebx 0x00000040 push ebx 0x00000041 ret 0x00000042 pop ebx 0x00000043 ret 0x00000044 xor dword ptr [ebp+122D263Dh], eax 0x0000004a push 5D5FCE2Fh 0x0000004f push eax 0x00000050 push edx 0x00000051 push eax 0x00000052 push edx 0x00000053 push eax 0x00000054 push edx 0x00000055 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 66D3BC second address: 66D3C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 66D3C0 second address: 66D3C6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 68D3D3 second address: 68D419 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B852D3C4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F06B852D3C7h 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 jc 00007F06B852D3B8h 0x00000017 js 00007F06B852D3BCh 0x0000001d je 00007F06B852D3B6h 0x00000023 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 68B304 second address: 68B32C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F06B90E9DDFh 0x00000009 popad 0x0000000a push ecx 0x0000000b jmp 00007F06B90E9DDCh 0x00000010 jbe 00007F06B90E9DD6h 0x00000016 pop ecx 0x00000017 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 68B479 second address: 68B47E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 68B47E second address: 68B48C instructions: 0x00000000 rdtsc 0x00000002 jne 00007F06B90E9DD8h 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 68BD51 second address: 68BD6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F06B852D3B6h 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F06B852D3C1h 0x00000012 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 68BD6F second address: 68BD75 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 68BD75 second address: 68BD7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 68BD7B second address: 68BD80 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 68BD80 second address: 68BD86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 68BD86 second address: 68BD99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F06B90E9DDAh 0x0000000e rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 68C193 second address: 68C19D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 655457 second address: 655467 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F06B90E9DDAh 0x00000008 push edx 0x00000009 pop edx 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push edi 0x0000000f pop edi 0x00000010 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 68CA41 second address: 68CA47 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 68CA47 second address: 68CA60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F06B90E9DE5h 0x00000009 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 68CA60 second address: 68CA64 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 68CA64 second address: 68CA78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 68CA78 second address: 68CA7C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 68CA7C second address: 68CA84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 68CA84 second address: 68CAA8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B852D3C4h 0x00000007 pushad 0x00000008 jmp 00007F06B852D3BBh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 68CAA8 second address: 68CAAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 68CC1B second address: 68CC2E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F06B852D3BEh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 68CF68 second address: 68CF6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 68CF6C second address: 68CF73 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 68D24C second address: 68D250 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 68D250 second address: 68D258 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 68D258 second address: 68D281 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 jmp 00007F06B90E9DDEh 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F06B90E9DE1h 0x00000014 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 68E87F second address: 68E885 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 68E885 second address: 68E889 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 68E889 second address: 68E88D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 68E88D second address: 68E8A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jg 00007F06B90E9DD8h 0x00000011 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 69175E second address: 691762 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 691762 second address: 691766 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 69811A second address: 698124 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F06B852D3B6h 0x0000000a rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 698124 second address: 69812A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 69812A second address: 698130 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 698130 second address: 698137 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 697842 second address: 697857 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F06B852D3C0h 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 6979CA second address: 6979D4 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F06B90E9DD6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 697CAA second address: 697CCB instructions: 0x00000000 rdtsc 0x00000002 jng 00007F06B852D3D3h 0x00000008 jmp 00007F06B852D3C7h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 697F99 second address: 697FB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F06B90E9DE6h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 69ABC6 second address: 69ABD1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnl 00007F06B852D3B6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 69ABD1 second address: 69ABE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 jbe 00007F06B90E9DDCh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 69B0B2 second address: 69B0B9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 69B19C second address: 69B1A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F06B90E9DD6h 0x0000000a rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 69B671 second address: 69B676 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 69C07C second address: 69C080 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 69C080 second address: 69C0A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a mov esi, dword ptr [ebp+122D3F5Ch] 0x00000010 push 00000000h 0x00000012 xor si, E10Bh 0x00000017 push 00000000h 0x00000019 adc di, 30A6h 0x0000001e xchg eax, ebx 0x0000001f push eax 0x00000020 pushad 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 69D9EA second address: 69DA6A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B90E9DE6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push ebx 0x00000010 call 00007F06B90E9DD8h 0x00000015 pop ebx 0x00000016 mov dword ptr [esp+04h], ebx 0x0000001a add dword ptr [esp+04h], 00000016h 0x00000022 inc ebx 0x00000023 push ebx 0x00000024 ret 0x00000025 pop ebx 0x00000026 ret 0x00000027 sub dword ptr [ebp+122D1D02h], edx 0x0000002d push 00000000h 0x0000002f cmc 0x00000030 push 00000000h 0x00000032 push 00000000h 0x00000034 push eax 0x00000035 call 00007F06B90E9DD8h 0x0000003a pop eax 0x0000003b mov dword ptr [esp+04h], eax 0x0000003f add dword ptr [esp+04h], 00000014h 0x00000047 inc eax 0x00000048 push eax 0x00000049 ret 0x0000004a pop eax 0x0000004b ret 0x0000004c mov esi, dword ptr [ebp+122DBC8Bh] 0x00000052 xchg eax, ebx 0x00000053 push eax 0x00000054 push edx 0x00000055 push edx 0x00000056 jmp 00007F06B90E9DE2h 0x0000005b pop edx 0x0000005c rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 69E503 second address: 69E51B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F06B852D3C3h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 69EE52 second address: 69EEDB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F06B90E9DE1h 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov dword ptr [esp], eax 0x00000010 sbb esi, 15047600h 0x00000016 push 00000000h 0x00000018 push 00000000h 0x0000001a push esi 0x0000001b call 00007F06B90E9DD8h 0x00000020 pop esi 0x00000021 mov dword ptr [esp+04h], esi 0x00000025 add dword ptr [esp+04h], 00000018h 0x0000002d inc esi 0x0000002e push esi 0x0000002f ret 0x00000030 pop esi 0x00000031 ret 0x00000032 pushad 0x00000033 mov eax, ebx 0x00000035 pushad 0x00000036 mov dh, bh 0x00000038 or cl, FFFFFFFAh 0x0000003b popad 0x0000003c popad 0x0000003d push 00000000h 0x0000003f push 00000000h 0x00000041 push ebx 0x00000042 call 00007F06B90E9DD8h 0x00000047 pop ebx 0x00000048 mov dword ptr [esp+04h], ebx 0x0000004c add dword ptr [esp+04h], 0000001Ah 0x00000054 inc ebx 0x00000055 push ebx 0x00000056 ret 0x00000057 pop ebx 0x00000058 ret 0x00000059 mov dword ptr [ebp+122D22A9h], ecx 0x0000005f xchg eax, ebx 0x00000060 js 00007F06B90E9DE4h 0x00000066 pushad 0x00000067 je 00007F06B90E9DD6h 0x0000006d push eax 0x0000006e push edx 0x0000006f rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 6A029D second address: 6A02A7 instructions: 0x00000000 rdtsc 0x00000002 js 00007F06B852D3B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 6A0CEB second address: 6A0D16 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F06B90E9DE4h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e js 00007F06B90E9DE8h 0x00000014 push eax 0x00000015 push edx 0x00000016 je 00007F06B90E9DD6h 0x0000001c rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 6A0D16 second address: 6A0D76 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F06B852D3B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b jp 00007F06B852D3BEh 0x00000011 pushad 0x00000012 or dword ptr [ebp+122D1F4Eh], edi 0x00000018 sbb ch, 00000007h 0x0000001b popad 0x0000001c push 00000000h 0x0000001e push 00000000h 0x00000020 push ecx 0x00000021 call 00007F06B852D3B8h 0x00000026 pop ecx 0x00000027 mov dword ptr [esp+04h], ecx 0x0000002b add dword ptr [esp+04h], 00000014h 0x00000033 inc ecx 0x00000034 push ecx 0x00000035 ret 0x00000036 pop ecx 0x00000037 ret 0x00000038 push esi 0x00000039 sbb si, 1841h 0x0000003e pop edi 0x0000003f push 00000000h 0x00000041 mov dword ptr [ebp+1247974Eh], edi 0x00000047 xchg eax, ebx 0x00000048 pushad 0x00000049 pushad 0x0000004a push esi 0x0000004b pop esi 0x0000004c jnc 00007F06B852D3B6h 0x00000052 popad 0x00000053 pushad 0x00000054 push eax 0x00000055 push edx 0x00000056 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 6A4295 second address: 6A4299 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 6A4299 second address: 6A42AD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F06B852D3BBh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 6A42AD second address: 6A42B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 65042F second address: 65043F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B852D3BAh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 65043F second address: 65044F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F06B90E9DD6h 0x0000000a ja 00007F06B90E9DD6h 0x00000010 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 65044F second address: 650453 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 650453 second address: 650472 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jnc 00007F06B90E9DD6h 0x00000010 jmp 00007F06B90E9DDFh 0x00000015 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 650472 second address: 650476 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 6A765D second address: 6A769C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 mov dword ptr [esp], eax 0x0000000a mov bx, F5EDh 0x0000000e push 00000000h 0x00000010 push 00000000h 0x00000012 push edi 0x00000013 call 00007F06B90E9DD8h 0x00000018 pop edi 0x00000019 mov dword ptr [esp+04h], edi 0x0000001d add dword ptr [esp+04h], 0000001Dh 0x00000025 inc edi 0x00000026 push edi 0x00000027 ret 0x00000028 pop edi 0x00000029 ret 0x0000002a push 00000000h 0x0000002c mov bl, 71h 0x0000002e xchg eax, esi 