Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1571960
MD5:	cbf2b84f9b993a77c0e2170cccbacb7c
SHA1:	33fdf37b3a3f1394edc5d64c0952064b7f4177ea
SHA256:	9c9687e8c61b784d08f6d80853666faa0884043ce7b99f4fb3676f3bc563c2f5
Tags:	exeuser-Bitsight
Infos:

Detection

Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected Amadeys stealer DLL

Yara detected Credential Flusher

Yara detected LummaC Stealer

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

C2 URLs / IPs found in malware configuration

Creates multiple autostart registry keys

Disable Windows Defender notifications (registry)

Disable Windows Defender real time protection (registry)

Disables Windows Defender Tamper protection

Drops PE files to the document folder of the user

Excessive usage of taskkill to terminate processes

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies windows update settings

PE file contains section with special chars

Query firmware table information (likely to detect VMs)

Sigma detected: New RUN Key Pointing to Suspicious Folder

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Checks for debuggers (devices)

Checks for kernel debuggers (NtQuerySystemInformation(SystemKernelDebuggerInformation))

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Enables debug privileges

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Searches for user specific document files

Sigma detected: Browser Started with Remote Debugging

Sigma detected: CurrentVersion Autorun Keys Modification

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Uses taskkill to terminate processes

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 3152 cmdline: "C:\Users\user\Desktop\file.exe" MD5: CBF2B84F9B993A77C0E2170CCCBACB7C)

chrome.exe (PID: 7156 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7416 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2588 --field-trial-handle=2076,i,11101187424602966218,1363370709843346949,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cmd.exe (PID: 1516 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\BAKFCBFHJD.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5664 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

BAKFCBFHJD.exe (PID: 3220 cmdline: "C:\Users\user\Documents\BAKFCBFHJD.exe" MD5: F5DB9DCEA4098275CB46B5D6FE73CEF8)

skotes.exe (PID: 7516 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: F5DB9DCEA4098275CB46B5D6FE73CEF8)

skotes.exe (PID: 7760 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: F5DB9DCEA4098275CB46B5D6FE73CEF8)

skotes.exe (PID: 7344 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: F5DB9DCEA4098275CB46B5D6FE73CEF8)

a17088d8c7.exe (PID: 8004 cmdline: "C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe" MD5: 08EFA0BF248584557641DC5DB156248E)

f039f524ee.exe (PID: 6696 cmdline: "C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe" MD5: 52F0F216DFBB86683B1E318A0796DD81)

chrome.exe (PID: 3344 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=f039f524ee.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7184 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2448 --field-trial-handle=2280,i,510515106440553161,2480043565169282240,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 5184 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=f039f524ee.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6052 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2084 --field-trial-handle=1932,i,2083666299261817870,13908559142850350553,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

f377015f96.exe (PID: 8 cmdline: "C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe" MD5: CBF2B84F9B993A77C0E2170CCCBACB7C)

18d00389b3.exe (PID: 3284 cmdline: "C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe" MD5: 5DD5F67D25C20DFF1AC926ABDC8C2EB0)

taskkill.exe (PID: 2364 cmdline: taskkill /F /IM firefox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 980 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 4112 cmdline: taskkill /F /IM chrome.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 3964 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 2144 cmdline: taskkill /F /IM msedge.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 3848 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 1700 cmdline: taskkill /F /IM opera.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 5472 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 7716 cmdline: taskkill /F /IM brave.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 4556 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

firefox.exe (PID: 7664 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

9f6ad733e2.exe (PID: 7252 cmdline: "C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe" MD5: 6CFAA4B02B026AA1631EDA2E570A1298)

f039f524ee.exe (PID: 2840 cmdline: "C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe" MD5: 52F0F216DFBB86683B1E318A0796DD81)

chrome.exe (PID: 8068 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=f039f524ee.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 1076 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1956 --field-trial-handle=1860,i,10040747374664479283,16727769951129841397,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7444 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=f039f524ee.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

f377015f96.exe (PID: 5228 cmdline: "C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe" MD5: CBF2B84F9B993A77C0E2170CCCBACB7C)

firefox.exe (PID: 7184 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 7196 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 3720 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2272 -parentBuildID 20230927232528 -prefsHandle 2196 -prefMapHandle 2176 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0e2b88bc-fb1b-4ee6-b399-2d0b61fdaa7d} 7196 "\\.\pipe\gecko-crash-server-pipe.7196" 17cc9869f10 socket MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 420 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4500 -parentBuildID 20230927232528 -prefsHandle 4492 -prefMapHandle 4488 -prefsLen 26374 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {91de2f66-b71a-414e-a97d-01546071d5ac} 7196 "\\.\pipe\gecko-crash-server-pipe.7196" 17cc987e310 rdd MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

18d00389b3.exe (PID: 2844 cmdline: "C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe" MD5: 5DD5F67D25C20DFF1AC926ABDC8C2EB0)

taskkill.exe (PID: 7924 cmdline: taskkill /F /IM firefox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 8148 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 8112 cmdline: taskkill /F /IM chrome.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 4428 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 3140 cmdline: taskkill /F /IM msedge.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 3588 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 1260 cmdline: taskkill /F /IM opera.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 3752 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 7732 cmdline: taskkill /F /IM brave.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 3192 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

firefox.exe (PID: 704 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 280 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 7984 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2320 -parentBuildID 20230927232528 -prefsHandle 2264 -prefMapHandle 2260 -prefsLen 25359 -prefMapSize 238769 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2b17f485-0e86-472e-88cf-afe23e104bea} 280 "\\.\pipe\gecko-crash-server-pipe.280" 234f4b6a910 socket MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

taskkill.exe (PID: 3660 cmdline: taskkill /F /IM firefox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 5904 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 3660 cmdline: taskkill /F /IM chrome.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 7724 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

f039f524ee.exe (PID: 1628 cmdline: "C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe" MD5: 52F0F216DFBB86683B1E318A0796DD81)

f377015f96.exe (PID: 5064 cmdline: "C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe" MD5: CBF2B84F9B993A77C0E2170CCCBACB7C)

f039f524ee.exe (PID: 7624 cmdline: "C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe" MD5: 52F0F216DFBB86683B1E318A0796DD81)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/clickfix-tactic-the-phantom-meet/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/c4becf79229cb002.php"}

Threatname: LummaC

{"C2 url": ["impend-differ.biz", "dare-curbys.biz", "atten-supporse.biz", "formy-spill.biz", "se-blurry.biz", "covery-mover.biz", "print-vexer.biz", "dwell-exclaim.biz", "zinc-sneark.biz"], "Build id": "LOGS11--LiveTraffic"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
0000000F.00000003.2681081649.0000000001018000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1658639876.0000000005220000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000000F.00000003.2680221886.0000000001018000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000F.00000003.2673800698.0000000001018000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000F.00000003.2646499229.0000000001011000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000011.00000003.2809295731.00000000011E3000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000011.00000003.2713156874.00000000011D8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000F.00000003.2678578144.0000000001018000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000031.00000002.3117979567.0000000000DB1000.00000040.00000001.01000000.00000010.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000000F.00000003.2673028661.0000000001017000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000F.00000003.2675427284.0000000001018000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000019.00000002.2848099754.0000000000DB1000.00000040.00000001.01000000.00000010.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000000F.00000003.2682030732.000000000101F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2107422140.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000000F.00000003.2678009352.0000000001018000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000F.00000003.2680574921.0000000001018000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000F.00000003.2678906552.0000000001018000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000F.00000003.2681445195.0000000001018000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000011.00000003.2803779137.00000000011DC000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000011.00000003.2809371493.00000000011F2000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000F.00000003.2679263353.0000000001018000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000011.00000003.2803011829.00000000011D8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000F.00000003.2675179858.0000000001018000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000F.00000003.2679554542.0000000001018000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000F.00000003.2678083034.0000000001018000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000F.00000003.2678456559.0000000001018000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000F.00000003.2678381424.0000000001018000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000010.00000003.2629217512.00000000050B0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000000F.00000003.2680795575.0000000001018000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000F.00000003.2680339133.0000000001018000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000002.2153108799.0000000000481000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000F.00000003.2679363395.0000000001018000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000F.00000003.2646636082.0000000001017000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000011.00000003.2771485025.00000000011DD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000F.00000003.2679980400.0000000001018000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000F.00000003.2673739066.0000000001018000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000F.00000003.2680696251.0000000001018000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000011.00000003.2742195555.00000000011D8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000011.00000003.2742444167.00000000011DB000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000F.00000003.2680117370.0000000001018000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000019.00000002.2861247425.0000000001A6B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000000F.00000003.2674348099.0000000001018000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000011.00000003.2809334415.00000000011EA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000F.00000003.2672861730.0000000001011000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000031.00000003.3020544677.0000000004B00000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000000F.00000003.2678514734.0000000001018000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000011.00000003.2770447800.00000000011D8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000F.00000003.2679869482.0000000001018000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000011.00000003.2713492473.00000000011D9000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000019.00000003.2757599430.00000000056A0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000011.00000003.2814773574.00000000011F3000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000F.00000003.2677615654.0000000001018000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000F.00000003.2622538163.0000000001019000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000F.00000003.2678714450.0000000001018000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000011.00000003.2776788243.00000000011DD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000F.00000003.2679680520.0000000001018000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000A.00000002.2198230771.0000000000F41000.00000040.00000001.01000000.0000000D.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000011.00000003.2771976922.00000000011DD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000F.00000003.2677513754.0000000001018000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000F.00000003.2678158093.0000000001018000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000010.00000002.2681962698.000000000155E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000000F.00000003.2646669500.0000000001019000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000F.00000003.2674962634.0000000001018000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000F.00000003.2673677963.0000000001018000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000010.00000002.2679338417.0000000000DB1000.00000040.00000001.01000000.00000010.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000000F.00000003.2589686211.000000000100F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000F.00000003.2673586366.0000000001018000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000F.00000003.2675285735.0000000001018000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000F.00000003.2679462403.0000000001018000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000F.00000003.2679006727.0000000001018000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000011.00000003.2775962014.00000000011DD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000031.00000002.3112834532.000000000068B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000000F.00000003.2679087482.0000000001018000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000F.00000003.2678304397.0000000001018000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000F.00000003.2680932860.0000000001018000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000F.00000003.2673513530.0000000001018000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2107233640.0000000000DFE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000000F.00000003.2678818521.0000000001018000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000F.00000003.2616118705.0000000001012000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000B.00000002.2199343337.0000000000F41000.00000040.00000001.01000000.0000000D.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Process Memory Space: file.exe PID: 3152	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 3152	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 3152	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 3152	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: f039f524ee.exe PID: 6696	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: f039f524ee.exe PID: 6696	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: f039f524ee.exe PID: 6696	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: f377015f96.exe PID: 8	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: f377015f96.exe PID: 8	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: f039f524ee.exe PID: 2840	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: f039f524ee.exe PID: 2840	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: f039f524ee.exe PID: 2840	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 18d00389b3.exe PID: 3284	JoeSecurity_CredentialFlusher	Yara detected Credential Flusher	Joe Security
Process Memory Space: f377015f96.exe PID: 5228	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: f377015f96.exe PID: 5228	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 90 entries

Unpacked PEs

Source	Rule	Description	Author
11.2.skotes.exe.f40000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
10.2.skotes.exe.f40000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
9.2.BAKFCBFHJD.exe.480000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 7344, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\f039f524ee.exe