0x0000002f pushad 0x00000030 push eax 0x00000031 push edx 0x00000032 pushad 0x00000033 popad 0x00000034 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 6A8772 second address: 6A8776 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 6A8776 second address: 6A877A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 6A877A second address: 6A87D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push edi 0x0000000b call 00007F06B852D3B8h 0x00000010 pop edi 0x00000011 mov dword ptr [esp+04h], edi 0x00000015 add dword ptr [esp+04h], 00000016h 0x0000001d inc edi 0x0000001e push edi 0x0000001f ret 0x00000020 pop edi 0x00000021 ret 0x00000022 jns 00007F06B852D3B8h 0x00000028 mov ebx, dword ptr [ebp+122D3C58h] 0x0000002e push 00000000h 0x00000030 clc 0x00000031 push 00000000h 0x00000033 mov bh, 5Ch 0x00000035 mov di, ax 0x00000038 xchg eax, esi 0x00000039 jmp 00007F06B852D3BFh 0x0000003e push eax 0x0000003f jo 00007F06B852D3BEh 0x00000045 push ebx 0x00000046 push eax 0x00000047 push edx 0x00000048 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 6A971B second address: 6A971F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 6A971F second address: 6A9729 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F06B852D3B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 6AA75C second address: 6AA7D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 mov dword ptr [esp], eax 0x00000008 push 00000000h 0x0000000a push edx 0x0000000b call 00007F06B90E9DD8h 0x00000010 pop edx 0x00000011 mov dword ptr [esp+04h], edx 0x00000015 add dword ptr [esp+04h], 0000001Ch 0x0000001d inc edx 0x0000001e push edx 0x0000001f ret 0x00000020 pop edx 0x00000021 ret 0x00000022 push 00000000h 0x00000024 push edx 0x00000025 sub ebx, dword ptr [ebp+122D2414h] 0x0000002b pop edi 0x0000002c push 00000000h 0x0000002e push 00000000h 0x00000030 push eax 0x00000031 call 00007F06B90E9DD8h 0x00000036 pop eax 0x00000037 mov dword ptr [esp+04h], eax 0x0000003b add dword ptr [esp+04h], 0000001Ch 0x00000043 inc eax 0x00000044 push eax 0x00000045 ret 0x00000046 pop eax 0x00000047 ret 0x00000048 xchg eax, esi 0x00000049 js 00007F06B90E9DE0h 0x0000004f jmp 00007F06B90E9DDAh 0x00000054 push eax 0x00000055 jc 00007F06B90E9DE2h 0x0000005b jp 00007F06B90E9DDCh 0x00000061 push eax 0x00000062 push edx 0x00000063 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 6AC763 second address: 6AC7EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F06B852D3C0h 0x00000009 popad 0x0000000a pop esi 0x0000000b push eax 0x0000000c js 00007F06B852D3C4h 0x00000012 pushad 0x00000013 jp 00007F06B852D3B6h 0x00000019 jo 00007F06B852D3B6h 0x0000001f popad 0x00000020 nop 0x00000021 push 00000000h 0x00000023 push ecx 0x00000024 call 00007F06B852D3B8h 0x00000029 pop ecx 0x0000002a mov dword ptr [esp+04h], ecx 0x0000002e add dword ptr [esp+04h], 00000017h 0x00000036 inc ecx 0x00000037 push ecx 0x00000038 ret 0x00000039 pop ecx 0x0000003a ret 0x0000003b adc edi, 0EC0C071h 0x00000041 push 00000000h 0x00000043 push 00000000h 0x00000045 push esi 0x00000046 call 00007F06B852D3B8h 0x0000004b pop esi 0x0000004c mov dword ptr [esp+04h], esi 0x00000050 add dword ptr [esp+04h], 00000019h 0x00000058 inc esi 0x00000059 push esi 0x0000005a ret 0x0000005b pop esi 0x0000005c ret 0x0000005d mov ebx, dword ptr [ebp+122D3CE0h] 0x00000063 push 00000000h 0x00000065 mov dword ptr [ebp+122D1F99h], esi 0x0000006b xchg eax, esi 0x0000006c js 00007F06B852D3BEh 0x00000072 push edi 0x00000073 push eax 0x00000074 push edx 0x00000075 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 6AC7EF second address: 6AC7FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 6AC7FB second address: 6AC7FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 6AC7FF second address: 6AC80D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B90E9DDAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 6AD850 second address: 6AD854 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 6AD854 second address: 6AD85A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 6B37FF second address: 6B3867 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F06B852D3C0h 0x0000000b pushad 0x0000000c jmp 00007F06B852D3BEh 0x00000011 jmp 00007F06B852D3C8h 0x00000016 js 00007F06B852D3B6h 0x0000001c pushad 0x0000001d popad 0x0000001e popad 0x0000001f popad 0x00000020 pushad 0x00000021 jmp 00007F06B852D3C8h 0x00000026 push eax 0x00000027 push edx 0x00000028 jl 00007F06B852D3B6h 0x0000002e rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 653984 second address: 65398A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 6B3E2A second address: 6B3E30 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 6B3E30 second address: 6B3E75 instructions: 0x00000000 rdtsc 0x00000002 je 00007F06B90E9DD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f push 00000000h 0x00000011 push edx 0x00000012 call 00007F06B90E9DD8h 0x00000017 pop edx 0x00000018 mov dword ptr [esp+04h], edx 0x0000001c add dword ptr [esp+04h], 00000015h 0x00000024 inc edx 0x00000025 push edx 0x00000026 ret 0x00000027 pop edx 0x00000028 ret 0x00000029 movzx edi, dx 0x0000002c push 00000000h 0x0000002e sub ebx, dword ptr [ebp+122D3C40h] 0x00000034 push 00000000h 0x00000036 mov dword ptr [ebp+122D1E3Dh], esi 0x0000003c push eax 0x0000003d push eax 0x0000003e push edx 0x0000003f pushad 0x00000040 push eax 0x00000041 push edx 0x00000042 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 6B3E75 second address: 6B3E7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 6B3E7C second address: 6B3E91 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F06B90E9DE1h 0x00000009 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 6B4DA3 second address: 6B4DDE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jng 00007F06B852D3B6h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f pushad 0x00000010 jmp 00007F06B852D3C8h 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F06B852D3C1h 0x0000001c rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 6B5E27 second address: 6B5E2D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 6CA1B5 second address: 6CA1CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 jnc 00007F06B852D3B6h 0x0000000c jmp 00007F06B852D3BDh 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 6CA1CF second address: 6CA1D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 6CA1D5 second address: 6CA1DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 6CA1DB second address: 6CA1DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 6CA1DF second address: 6CA1E9 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F06B852D3B6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 6C9506 second address: 6C950C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 6C950C second address: 6C9512 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 11FFC3D instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 11FFB5B instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 14327A4 instructions caused by: Self-modifying code
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Special instruction interceptor: First address: 68F6B5 instructions caused by: Self-modifying code
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Special instruction interceptor: First address: 71C8EF instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 114F6B5 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 11DC8EF instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Special instruction interceptor: First address: 8257BC instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Special instruction interceptor: First address: 8256F8 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Special instruction interceptor: First address: 9CD725 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Special instruction interceptor: First address: 9F6B00 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Special instruction interceptor: First address: 9D73EE instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Special instruction interceptor: First address: A58594 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Special instruction interceptor: First address: 663277 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Special instruction interceptor: First address: 4B608E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Special instruction interceptor: First address: 67442E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Special instruction interceptor: First address: 6F184C instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Special instruction interceptor: First address: FFFC3D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Special instruction interceptor: First address: FFFB5B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Special instruction interceptor: First address: 12327A4 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Special instruction interceptor: First address: EFDE86 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Special instruction interceptor: First address: EFDDE9 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Special instruction interceptor: First address: 10B1E84 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Special instruction interceptor: First address: EFDD93 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Special instruction interceptor: First address: 1150B23 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Special instruction interceptor: First address: F01E23 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Special instruction interceptor: First address: 618DE86 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Special instruction interceptor: First address: 618DDE9 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Special instruction interceptor: First address: 6341E84 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Special instruction interceptor: First address: 618DD93 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Special instruction interceptor: First address: 63E0B23 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Special instruction interceptor: First address: 648DE86 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Special instruction interceptor: First address: 648DDE9 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Special instruction interceptor: First address: 6191E23 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Special instruction interceptor: First address: 6641E84 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Special instruction interceptor: First address: 648DD93 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Special instruction interceptor: First address: 66E0B23 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Special instruction interceptor: First address: 6491E23 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Special instruction interceptor: First address: 5A1DE86 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Special instruction interceptor: First address: 5A1DDE9 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Special instruction interceptor: First address: 5BD1E84 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Special instruction interceptor: First address: 5A1DD93 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Special instruction interceptor: First address: 5C70B23 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Special instruction interceptor: First address: 641DE86 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Special instruction interceptor: First address: 641DDE9 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Special instruction interceptor: First address: 5A21E23 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Special instruction interceptor: First address: 65D1E84 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Special instruction interceptor: First address: 641DD93 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Special instruction interceptor: First address: 6670B23 instructions caused by: Self-modifying code