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 3152, ParentProcessName: file.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", ProcessId: 7156, ProcessName: chrome.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 7344, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\f039f524ee.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://atten-supporse.biz/apiluv	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phppresolver.dll	Avira URL Cloud: Label: malware
Source: https://atten-supporse.biz/U	Avira URL Cloud: Label: malware
Source: https://atten-supporse.biz/#4	Avira URL Cloud: Label: malware
Source: https://atten-supporse.biz/s4p6	Avira URL Cloud: Label: malware
Source: https://atten-supporse.biz/apiEW	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/mine/random.exeg	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phper	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Avira: detection malicious, Label: HEUR/AGEN.1320706
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Avira: detection malicious, Label: TR/Crypt.XPACK.Gen
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Avira: detection malicious, Label: TR/ATRAPS.Gen
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Avira: detection malicious, Label: TR/Crypt.XPACK.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	Avira: detection malicious, Label: TR/ATRAPS.Gen
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Avira: detection malicious, Label: HEUR/AGEN.1320706

Found malware configuration

Source: 00000009.00000002.2153108799.0000000000481000.00000040.00000001.01000000.0000000B.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 00000010.00000002.2681962698.000000000155E000.00000004.00000020.00020000.00000000.sdmp	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/c4becf79229cb002.php"}
Source: f039f524ee.exe.2840.17.memstrmin	Malware Configuration Extractor: LummaC {"C2 url": ["impend-differ.biz", "dare-curbys.biz", "atten-supporse.biz", "formy-spill.biz", "se-blurry.biz", "covery-mover.biz", "print-vexer.biz", "dwell-exclaim.biz", "zinc-sneark.biz"], "Build id": "LOGS11--LiveTraffic"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	ReversingLabs: Detection: 44%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[2].exe	ReversingLabs: Detection: 23%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe	ReversingLabs: Detection: 34%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe	ReversingLabs: Detection: 44%
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	ReversingLabs: Detection: 34%
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	ReversingLabs: Detection: 44%
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	ReversingLabs: Detection: 23%
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	ReversingLabs: Detection: 44%

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 44%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C466C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,	0_2_6C466C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5BA9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,	0_2_6C5BA9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5B4440 PK11_PrivDecrypt,	0_2_6C5B4440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C584420 SECKEY_DestroyEncryptedPrivateKeyInfo,memset,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,free,	0_2_6C584420
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5B44C0 PK11_PubEncrypt,	0_2_6C5B44C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6025B0 PK11_Encrypt,memcpy,PR_SetError,PK11_Encrypt,	0_2_6C6025B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5BA650 PK11SDR_Encrypt,PORT_NewArena_Util,PK11_GetInternalKeySlot,PK11_Authenticate,SECITEM_ZfreeItem_Util,TlsGetValue,EnterCriticalSection,PR_Unlock,PK11_CreateContextBySymKey,PK11_GetBlockSize,PORT_Alloc_Util,memcpy,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PORT_ArenaAlloc_Util,PK11_CipherOp,SEC_ASN1EncodeItem_Util,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,PK11_DestroyContext,	0_2_6C5BA650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C598670 PK11_ExportEncryptedPrivKeyInfo,	0_2_6C598670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C59E6E0 PK11_AEADOp,TlsGetValue,EnterCriticalSection,PORT_Alloc_Util,PK11_Encrypt,PORT_Alloc_Util,memcpy,memcpy,PR_SetError,PR_SetError,PR_Unlock,PR_SetError,PR_Unlock,PK11_Decrypt,PR_GetCurrentThread,PK11_Decrypt,PK11_Encrypt,memcpy,memcpy,PR_SetError,free,	0_2_6C59E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5DA730 SEC_PKCS12AddCertAndKey,PORT_ArenaMark_Util,PORT_ArenaMark_Util,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,PK11_GetInternalKeySlot,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,SECKEY_DestroyEncryptedPrivateKeyInfo,strlen,PR_SetError,PORT_FreeArena_Util,PORT_FreeArena_Util,PORT_ArenaAlloc_Util,PR_SetError,	0_2_6C5DA730
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E0180 SECMIME_DecryptionAllowed,SECOID_GetAlgorithmTag_Util,	0_2_6C5E0180

Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=f039f524ee.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=f039f524ee.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=f039f524ee.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2116362437.000000006C68F000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2116362437.000000006C68F000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: f039f524ee.exe, 00000011.00000003.3081089288.0000000008320000.00000004.00001000.00020000.00000000.sdmp, 9f6ad733e2.exe, 00000021.00000003.2802037515.0000000005190000.00000004.00001000.00020000.00000000.sdmp, 9f6ad733e2.exe, 00000021.00000002.2937994456.0000000000EF2000.00000040.00000001.01000000.00000014.sdmp
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmp

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: chrome.exe	Memory has grown: Private usage: 9MB later: 41MB
Source: firefox.exe	Memory has grown: Private usage: 1MB later: 95MB

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	URLs: impend-differ.biz
Source: Malware configuration extractor	URLs: dare-curbys.biz
Source: Malware configuration extractor	URLs: atten-supporse.biz
Source: Malware configuration extractor	URLs: formy-spill.biz
Source: Malware configuration extractor	URLs: se-blurry.biz
Source: Malware configuration extractor	URLs: covery-mover.biz
Source: Malware configuration extractor	URLs: print-vexer.biz
Source: Malware configuration extractor	URLs: dwell-exclaim.biz
Source: Malware configuration extractor	URLs: zinc-sneark.biz
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 1.1.1.1 1.1.1.1
Source: Joe Sandbox View	IP Address: 1.1.1.1 1.1.1.1