Allocates memory with a write watch (potentially for evading sandboxes)

Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Memory allocated: 5370000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Memory allocated: 55B0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Memory allocated: 53B0000 memory reserve \| memory write watch

Contains capabilities to detect virtual machines

Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Contains functionality for execution timing, often used to detect debuggers

Source: C:\Users\user\Documents\BAKFCBFHJD.exe

Code function: 9_2_05220D46 rdtsc

9_2_05220D46

Contains long sleeps (>= 3 min)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Thread delayed: delay time: 922337203685477

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 4332	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Window / User API: threadDelayed 1590
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Window / User API: threadDelayed 1072
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Window / User API: threadDelayed 910
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Window / User API: threadDelayed 689
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Window / User API: threadDelayed 1628
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Window / User API: threadDelayed 1516
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Window / User API: threadDelayed 1068
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Window / User API: threadDelayed 652

Found dropped PE file which has not been started or loaded

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Found large amount of non-executed APIs

Source: C:\Users\user\Desktop\file.exe

API coverage: 0.3 %

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Users\user\Desktop\file.exe TID: 4348	Thread sleep time: -36018s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5740	Thread sleep time: -38019s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 4144	Thread sleep time: -32000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 3752	Thread sleep time: -42021s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 3332	Thread sleep time: -38019s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5228	Thread sleep time: -36018s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7396	Thread sleep count: 87 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7396	Thread sleep time: -174087s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7404	Thread sleep count: 70 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7404	Thread sleep time: -140070s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7364	Thread sleep count: 231 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7364	Thread sleep time: -6930000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7336	Thread sleep count: 4332 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7336	Thread sleep time: -8668332s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7384	Thread sleep count: 85 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7384	Thread sleep time: -170085s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7400	Thread sleep time: -180000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7336	Thread sleep time: -32016s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe TID: 8028	Thread sleep count: 1590 > 30
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe TID: 8028	Thread sleep time: -3181590s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe TID: 8008	Thread sleep count: 1072 > 30
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe TID: 8008	Thread sleep time: -2145072s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe TID: 7976	Thread sleep count: 77 > 30
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe TID: 7976	Thread sleep count: 78 > 30
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe TID: 7976	Thread sleep count: 79 > 30
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe TID: 2424	Thread sleep count: 910 > 30
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe TID: 2424	Thread sleep time: -1820910s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe TID: 796	Thread sleep count: 689 > 30
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe TID: 796	Thread sleep time: -1378689s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe TID: 2232	Thread sleep count: 1628 > 30
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe TID: 2232	Thread sleep time: -3257628s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe TID: 8056	Thread sleep count: 1516 > 30
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe TID: 8056	Thread sleep time: -3033516s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe TID: 1228	Thread sleep count: 1068 > 30
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe TID: 1228	Thread sleep time: -2137068s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe TID: 6748	Thread sleep time: -58029s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe TID: 6760	Thread sleep time: -44022s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe TID: 7096	Thread sleep time: -32000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe TID: 6764	Thread sleep time: -54027s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe TID: 7120	Thread sleep time: -210000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe TID: 6828	Thread sleep time: -44022s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe TID: 6832	Thread sleep time: -54027s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe TID: 6808	Thread sleep time: -54027s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe TID: 6804	Thread sleep time: -62031s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe TID: 1168	Thread sleep time: -56028s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe TID: 396	Thread sleep time: -46023s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe TID: 6840	Thread sleep time: -36000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe TID: 5376	Thread sleep time: -42021s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe TID: 6928	Thread sleep time: -210000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe TID: 6192	Thread sleep time: -56028s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe TID: 3492	Thread sleep time: -48024s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe TID: 412	Thread sleep time: -44022s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe TID: 3668	Thread sleep time: -40020s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe TID: 5368	Thread sleep count: 103 > 30
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe TID: 5368	Thread sleep count: 144 > 30
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe TID: 1420	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe TID: 4284	Thread sleep count: 652 > 30
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe TID: 4284	Thread sleep count: 280 > 30
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe TID: 4284	Thread sleep count: 141 > 30
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe TID: 2740	Thread sleep time: -48024s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe TID: 2716	Thread sleep time: -36018s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe TID: 2288	Thread sleep time: -48024s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe TID: 2832	Thread sleep time: -34017s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe TID: 7996	Thread sleep time: -270000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe TID: 6040	Thread sleep time: -34017s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe TID: 2784	Thread sleep time: -36018s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe TID: 4944	Thread sleep time: -34017s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe TID: 2496	Thread sleep time: -180000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe TID: 3752	Thread sleep time: -32016s >= -30000s

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Sample execution stops while process was sleeping (likely an evasion)

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Documents\BAKFCBFHJD.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C46C930 GetSystemInfo,VirtualAlloc,GetSystemInfo,VirtualFree,VirtualAlloc,