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C56CC60 PR_Recv,

0_2_6C56CC60

Source: firefox.exe, 00000020.00000002.2914904234.0000017CD7978000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD6757000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD6703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "url": "https://www.facebook.com/", equals www.facebook.com (Facebook)
Source: firefox.exe, 00000020.00000002.2914904234.0000017CD7978000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD6757000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD6703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "url": "https://www.youtube.com/", equals www.youtube.com (Youtube)
Source: firefox.exe, 00000020.00000002.2914904234.0000017CD7978000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD6703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.facebook.com (Facebook)
Source: firefox.exe, 00000020.00000002.2914904234.0000017CD7978000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD6703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.twitter.com (Twitter)
Source: firefox.exe, 00000020.00000002.2914904234.0000017CD7978000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD6703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.youtube.com (Youtube)
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: BETWEEN 'www.' \|\| :strippedURL AND 'www.' \|\| :strippedURL \|\| X'FFFF'The timing of the exposure event depends on the experiment, but generally the event is recorded when the user first encounters onboarding UI for the shopping feature.[{incognito:null, tabId:null, types:["image"], urls:["https://smartblock.firefox.etp/facebook.svg", "https://smartblock.firefox.etp/play.svg"], windowId:null}, ["blocking"]][{incognito:null, tabId:null, types:["image"], urls:["https://smartblock.firefox.etp/facebook.svg", "https://smartblock.firefox.etp/play.svg"], windowId:null}, ["blocking"]]X!p equals www.facebook.com (Facebook)
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5AE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "://.adsafeprotected.com//Serving/""://.adsafeprotected.com/jload""://pubads.g.doubleclick.net/gampad/ad""://vast.adsafeprotected.com/vast""://.adsafeprotected.com/jsvid?""://.adsafeprotected.com/jsvid?""://.adsafeprotected.com/jsvid""://.adsafeprotected.com/tpl?""://cdn.cmp.advertising.com/firefox-etp""://pubads.g.doubleclick.net/gampad/ad-blk""://pixel.advertising.com/firefox-etp""://vast.adsafeprotected.com/vast""://.adsafeprotected.com/services/pub""://track.adform.net/Serving/TrackPoint/""://securepubads.g.doubleclick.net/gampad/ad""://securepubads.g.doubleclick.net/gampad/ad""https://ads.stickyadstv.com/firefox-etp""://ads.stickyadstv.com/user-matching""://.adsafeprotected.com//adj""://.adsafeprotected.com//unit/""://.adsafeprotected.com/.png""://.adsafeprotected.com/jload?""://pubads.g.doubleclick.net/gampad/ad-blk""://pixel.advertising.com/firefox-etp""://.adsafeprotected.com/.gif""://.adsafeprotected.com/services/pub""://track.adform.net/Serving/TrackPoint/""://.adsafeprotected.com/.js""://.adsafeprotected.com//imp/""://.adsafeprotected.com/tpl?""://www.facebook.com/platform/impression.php""://ads.stickyadstv.com/auto-user-sync"Invalid argument passed to defaultEngine setterWebExtension engine check completegetDefaultEngineInfo: No default engineaddEnginesFromExtension: installing:nimbusPrivateDefaultUrlbarResultEnabledCan't find engine to remove in _sortedEngines!["://trends.google.com/trends/embed"]"://.adsafeprotected.com/.js""://pubads.g.doubleclick.net/gampad/ad""://.adsafeprotected.com//Serving/""://ads.stickyadstv.com/user-matching""://.adsafeprotected.com/jload?"#buildSortedEngineList: using saved order"://.adsafeprotected.com//unit/""://trends.google.com/trends/embed"#buildSortedEngineList: using default orders"://.adsafeprotected.com/tpl?""://.adsafeprotected.com//adj""://.adsafeprotected.com//imp/""://.adsafeprotected.com/jload""://trends.google.com/trends/embed"["://trends.google.com/trends/embed"]"://.adsafeprotected.com/.png""://.adsafeprotected.com/jsvid""://ads.stickyadstv.com/auto-user-sync""://.adsafeprotected.com/jsvid?""https://ads.stickyadstv.com/firefox-etp""://.adsafeprotected.com/services/pub"Running check on WebExtension enginesCould not find a replacement default engine."://www.facebook.com/platform/impression.php""://.adsafeprotected.com/.gif"@mozilla.org/widget/useridleservice;1addEnginesFromExtension/inConfig<Engine with updates found, setting update timer_sortEnginesByDefaults/remainingEngines<#findAndSetNewDefaultEngine/firstVisible<resource://gre/modules/DeferredTask.sys.mjsresource://gre/modules/ObjectUtils.sys.mjs#upgradeExtensionEngine/configuration<resource://gre/modules/SearchUtils.sys.mjsget: No settings file exists, new profile?batchTask: Invalidating engine settingsseperatePrivateDefaultUrlbarResultEnabled#buildSortedEngineList/filteredEngines<write-preve
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5AE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "://securepubads.g.doubleclick.net/gampad/ad-blk""https://static.adsafeprotected.com/firefox-etp-pixel""://tpc.googlesyndication.com/safeframe//html/container.html""://pagead2.googlesyndication.com/pagead/.jsfcd=true""://pagead2.googlesyndication.com/pagead/js/.jsfcd=true""://pubads.g.doubleclick.net/gampad/xml_vmap2""://pubads.g.doubleclick.net/gampad/xml_vmap1"resource://gre/modules/SearchSuggestionController.sys.mjs"://id.rambler.ru/rambler-id-helper/auth_events.js""://pubads.g.doubleclick.net/gampad/xml_vmap2""https://static.adsafeprotected.com/firefox-etp-pixel""://securepubads.g.doubleclick.net/gampad/xml_vmap2""https://static.adsafeprotected.com/firefox-etp-js""://www.gstatic.com/firebasejs//firebase-messaging.js""://securepubads.g.doubleclick.net/gampad/xml_vmap2""://securepubads.g.doubleclick.net/gampad/xml_vmap1""://media.richrelevance.com/rrserver/js/1.2/p13n.js""://vdb-cdn-files.s3.amazonaws.com//vidible-min.js""://securepubads.g.doubleclick.net/gampad/ad-blk""://securepubads.g.doubleclick.net/gampad/xml_vmap2""://securepubads.g.doubleclick.net/gpt/pubads_impl_.js""://pagead2.googlesyndication.com/gpt/pubads_impl_.js""://pubads.g.doubleclick.net/gampad/xml_vmap1""://pagead2.googlesyndication.com/tag/js/gpt.js""://securepubads.g.doubleclick.net/gampad/xml_vmap1""://pubads.g.doubleclick.net/gampad/xml_vmap1""://pubads.g.doubleclick.net/gampad/xml_vmap2""https://static.adsafeprotected.com/firefox-etp-pixel""://www.googleadservices.com/pagead/conversion_async.js""://securepubads.g.doubleclick.net/tag/js/gpt.js""://securepubads.g.doubleclick.net/gampad/ad-blk""://securepubads.g.doubleclick.net/gampad/xml_vmap1"ifnull(b.title, iif(h.frecency <> 0, h.title, NULL)) AS title, equals www.rambler.ru (Rambler)
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5AE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "://www.facebook.com/platform/impression.php" equals www.facebook.com (Facebook)
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://pubads.g.doubleclick.net/gampad/xml_vmap2://www.facebook.com/platform/impression.php://pubads.g.doubleclick.net/gampad/ad://.adsafeprotected.com//unit/--panel-banner-item-update-supported-bgcolor--panel-banner-item-info-icon-bgcolor://cdn.cmp.advertising.com/firefox-etp://.adsafeprotected.com/services/pubexecuteIDB/promise</transaction.onerror equals www.facebook.com (Facebook)
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://www.facebook.com/platform/impression.php equals www.facebook.com (Facebook)
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://www.gstatic.com/firebasejs//firebase-messaging.js*://pagead2.googlesyndication.com/pagead/.jsfcd=true://pagead2.googlesyndication.com/pagead/js/.jsfcd=true://securepubads.g.doubleclick.net/gampad/ad-blk*://securepubads.g.doubleclick.net/gampad/xml_vmap1*://tpc.googlesyndication.com/safeframe//html/container.htmlcolor-mix(in srgb, currentColor 14%, transparent)color-mix(in srgb, currentColor 25%, transparent)://securepubads.g.doubleclick.net/tag/js/gpt.js*://id.rambler.ru/rambler-id-helper/auth_events.jsopenIDB/</request.onupgradeneeded/transaction.onabort equals www.rambler.ru (Rambler)
Source: firefox.exe, 00000020.00000002.2910130082.0000017CD677D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: -l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"Wikipedia"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.reddit.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="R"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/reddit-com@2x.png)"></div></div></div><div class="title"><span dir="auto">Reddit<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"Reddit"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer hide-for-narrow"><div class="top-site-inner"><a class="top-site-button" href="https://twitter.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="T"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/twitter-com@2x.png)"></div></div></div><div class="title"><span dir="auto">Twitter<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"Twitter"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer placeholder hide-for-narrow"><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li></ul><div class="edit-topsites-wrapper"></div></div></section></div></div></div></div><style data-styles="[[null]]"></style></div><div class="discovery-stream ds-layout"><div class="ds-column ds-column-12"><div class="ds-column-grid"><div></div></div></div><style data-styles="[[null]]"></style></div></div></main></div></div> equals www.twitter.com (Twitter)
Source: firefox.exe, 00000020.00000002.2933948328.0000017CDA0BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2931947413.0000017CD9EF7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2933948328.0000017CDA07C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: FileUtils_closeSafeFileOutputStreamFileUtils_openSafeFileOutputStreamresource://gre/modules/addons/XPIProvider.jsmFileUtils_openAtomicFileOutputStreamwebcompat-reporter@mozilla.org.xpi@mozilla.org/network/atomic-file-output-stream;1webcompat-reporter%40mozilla.org:1.5.1https://smartblock.firefox.etp/facebook.svg@mozilla.org/addons/addon-manager-startup;1://cdn.branch.io/branch-latest.min.js@mozilla.org/network/safe-file-output-stream;1@mozilla.org/network/file-output-stream;1://pub.doubleverify.com/signals/pub.js://www.google-analytics.com/analytics.js://www.google-analytics.com/gtm/js://www.googletagmanager.com/gtm.js://ssl.google-analytics.com/ga.js://pagead2.googlesyndication.com/tag/js/gpt.js*://cdn.adsafeprotected.com/iasPET.1.js://static.adsafeprotected.com/iasPET.1.js://.moatads.com//moatheader.js://cdn.optimizely.com/public/.js://js.maxmind.com/js/apis/geoip2//geoip2.js://imasdk.googleapis.com/js/sdkloader/ima3.js://s.webtrends.com/js/advancedLinkTracking.js*://s.webtrends.com/js/webtrends.jsresource://gre/modules/ConduitsParent.sys.mjs equals www.facebook.com (Facebook)
Source: firefox.exe, 00000020.00000002.2933675468.0000017CD9F08000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ["://track.adform.net/Serving/TrackPoint/", "://pagead2.googlesyndication.com/pagead/.jsfcd=true", "://pagead2.googlesyndication.com/pagead/js/.jsfcd=true", "://pixel.advertising.com/firefox-etp", "://cdn.cmp.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "https://static.adsafeprotected.com/firefox-etp-js", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/*"] equals www.facebook.com (Facebook)
Source: firefox.exe, 00000020.00000002.2933675468.0000017CD9F08000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ["://track.adform.net/Serving/TrackPoint/", "://pixel.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/"] equals www.facebook.com (Facebook)