0_2_6C46C930

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.2107629430.000000000138B000.00000040.00000001.01000000.00000003.sdmp, BAKFCBFHJD.exe, 00000009.00000002.2157881884.0000000000673000.00000040.00000001.01000000.0000000B.sdmp, BAKFCBFHJD.exe, 00000009.00000000.2088224331.0000000000673000.00000080.00000001.01000000.0000000B.sdmp, skotes.exe, 0000000A.00000002.2198440738.0000000001133000.00000040.00000001.01000000.0000000D.sdmp, skotes.exe, 0000000A.00000000.2127869098.0000000001133000.00000080.00000001.01000000.0000000D.sdmp, skotes.exe, 0000000B.00000000.2132260235.0000000001133000.00000080.00000001.01000000.0000000D.sdmp, skotes.exe, 0000000B.00000002.2199681608.0000000001133000.00000040.00000001.01000000.0000000D.sdmp, skotes.exe, 0000000C.00000000.2299229146.0000000001133000.00000080.00000001.01000000.0000000D.sdmp, f377015f96.exe, 00000010.00000002.2679711119.000000000118B000.00000040.00000001.01000000.00000010.sdmp, f377015f96.exe, 00000019.00000002.2850082344.000000000118B000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: f039f524ee.exe, 0000000F.00000003.2646499229.0000000001011000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2646636082.0000000001017000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2622538163.0000000001019000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2646669500.0000000001019000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2616118705.0000000001012000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ItQegq4KuCKrUeyRbO71YP7nEBBLPLkYmFsftqEMuZoh
Source: a17088d8c7.exe, 0000000D.00000003.3078884337.00000000055D4000.00000004.00000020.00020000.00000000.sdmp, a17088d8c7.exe, 0000000D.00000003.3117232730.00000000055D4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWZ:u
Source: f039f524ee.exe, 0000000F.00000003.2848661309.0000000000FB0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWQ
Source: file.exe, 00000000.00000002.2107233640.0000000000E45000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWhw
Source: file.exe, 00000000.00000002.2107233640.0000000000E71000.00000004.00000020.00020000.00000000.sdmp, a17088d8c7.exe, 0000000D.00000003.3078884337.00000000055D4000.00000004.00000020.00020000.00000000.sdmp, a17088d8c7.exe, 0000000D.00000003.3117232730.00000000055D4000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2848661309.0000000000FB0000.00000004.00000020.00020000.00000000.sdmp, f377015f96.exe, 00000010.00000002.2681962698.00000000015CF000.00000004.00000020.00020000.00000000.sdmp, 18d00389b3.exe, 00000012.00000003.2824173672.0000000001801000.00000004.00000020.00020000.00000000.sdmp, 18d00389b3.exe, 00000012.00000003.2818519812.00000000017FD000.00000004.00000020.00020000.00000000.sdmp, 18d00389b3.exe, 00000012.00000002.2849633497.0000000001802000.00000004.00000020.00020000.00000000.sdmp, f377015f96.exe, 00000019.00000002.2861247425.0000000001AD5000.00000004.00000020.00020000.00000000.sdmp, f377015f96.exe, 00000019.00000002.2861247425.0000000001AAA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.2107233640.0000000000E71000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW9
Source: f377015f96.exe, 00000019.00000002.2861247425.0000000001A6B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: f377015f96.exe, 00000010.00000002.2681962698.00000000015A4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW(F]
Source: firefox.exe, 00000020.00000002.2906223989.0000017CD50B5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW : 2 : 34 : 1 : 1 : 0x20026 : 0x8 : %SystemRoot%\system32\mswsock.dll : : 1234191b-4bf7-4ca7-86e0-dfd7c32b5445
Source: f039f524ee.exe, 0000000F.00000003.2589748747.0000000001021000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2589686211.000000000100F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: hi/UVNPhErBJsEzz8BycqmCn70pmM0K3FspTC9nXO+nZZIRTzaVB7hz6Xp6Ze8CjPr2bcAcrXrlZmEtq2Ycn78RigFzD7UHsEKsm7udUju1unb1OKGAR+kDTHl+I3R73wnGXZO6ACq5b7Vn49QKOsT/+9wx0MEWqAYhBTNeJae+UOcYegrMKuFusF62mT8C2PKypXzBoV8do6hBSkJMs/sVfqn/JoFrtCuYdtutjxbQ+s75RIn0h713ZGki1nT/+xVzORcWoUeBK7UOgp1nJixCQol0lZSHvVc4UE9fQJrmMWNRCzLZFrAr4F6uxS4GgLbDvY2grCLkOmD9ej5c4uZohkhCa8wSgH/pZ+PceleB96f8OOSUJuUCYSwHX0Du5jCHTU9CzTOMN6F6emW3DuS+5vUozZgD3UOYtf5SGLuHfb5pTgu8K71uzIOCLQdiyP+XjWiYrL7cWwFML2bwk79Nw2XzPt034EOUXo+cCjrNu5v0SZm8BuQ6IQQjMw36phn7aSYK3CrhJpVmy5xSO8i2svVolfRO+aOYlWZ7SCfrCItQegq4KuCKrUeyRbO71YP7nEBBLPLkYmFsftqEMuZoh3BzljmSgVatR7Ih97vVg/ucQKWsd4xaWUxvVswnflC/UGI6FZNpbpVno63runG7w7xRqQTDSFpZTG9WGM++UXtoQ2uESoDToEq7lbcC+KbK5TWtdGv522wUT19AvuYww2hDGsAq4S7lC9fQbnucx8LYcMCtIqxiYARPB0Aih6l+mf+GKZKBVqxbg/3WO/WKfg3NmJVCxGuo8d9neabGYU7t8gu8KqFfZNo7nAo79D52OdgEnItYWllMb1aUb1pQv1BiOk2WgVatR7JB9/vUR8O9EZjNQ1lXTHRG4niL+2HeFHfCmT+MK/Ajg6QzI9Xbv4RwielChBopIBsrHeavLL40Q1OESslWrC+D/DIm7I7+sUiV5Av9VzhAUp64G+t9vlFvSp3TeKv0UsKAMgPUh/vdlZiNc/1aYLB3ZiGmhlE6XW8zja+4Q7BW2tgHhtiWwr1c2bVC3Ft5TC8jeaf3FIcwAkPofs0y7S7/pVY6jbub9EmZ5UKEWnxBBi5Yq79cmqm7FjgjBFeAerLEMgPUh/vdlZiNc/1XOUx3Z2GX/13fbQciuCq5bo1WmpFqBoC2w7xJmI1z+WdZTbNfQMbmMIbtTya8IwRXgHqyxXYOSIZ+hVyFnBrkYmBUTwcFnudBw1AiS8xG1SLxJ8rhz0Q==
Source: file.exe, 00000000.00000002.2107629430.000000000138B000.00000040.00000001.01000000.00000003.sdmp, BAKFCBFHJD.exe, 00000009.00000002.2157881884.0000000000673000.00000040.00000001.01000000.0000000B.sdmp, BAKFCBFHJD.exe, 00000009.00000000.2088224331.0000000000673000.00000080.00000001.01000000.0000000B.sdmp, skotes.exe, 0000000A.00000002.2198440738.0000000001133000.00000040.00000001.01000000.0000000D.sdmp, skotes.exe, 0000000A.00000000.2127869098.0000000001133000.00000080.00000001.01000000.0000000D.sdmp, skotes.exe, 0000000B.00000000.2132260235.0000000001133000.00000080.00000001.01000000.0000000D.sdmp, skotes.exe, 0000000B.00000002.2199681608.0000000001133000.00000040.00000001.01000000.0000000D.sdmp, skotes.exe, 0000000C.00000000.2299229146.0000000001133000.00000080.00000001.01000000.0000000D.sdmp, f377015f96.exe, 00000010.00000002.2679711119.000000000118B000.00000040.00000001.01000000.00000010.sdmp, f377015f96.exe, 00000019.00000002.2850082344.000000000118B000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: firefox.exe, 00000022.00000002.2931706128.0000029454540000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: f377015f96.exe, 00000019.00000002.2861247425.0000000001AD5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWD

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	API call chain: ExitProcess graph end node

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Checks for debuggers (devices)

Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: SIWVID

Checks for kernel debuggers (NtQuerySystemInformation(SystemKernelDebuggerInformation))

Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe

System information queried: KernelDebuggerInformation

Checks if the current process is being debugged

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process queried: DebugPort

Contains functionality for execution timing, often used to detect debuggers

Source: C:\Users\user\Documents\BAKFCBFHJD.exe

Code function: 9_2_05220D46 rdtsc

9_2_05220D46

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Source: C:\Users\user\Desktop\file.exe

0_2_6C4B5FF0

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C4BC410 LoadLibraryW,GetProcAddress,FreeLibrary,

0_2_6C4BC410

Contains functionality to read the PEB

Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Code function: 9_2_004B652B mov eax, dword ptr fs:[00000030h]	9_2_004B652B
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Code function: 9_2_004BA302 mov eax, dword ptr fs:[00000030h]	9_2_004BA302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 10_2_00F7A302 mov eax, dword ptr fs:[00000030h]	10_2_00F7A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 10_2_00F7652B mov eax, dword ptr fs:[00000030h]	10_2_00F7652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 11_2_00F7A302 mov eax, dword ptr fs:[00000030h]	11_2_00F7A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 11_2_00F7652B mov eax, dword ptr fs:[00000030h]	11_2_00F7652B

Enables debug privileges

Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C48B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_6C48B66C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C48B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6C48B1F7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C63AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6C63AC62

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: file.exe PID: 3152, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: f377015f96.exe PID: 8, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: f377015f96.exe PID: 5228, type: MEMORYSTR

Excessive usage of taskkill to terminate processes

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T

Creates a process in suspended mode (likely to inject code)

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\BAKFCBFHJD.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Documents\BAKFCBFHJD.exe "C:\Users\user\Documents\BAKFCBFHJD.exe"	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe "C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe "C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe "C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe "C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe "C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=f039f524ee.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=f039f524ee.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=f039f524ee.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=f039f524ee.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process created: unknown unknown

Uses taskkill to terminate processes

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T

Source: C:\Users\user\Desktop\file.exe

0_2_6C684760

Source: 18d00389b3.exe, 00000012.00000000.2682081483.00000000008E2000.00000002.00000001.01000000.00000011.sdmp	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: file.exe, file.exe, 00000000.00000002.2107629430.000000000138B000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: dProgram Manager
Source: firefox.exe, 00000020.00000002.2896023910.00000018880BB000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: ?ProgmanListenerWi
Source: BAKFCBFHJD.exe, 00000009.00000002.2158184442.00000000006B7000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, 0000000A.00000002.2198597904.0000000001177000.00000040.00000001.01000000.0000000D.sdmp, skotes.exe, 0000000B.00000002.2199941474.0000000001177000.00000040.00000001.01000000.0000000D.sdmp	Binary or memory string: ^lProgram Manager

Contains functionality to query CPU information (cpuid)

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C48B341 cpuid

0_2_6C48B341

Queries information about the installed CPU (vendor, model number etc)

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Queries the volume information (name, serial number etc) of a device

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\file.exe

0_2_6C4535A0

Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Lowering of HIPS / PFW / Operating System Security Settings

Disable Windows Defender notifications (registry)

Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe

Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1

Disable Windows Defender real time protection (registry)

Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableIOAVProtection 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRealtimeMonitoring 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	Registry value created: DisableNotifications 1

Disables Windows Defender Tamper protection

Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe

Registry value created: TamperProtection 0

Modifies windows update settings

Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AutoInstallMinorUpdates
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotConnectToWindowsUpdateInternetLocations

AV process strings found (often used to terminate AV products)

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 11.2.skotes.exe.f40000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.skotes.exe.f40000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.BAKFCBFHJD.exe.480000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.2153108799.0000000000481000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2198230771.0000000000F41000.00000040.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2199343337.0000000000F41000.00000040.00000001.01000000.0000000D.sdmp, type: MEMORY

Yara detected Credential Flusher

Source: Yara match

File source: Process Memory Space: 18d00389b3.exe PID: 3284, type: MEMORYSTR

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: f039f524ee.exe PID: 6696, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: f039f524ee.exe PID: 2840, type: MEMORYSTR

Yara detected Stealc

Source: Yara match	File source: 00000000.00000003.1658639876.0000000005220000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000031.00000002.3117979567.0000000000DB1000.00000040.00000001.01000000.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.2848099754.0000000000DB1000.00000040.00000001.01000000.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2107422140.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.2629217512.00000000050B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.2861247425.0000000001A6B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000031.00000003.3020544677.0000000004B00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000003.2757599430.00000000056A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.2681962698.000000000155E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.2679338417.0000000000DB1000.00000040.00000001.01000000.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000031.00000002.3112834532.000000000068B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2107233640.0000000000DFE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 3152, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: f377015f96.exe PID: 8, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: f377015f96.exe PID: 5228, type: MEMORYSTR

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 3152, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.2107422140.0000000001034000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2107422140.0000000001034000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2107422140.0000000001034000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2107422140.0000000001117000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Jaxx Liberty
Source: file.exe, 00000000.00000002.2107422140.0000000001034000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2107422140.0000000001034000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2107422140.0000000001034000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2107422140.0000000001034000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2107422140.0000000001034000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2107422140.0000000001034000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2107422140.0000000001034000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2107422140.0000000001034000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2107422140.0000000001034000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2107422140.0000000001034000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2107422140.0000000001034000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2107422140.0000000001034000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2107422140.0000000001034000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2107422140.0000000001034000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2107422140.0000000001034000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2107422140.0000000001034000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2107422140.0000000001034000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2107233640.0000000000E71000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\.

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Searches for user specific document files

Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents\JSDNGYCOWY
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents\JSDNGYCOWY
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents\JSDNGYCOWY
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents\JSDNGYCOWY
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents\SQRKHNBNYN
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents\SQRKHNBNYN
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents\JSDNGYCOWY
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents\JSDNGYCOWY
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents\SQRKHNBNYN
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents\SQRKHNBNYN
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents\WKXEWIOTXI
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents\WKXEWIOTXI
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN

Yara detected Credential Stealer

Source: Yara match	File source: 0000000F.00000003.2681081649.0000000001018000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2680221886.0000000001018000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2673800698.0000000001018000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2646499229.0000000001011000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.2809295731.00000000011E3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.2713156874.00000000011D8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2678578144.0000000001018000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2673028661.0000000001017000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2675427284.0000000001018000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2682030732.000000000101F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2678009352.0000000001018000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2680574921.0000000001018000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2678906552.0000000001018000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2681445195.0000000001018000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.2803779137.00000000011DC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.2809371493.00000000011F2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2679263353.0000000001018000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.2803011829.00000000011D8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2675179858.0000000001018000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2679554542.0000000001018000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2678083034.0000000001018000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2678456559.0000000001018000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2678381424.0000000001018000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2680795575.0000000001018000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2680339133.0000000001018000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2679363395.0000000001018000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2646636082.0000000001017000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.2771485025.00000000011DD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2679980400.0000000001018000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2673739066.0000000001018000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2680696251.0000000001018000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.2742195555.00000000011D8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.2742444167.00000000011DB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2680117370.0000000001018000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2674348099.0000000001018000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.2809334415.00000000011EA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2672861730.0000000001011000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2678514734.0000000001018000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.2770447800.00000000011D8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2679869482.0000000001018000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.2713492473.00000000011D9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.2814773574.00000000011F3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2677615654.0000000001018000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2622538163.0000000001019000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2678714450.0000000001018000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.2776788243.00000000011DD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2679680520.0000000001018000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.2771976922.00000000011DD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2677513754.0000000001018000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2678158093.0000000001018000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2646669500.0000000001019000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2674962634.0000000001018000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2673677963.0000000001018000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2589686211.000000000100F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2673586366.0000000001018000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2675285735.0000000001018000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2679462403.0000000001018000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2679006727.0000000001018000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.2775962014.00000000011DD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2679087482.0000000001018000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2678304397.0000000001018000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2680932860.0000000001018000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2673513530.0000000001018000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2678818521.0000000001018000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2616118705.0000000001012000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 3152, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: f039f524ee.exe PID: 6696, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: f039f524ee.exe PID: 2840, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""

Yara detected Credential Flusher

Source: Yara match

File source: Process Memory Space: 18d00389b3.exe PID: 3284, type: MEMORYSTR

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: f039f524ee.exe PID: 6696, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: f039f524ee.exe PID: 2840, type: MEMORYSTR

Yara detected Stealc

Source: Yara match	File source: 00000000.00000003.1658639876.0000000005220000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000031.00000002.3117979567.0000000000DB1000.00000040.00000001.01000000.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.2848099754.0000000000DB1000.00000040.00000001.01000000.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2107422140.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.2629217512.00000000050B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.2861247425.0000000001A6B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000031.00000003.3020544677.0000000004B00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000003.2757599430.00000000056A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.2681962698.000000000155E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.2679338417.0000000000DB1000.00000040.00000001.01000000.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000031.00000002.3112834532.000000000068B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2107233640.0000000000DFE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 3152, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: f377015f96.exe PID: 8, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: f377015f96.exe PID: 5228, type: MEMORYSTR