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A46000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ["://webcompat-addon-testbed.herokuapp.com/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js", "://track.adform.net/serving/scripts/trackpoint/", "://track.adform.net/serving/scripts/trackpoint/async/", "://.adnxs.com//ast.js", "://.adnxs.com//pb.js", "://.adnxs.com//prebid", "://www.everestjs.net/static/st.v3.js", "://static.adsafeprotected.com/vans-adapter-google-ima.js", "://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "://cdn.branch.io/branch-latest.min.js", "://pub.doubleverify.com/signals/pub.js", "://c.amazon-adsystem.com/aax2/apstag.js", "://auth.9c9media.ca/auth/main.js", "://static.chartbeat.com/js/chartbeat.js", "://static.chartbeat.com/js/chartbeat_video.js", "://static.criteo.net/js/ld/publishertag.js", "://.imgur.com/js/vendor..bundle.js", "://.imgur.io/js/vendor..bundle.js", "://www.rva311.com/static/js/main..chunk.js", "://web-assets.toggl.com/app/assets/scripts/.js", "://libs.coremetrics.com/eluminate.js", "://connect.facebook.net//sdk.js", "://connect.facebook.net//all.js", "://secure.cdn.fastclick.net/js/cnvr-launcher//launcher-stub.min.js", "://www.google-analytics.com/analytics.js", "://www.google-analytics.com/gtm/js", "://www.googletagmanager.com/gtm.js", "://www.google-analytics.com/plugins/ua/ec.js", "://ssl.google-analytics.com/ga.js", "://s0.2mdn.net/instream/html5/ima3.js", "://imasdk.googleapis.com/js/sdkloader/ima3.js", "://www.googleadservices.com/pagead/conversion_async.js", "://www.googletagservices.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/gpt/pubads_impl_.js", "://securepubads.g.doubleclick.net/tag/js/gpt.js", "://securepubads.g.doubleclick.net/gpt/pubads_impl_.js", "://script.ioam.de/iam.js", "://cdn.adsafeprotected.com/iasPET.1.js", "://static.adsafeprotected.com/iasPET.1.js", "://adservex.media.net/videoAds.js", "://.moatads.com//moatad.js", "://.moatads.com//moatapi.js", "://.moatads.com//moatheader.js", "://.moatads.com//yi.js", "://.imrworldwide.com/v60.js", "://cdn.optimizely.com/js/.js", "://cdn.optimizely.com/public/.js", "://id.rambler.ru/rambler-id-helper/auth_events.js", "://media.richrelevance.com/rrserver/js/1.2/p13n.js", "://www.gstatic.com/firebasejs//firebase-messaging.js", "://.vidible.tv//vidible-min.js", "://vdb-cdn-files.s3.amazonaws.com//vidible-min.js", "://js.maxmind.com/js/apis/geoip2//geoip2.js", "://s.webtrends.com/js/advancedLinkTracking.js", "://s.webtrends.com/js/webtrends.js", "://s.webtrends.com/js/webtrends.min.js"] equals www.facebook.com (Facebook)
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A46000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ["://webcompat-addon-testbed.herokuapp.com/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js", "://track.adform.net/serving/scripts/trackpoint/", "://track.adform.net/serving/scripts/trackpoint/async/", "://.adnxs.com//ast.js", "://.adnxs.com//pb.js", "://.adnxs.com//prebid", "://www.everestjs.net/static/st.v3.js", "://static.adsafeprotected.com/vans-adapter-google-ima.js", "://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "://cdn.branch.io/branch-latest.min.js", "://pub.doubleverify.com/signals/pub.js", "://c.amazon-adsystem.com/aax2/apstag.js", "://auth.9c9media.ca/auth/main.js", "://static.chartbeat.com/js/chartbeat.js", "://static.chartbeat.com/js/chartbeat_video.js", "://static.criteo.net/js/ld/publishertag.js", "://.imgur.com/js/vendor..bundle.js", "://.imgur.io/js/vendor..bundle.js", "://www.rva311.com/static/js/main..chunk.js", "://web-assets.toggl.com/app/assets/scripts/.js", "://libs.coremetrics.com/eluminate.js", "://connect.facebook.net//sdk.js", "://connect.facebook.net//all.js", "://secure.cdn.fastclick.net/js/cnvr-launcher//launcher-stub.min.js", "://www.google-analytics.com/analytics.js", "://www.google-analytics.com/gtm/js", "://www.googletagmanager.com/gtm.js", "://www.google-analytics.com/plugins/ua/ec.js", "://ssl.google-analytics.com/ga.js", "://s0.2mdn.net/instream/html5/ima3.js", "://imasdk.googleapis.com/js/sdkloader/ima3.js", "://www.googleadservices.com/pagead/conversion_async.js", "://www.googletagservices.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/gpt/pubads_impl_.js", "://securepubads.g.doubleclick.net/tag/js/gpt.js", "://securepubads.g.doubleclick.net/gpt/pubads_impl_.js", "://script.ioam.de/iam.js", "://cdn.adsafeprotected.com/iasPET.1.js", "://static.adsafeprotected.com/iasPET.1.js", "://adservex.media.net/videoAds.js", "://.moatads.com//moatad.js", "://.moatads.com//moatapi.js", "://.moatads.com//moatheader.js", "://.moatads.com//yi.js", "://.imrworldwide.com/v60.js", "://cdn.optimizely.com/js/.js", "://cdn.optimizely.com/public/.js", "://id.rambler.ru/rambler-id-helper/auth_events.js", "://media.richrelevance.com/rrserver/js/1.2/p13n.js", "://www.gstatic.com/firebasejs//firebase-messaging.js", "://.vidible.tv//vidible-min.js", "://vdb-cdn-files.s3.amazonaws.com//vidible-min.js", "://js.maxmind.com/js/apis/geoip2//geoip2.js", "://s.webtrends.com/js/advancedLinkTracking.js", "://s.webtrends.com/js/webtrends.js", "://s.webtrends.com/js/webtrends.min.js"] equals www.rambler.ru (Rambler)
Source: firefox.exe, 00000020.00000002.2933675468.0000017CD9F03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["image"], urls:["://track.adform.net/Serving/TrackPoint/", "://pixel.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 00000020.00000002.2933675468.0000017CD9F08000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2933675468.0000017CD9F03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["imageset"], urls:["://track.adform.net/Serving/TrackPoint/", "://pixel.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["script"], urls:["://webcompat-addon-testbed.herokuapp.com/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js", "://track.adform.net/serving/scripts/trackpoint/", "://track.adform.net/serving/scripts/trackpoint/async/", "://.adnxs.com//ast.js", "://.adnxs.com//pb.js", "://.adnxs.com//prebid", "://www.everestjs.net/static/st.v3.js", "://static.adsafeprotected.com/vans-adapter-google-ima.js", "://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "://cdn.branch.io/branch-latest.min.js", "://pub.doubleverify.com/signals/pub.js", "://c.amazon-adsystem.com/aax2/apstag.js", "://auth.9c9media.ca/auth/main.js", "://static.chartbeat.com/js/chartbeat.js", "://static.chartbeat.com/js/chartbeat_video.js", "://static.criteo.net/js/ld/publishertag.js", "://.imgur.com/js/vendor..bundle.js", "://.imgur.io/js/vendor..bundle.js", "://www.rva311.com/static/js/main..chunk.js", "://web-assets.toggl.com/app/assets/scripts/.js", "://libs.coremetrics.com/eluminate.js", "://connect.facebook.net//sdk.js", "://connect.facebook.net//all.js", "://secure.cdn.fastclick.net/js/cnvr-launcher//launcher-stub.min.js", "://www.google-analytics.com/analytics.js", "://www.google-analytics.com/gtm/js", "://www.googletagmanager.com/gtm.js", "://www.google-analytics.com/plugins/ua/ec.js", "://ssl.google-analytics.com/ga.js", "://s0.2mdn.net/instream/html5/ima3.js", "://imasdk.googleapis.com/js/sdkloader/ima3.js", "://www.googleadservices.com/pagead/conversion_async.js", "://www.googletagservices.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/gpt/pubads_impl_.js", "://securepubads.g.doubleclick.net/tag/js/gpt.js", "://securepubads.g.doubleclick.net/gpt/pubads_impl_.js", "://script.ioam.de/iam.js", "://cdn.adsafeprotected.com/iasPET.1.js", "://static.adsafeprotected.com/iasPET.1.js", "://adservex.media.net/videoAds.js", "://.moatads.com//moatad.js", "://.moatads.com//moatapi.js", "://.moatads.com//moatheader.js", "://.moatads.com//yi.js", "://.imrworldwide.com/v60.js", "://cdn.optimizely.com/js/.js", "://cdn.optimizely.com/public/.js", "://id.rambler.ru/rambler-id-helper/auth_events.js", "://media.richrelevance.com/rrserver/js/1.2/p13n.js", "://www.gstatic.com/firebasejs//firebase-messaging.js", "://.vidible.tv//vidible-min.js", "://vdb-cdn-files.s3.amazonaws.com//vidible-min.js", "://js.maxmind.com/js/apis/geoip2//geoip2.js", "://s.webtrends.com/js/advancedLinkTracking.js", "://s.webtrends.com/js/webtrends.js", "://s.webtrends.com/js/webtrends.min.js"], windowId
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A46000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2908457770.0000017CD5A61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["script"], urls:["://webcompat-addon-testbed.herokuapp.com/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js", "://track.adform.net/serving/scripts/trackpoint/", "://track.adform.net/serving/scripts/trackpoint/async/", "://.adnxs.com//ast.js", "://.adnxs.com//pb.js", "://.adnxs.com//prebid", "://www.everestjs.net/static/st.v3.js", "://static.adsafeprotected.com/vans-adapter-google-ima.js", "://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "://cdn.branch.io/branch-latest.min.js", "://pub.doubleverify.com/signals/pub.js", "://c.amazon-adsystem.com/aax2/apstag.js", "://auth.9c9media.ca/auth/main.js", "://static.chartbeat.com/js/chartbeat.js", "://static.chartbeat.com/js/chartbeat_video.js", "://static.criteo.net/js/ld/publishertag.js", "://.imgur.com/js/vendor..bundle.js", "://.imgur.io/js/vendor..bundle.js", "://www.rva311.com/static/js/main..chunk.js", "://web-assets.toggl.com/app/assets/scripts/.js", "://libs.coremetrics.com/eluminate.js", "://connect.facebook.net//sdk.js", "://connect.facebook.net//all.js", "://secure.cdn.fastclick.net/js/cnvr-launcher//launcher-stub.min.js", "://www.google-analytics.com/analytics.js", "://www.google-analytics.com/gtm/js", "://www.googletagmanager.com/gtm.js", "://www.google-analytics.com/plugins/ua/ec.js", "://ssl.google-analytics.com/ga.js", "://s0.2mdn.net/instream/html5/ima3.js", "://imasdk.googleapis.com/js/sdkloader/ima3.js", "://www.googleadservices.com/pagead/conversion_async.js", "://www.googletagservices.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/gpt/pubads_impl_.js", "://securepubads.g.doubleclick.net/tag/js/gpt.js", "://securepubads.g.doubleclick.net/gpt/pubads_impl_.js", "://script.ioam.de/iam.js", "://cdn.adsafeprotected.com/iasPET.1.js", "://static.adsafeprotected.com/iasPET.1.js", "://adservex.media.net/videoAds.js", "://.moatads.com//moatad.js", "://.moatads.com//moatapi.js", "://.moatads.com//moatheader.js", "://.moatads.com//yi.js", "://.imrworldwide.com/v60.js", "://cdn.optimizely.com/js/.js", "://cdn.optimizely.com/public/.js", "://id.rambler.ru/rambler-id-helper/auth_events.js", "://media.richrelevance.com/rrserver/js/1.2/p13n.js", "://www.gstatic.com/firebasejs//firebase-messaging.js", "://.vidible.tv//vidible-min.js", "://vdb-cdn-files.s3.amazonaws.com//vidible-min.js", "://js.maxmind.com/js/apis/geoip2//geoip2.js", "://s.webtrends.com/js/advancedLinkTracking.js", "://s.webtrends.com/js/webtrends.js", "://s.webtrends.com/js/webtrends.min.js"], windowId