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 3152, type: MEMORYSTR

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C640C40 sqlite3_bind_zeroblob,	0_2_6C640C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C640D60 sqlite3_bind_parameter_name,	0_2_6C640D60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C568EA0 sqlite3_clear_bindings,	0_2_6C568EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C640B40 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob,	0_2_6C640B40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C566410 bind,WSAGetLastError,	0_2_6C566410
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C56C050 sqlite3_bind_parameter_index,strlen,strncmp,strncmp,	0_2_6C56C050
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C566070 PR_Listen,	0_2_6C566070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C56C030 sqlite3_bind_parameter_count,	0_2_6C56C030
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5660B0 listen,WSAGetLastError,	0_2_6C5660B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4F22D0 sqlite3_bind_blob,	0_2_6C4F22D0

Windows Analysis Report
file.exe

Overview

General Information

Detection

Signatures

Classification

Malware Threat Intel
Provided by

Signatures

AV Detection

Cryptography

Phishing

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted URLs

ID:	1571960
Product:	CloudBasic
Start time:	22:34:07
Start date:	09.12.2024
Sample:	file.exe
Cookbook:	default.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	cbf2b84f9b993a77c0e2170cccbacb7c
SHA1:	33fdf37b3a3f1394edc5d64c0952064b7f4177ea
SHA256:	9c9687e8c61b784d08f6d80853666faa0884043ce7b99f4fb3676f3bc563c2f5
Filetype:	Win32 Executable (generic) a (10002005/4) 99.96%

Name	Type	MD5	SHA1	SHA256
C:\ProgramData\CBKJEGCBKKJECBGCGDBAKJEBAA	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3	369B6DD66F1CAD49D0952C40FEB9AD41	D05B2DE29433FB113EC4C558FF33087ED7481DD4	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
C:\ProgramData\EBGCGHIDHCBFHIDGHCBK	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1	28222628A3465C5F0D4B28F70F97F482	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
C:\ProgramData\HDAFBGIJ	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2	780853CDDEAEE8DE70F28A4B255A600B	AD7A5DA33F7AD12946153C497E990720B09005ED	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
C:\ProgramData\JDBGHIIDAECBFIDHIIDG	ASCII text, with very long lines (1809), with CRLF line terminators	5D8E5D85E880FB2D153275FCBE9DA6E5	72332A8A92B77A8B1E3AA00893D73FC2704B0D13	50490DC0D0A953FA7D5E06105FE9676CDB9B49C399688068541B19DD911B90F9
C:\ProgramData\JECGIIIDAKJDHJKFHIEB	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1	349E6EB110E34A08924D92F6B334801D	BDFB289DAFF51890CC71697B6322AA4B35EC9169	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
C:\ProgramData\JJKFBAKFBGDHIEBGDAKFCAFHCB	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2	C0FDF21AE11A6D1FA1201D502614B622	11724034A1CC915B061316A96E79E9DA6A00ADE8	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
C:\ProgramData\KFIIJJJD	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3	28591AA4E12D1C4FC761BE7C0A468622	BC4968A84C19377D05A8BB3F208FBFAC49F4820B	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
C:\ProgramData\freebl3.dll	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows	550686C0EE48C386DFCB40199BD076AC	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
C:\ProgramData\mozglue.dll	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows	C8FD9BE83BC728CC04BEFFAFC2907FE9	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
C:\ProgramData\msvcp140.dll	PE32 executable (DLL) (console) Intel 80386, for MS Windows	5FF1FCA37C466D6723EC67BE93B51442	34CC4E158092083B13D67D6D2BC9E57B798A303B	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
C:\ProgramData\nss3.dll	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows	1CC453CDF74F31E4D913FF9C10ACDDE2	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
C:\ProgramData\softokn3.dll	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows	4E52D739C324DB8225BD9AB2695F262F	71C3DA43DC5A0D2A1941E874A6D015A071783889	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
C:\ProgramData\vcruntime140.dll	PE32 executable (DLL) (console) Intel 80386, for MS Windows	A37EE36B536409056A86F50E67777DD7	1CAFA159292AA736FC595FC04E16325B27CD6750	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\9f6ad733e2.exe.log	CSV text	3A8957C6382192B71471BD14359D0B12	71B96C965B65A051E7E7D10F61BEBD8CCBB88587	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\add[1].htm	very short file (no magic)	CFCD208495D565EF66E7DFF9F98764DA	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\download[1].htm	very short file (no magic)	CFCD208495D565EF66E7DFF9F98764DA	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	PE32 executable (GUI) Intel 80386, for MS Windows	52F0F216DFBB86683B1E318A0796DD81	2E2B8710E0A077ED8A2124FDE2486F397857B8F6	1D95373C2284B657B614F07051EED5FED72F34F787350409E49E8DC30A5EA494
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	PE32 executable (GUI) Intel 80386, for MS Windows	6CFAA4B02B026AA1631EDA2E570A1298	28724AB39CD0F9F86C80C1F1FCEDCA8DDE14E77F	2A68C5304DEEBB741759B134BE32D6C0F8E64DFBB8C06D9765E3035D3AF6CBFD
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows	550686C0EE48C386DFCB40199BD076AC	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\fuckingdllENCR[1].dll	data	E6743949BBF24B39B25399CD7C5D3A2E	DBE84C91A9B0ACCD2C1C16D49B48FAEAEC830239	A3B82FC46635A467CC8375D40DDBDDD71CAE3B7659D2BB5C3C4370930AE9468C
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows	C8FD9BE83BC728CC04BEFFAFC2907FE9	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll	PE32 executable (DLL) (console) Intel 80386, for MS Windows	5FF1FCA37C466D6723EC67BE93B51442	34CC4E158092083B13D67D6D2BC9E57B798A303B	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows	1CC453CDF74F31E4D913FF9C10ACDDE2	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	PE32 executable (GUI) Intel 80386, for MS Windows	F5DB9DCEA4098275CB46B5D6FE73CEF8	9B623E4CFFF93BFFBAF7034EBBF893773700BA94	34959918550EF8A11FE8E0EF9DDE5F85F0DAC541E62A2CAD53998D4A0EB07D9D
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[2].exe	PE32 executable (GUI) Intel 80386, for MS Windows	5DD5F67D25C20DFF1AC926ABDC8C2EB0	E166D8E6544D137AE62FE204C59E53C962342703	9661D8306B9BF658642A01718AC746113E19741A560A48A5583BACD52998AF22
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows	4E52D739C324DB8225BD9AB2695F262F	71C3DA43DC5A0D2A1941E874A6D015A071783889	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll	PE32 executable (DLL) (console) Intel 80386, for MS Windows	A37EE36B536409056A86F50E67777DD7	1CAFA159292AA736FC595FC04E16325B27CD6750	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\download[1].htm	very short file (no magic)	CFCD208495D565EF66E7DFF9F98764DA	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe	PE32 executable (GUI) Intel 80386, for MS Windows	08EFA0BF248584557641DC5DB156248E	8B64A7D0EA9AF4524E7BE713BA22AB0191528403	15DF6347F76B4D0C86E07C4482E0B81B119265A4DD71F2C729C6BCC59E1CFA9B
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\json[1].json	JSON data	E6318C4EBADAA27E2EEC6CC15E611EF4	B7242AB0238DB8CF45FA5A669ECDDBDCAC5B4EFA	CA1624D70035400AAF36576B6F9FDB71DBE0105DE295926D514829B1B02558D5
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\key[1].htm	ASCII text, with no line terminators	408E94319D97609B8E768415873D5A14	E1F56DE347505607893A0A1442B6F3659BEF79C4	E29A4FD2CB1F367A743EA7CFD356DBD19AEB271523BBAE49D4F53257C3B0A78D
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe	PE32 executable (GUI) Intel 80386, for MS Windows	CBF2B84F9B993A77C0E2170CCCBACB7C	33FDF37B3A3F1394EDC5D64C0952064B7F4177EA	9C9687E8C61B784D08F6D80853666FAA0884043CE7B99F4FB3676F3BC563C2F5
C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	PE32 executable (GUI) Intel 80386, for MS Windows	08EFA0BF248584557641DC5DB156248E	8B64A7D0EA9AF4524E7BE713BA22AB0191528403	15DF6347F76B4D0C86E07C4482E0B81B119265A4DD71F2C729C6BCC59E1CFA9B
C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	PE32 executable (GUI) Intel 80386, for MS Windows	52F0F216DFBB86683B1E318A0796DD81	2E2B8710E0A077ED8A2124FDE2486F397857B8F6	1D95373C2284B657B614F07051EED5FED72F34F787350409E49E8DC30A5EA494
C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	PE32 executable (GUI) Intel 80386, for MS Windows	CBF2B84F9B993A77C0E2170CCCBACB7C	33FDF37B3A3F1394EDC5D64C0952064B7F4177EA	9C9687E8C61B784D08F6D80853666FAA0884043CE7B99F4FB3676F3BC563C2F5
C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	PE32 executable (GUI) Intel 80386, for MS Windows	5DD5F67D25C20DFF1AC926ABDC8C2EB0	E166D8E6544D137AE62FE204C59E53C962342703	9661D8306B9BF658642A01718AC746113E19741A560A48A5583BACD52998AF22
C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	PE32 executable (GUI) Intel 80386, for MS Windows	6CFAA4B02B026AA1631EDA2E570A1298	28724AB39CD0F9F86C80C1F1FCEDCA8DDE14E77F	2A68C5304DEEBB741759B134BE32D6C0F8E64DFBB8C06D9765E3035D3AF6CBFD
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	PE32 executable (GUI) Intel 80386, for MS Windows	F5DB9DCEA4098275CB46B5D6FE73CEF8	9B623E4CFFF93BFFBAF7034EBBF893773700BA94	34959918550EF8A11FE8E0EF9DDE5F85F0DAC541E62A2CAD53998D4A0EB07D9D
C:\Users\user\AppData\Local\Temp\mozilla-temp-files\mozilla-temp-41	ISO Media, MP4 Base Media v1 [ISO 14496-12:2003]	D910AD167F0217587501FDCDB33CC544	2F57441CEFDC781011B53C1C5D29AC54835AFC1D	E3699D9404A3FFC1AFF0CA8A3972DC0EF38BDAB927741E9F627C7C55CEA42E81
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\compatibility.ini	Windows WIN.INI	3FB561547A46AF02D6B00F86DC370634	914867E4C763611B441835A3FC0082359FBF7277	5393F0E8D90EE6A26EAC13B81B83EDC0637487B3E427175021D7EC4CDE8E34A7
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm	data	B7C14EC6110FA820CA6B65F5AEC85911	608EEB7488042453C9CA40F7E1398FC1A270F3F4	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm	data	B7C14EC6110FA820CA6B65F5AEC85911	608EEB7488042453C9CA40F7E1398FC1A270F3F4	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs-1.js	ASCII text, with very long lines (1809), with CRLF line terminators	89E48DC70301B6046DB08C965BE017EA	3E2FB04E222CEDCBEDC0942B86DE5413218DF07D	C83FFD272EC8696F9597F89456B728B9A5DFF6590A6AAAF167CEB94E6E467E40
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js (copy)	ASCII text, with very long lines (1809), with CRLF line terminators	89E48DC70301B6046DB08C965BE017EA	3E2FB04E222CEDCBEDC0942B86DE5413218DF07D	C83FFD272EC8696F9597F89456B728B9A5DFF6590A6AAAF167CEB94E6E467E40
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionCheckpoints.json (copy)	JSON data	EA8B62857DFDBD3D0BE7D7E4A954EC9A	B43BC4B3EA206A02EF8F63D5BFAD0C96BF2A3B2A	792955295AE9C382986222C6731C5870BD0E921E7F7E34CC4615F5CD67F225DA
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionCheckpoints.json.tmp	JSON data	EA8B62857DFDBD3D0BE7D7E4A954EC9A	B43BC4B3EA206A02EF8F63D5BFAD0C96BF2A3B2A	792955295AE9C382986222C6731C5870BD0E921E7F7E34CC4615F5CD67F225DA
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage.sqlite	SQLite 3.x database, user version 131075, last written using SQLite version 3042000, page size 512, file counter 6, database pages 8, cookie 0x4, schema 4, UTF-8, version-valid-for 6	8B40B1534FF0F4B533AF767EB5639A05	63EDB539EA39AD09D701A36B535C4C087AE08CC9	AF275A19A5C2C682139266065D90C237282274D11C5619A121B7BDBDB252861B
C:\Users\user\Documents\BAKFCBFHJD.exe	PE32 executable (GUI) Intel 80386, for MS Windows	F5DB9DCEA4098275CB46B5D6FE73CEF8	9B623E4CFFF93BFFBAF7034EBBF893773700BA94	34959918550EF8A11FE8E0EF9DDE5F85F0DAC541E62A2CAD53998D4A0EB07D9D
C:\Windows\Tasks\skotes.job	data	8D0CDF5AE530669BAEEEFF296E1D77C7	F8F2D66A827109E14CC95FAEEB5DB8BD054554B8	68C23AEE6472B775A6BAFD8E45618FC4F542A7AEEE132DDA40D3AA9A738E8B78

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Malware Threat Intel Provided by

Signatures

AV Detection

Cryptography

Phishing

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted URLs

Windows Analysis Report
file.exe

Malware Threat Intel
Provided by