Source: firefox.exe, 00000020.00000002.2933675468.0000017CD9F08000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["xmlhttprequest"], urls:["://track.adform.net/Serving/TrackPoint/", "://pagead2.googlesyndication.com/pagead/.jsfcd=true", "://pagead2.googlesyndication.com/pagead/js/.jsfcd=true", "://pixel.advertising.com/firefox-etp", "://cdn.cmp.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "https://static.adsafeprotected.com/firefox-etp-js", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/*"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 00000020.00000002.2910130082.0000017CD6725000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: doff-text" data-l10n-args="{"engine": "Google"}"></div><input type="search" class="fake-editable" tabindex="-1" aria-hidden="true"/><div class="fake-caret"></div></button></div></div></div><div class="body-wrapper on"><div class="discovery-stream ds-layout"><div class="ds-column ds-column-12"><div class="ds-column-grid"><div><div class="ds-top-sites"><section class="collapsible-section top-sites" data-section-id="topsites"><div class="section-top-bar"><h3 class="section-title-container " style="visibility:hidden"><span class="section-title"><span data-l10n-id="newtab-section-header-topsites"></span></span><span class="learn-more-link-wrapper"></span></h3></div><div><ul class="top-sites-list"><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.youtube.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="Y"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/youtube-com@2x.png)"></div></div></div><div class="title"><span dir="auto">YouTube<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"YouTube"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.facebook.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="F"><div class="top-site-icon rich-icon" style="backgroun
Source: firefox.exe, 00000020.00000002.2910130082.0000017CD6725000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: doff-text" data-l10n-args="{"engine": "Google"}"></div><input type="search" class="fake-editable" tabindex="-1" aria-hidden="true"/><div class="fake-caret"></div></button></div></div></div><div class="body-wrapper on"><div class="discovery-stream ds-layout"><div class="ds-column ds-column-12"><div class="ds-column-grid"><div><div class="ds-top-sites"><section class="collapsible-section top-sites" data-section-id="topsites"><div class="section-top-bar"><h3 class="section-title-container " style="visibility:hidden"><span class="section-title"><span data-l10n-id="newtab-section-header-topsites"></span></span><span class="learn-more-link-wrapper"></span></h3></div><div><ul class="top-sites-list"><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.youtube.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="Y"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/youtube-com@2x.png)"></div></div></div><div class="title"><span dir="auto">YouTube<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"YouTube"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.facebook.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="F"><div class="top-site-icon rich-icon" style="backgroun
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: startup - adding clearkey CDM failedmedia.{0}.allow-x64-plugin-on-arm64media.gmp-manager.cert.checkAttributesstartup - adding clearkey CDM directory onPrefEMEGlobalEnabledChanged() id=media.gmp-manager.checkContentSignatureresource://gre/modules/UpdateUtils.sys.mjsdom.sitepermsaddon-provider.enabledfindUpdates() - updateTask succeeded for uninstallPlugin() - unregistering gmp directory ://static.chartbeat.com/js/chartbeat.js://static.chartbeat.com/js/chartbeat_video.jspictureinpicture%40mozilla.org:1.0.0://track.adform.net/serving/scripts/trackpoint/FileUtils_closeAtomicFileOutputStreamresource://gre/modules/FileUtils.sys.mjshttps://smartblock.firefox.etp/play.svg://auth.9c9media.ca/auth/main.js://.imgur.com/js/vendor..bundle.js://.imgur.io/js/vendor..bundle.js://static.criteo.net/js/ld/publishertag.js://www.rva311.com/static/js/main..chunk.js://web-assets.toggl.com/app/assets/scripts/.js://libs.coremetrics.com/eluminate.js://connect.facebook.net//sdk.js://www.everestjs.net/static/st.v3.js://connect.facebook.net//all.js*://c.amazon-adsystem.com/aax2/apstag.jsresource://gre/modules/AsyncShutdown.sys.mjs equals www.facebook.com (Facebook)
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5AE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: webRequest asyncPromptAuth failure resource://gre/modules/SecurityInfo.sys.mjsresource://gre/modules/ExtensionDNR.sys.mjsUnable to set host header to restricted url.resource://gre/modules/WebRequestUpload.sys.mjsresource://gre/modules/WebRequest.sys.mjsDisallowed change restricted response header 115062f8-92f1-11e5-8b7f-080027b0f7ecresource://gre/modules/ExtensionParent.sys.mjswebRequestFilterResponse.serviceWorkerScriptwebRequest onAuthCancelled failure @mozilla.org/network/http-activity-distributor;1ACTIVITY_SUBTYPE_RESPONSE_COMPLETEACTIVITY_SUBTYPE_TRANSACTION_CLOSEasyncPromptAuth/wrapper.authPromptForwardasyncPromptAuth/wrapper.authPromptCallbackwebRequestBlockingPermissionRequired"://login.microsoftonline.com/""://www.everestjs.net/static/st.v3.js"resource://gre/modules/ExtensionUtils.sys.mjs on service worker imported script removeBootstrappedManifestLocationwebRequestBlockingPermissionRequired@mozilla.org/webrequest/channel-event-sink;1webRequestBlockingPermissionRequiredwebRequest onAuthAvailable failure "https://smartblock.firefox.etp/facebook.svg"BLOCKING_REASON_EXTENSION_WEBREQUEST"https://smartblock.firefox.etp/play.svg"TYPE_INTERNAL_WORKER_IMPORT_SCRIPTSwebRequestBlockingPermissionRequiredTYPE_INTERNAL_WORKER_STATIC_MODULE"://.vidible.tv//vidible-min.js""://www.rva311.com/static/js/main..chunk.js""://js.maxmind.com/js/apis/geoip2//geoip2.js""://s.webtrends.com/js/webtrends.js""://libs.coremetrics.com/eluminate.js""://s.webtrends.com/js/webtrends.min.js""://cdn.branch.io/branch-latest.min.js""://static.criteo.net/js/ld/publishertag.js""://ssl.google-analytics.com/ga.js""://cdn.optimizely.com/public/.js""://static.adsafeprotected.com/iasPET.1.js""://.imgur.com/js/vendor..bundle.js""://www.google-analytics.com/gtm/js""://s0.2mdn.net/instream/html5/ima3.js""://cdn.adsafeprotected.com/iasPET.1.js""://connect.facebook.net//all.js""://c.amazon-adsystem.com/aax2/apstag.js""://.moatads.com//moatheader.js""://www.googletagservices.com/tag/js/gpt.js""://s.webtrends.com/js/advancedLinkTracking.js""://imasdk.googleapis.com/js/sdkloader/ima3.js""://auth.9c9media.ca/auth/main.js""://static.chartbeat.com/js/chartbeat.js""://pub.doubleverify.com/signals/pub.js""://.imgur.io/js/vendor..bundle.js""://connect.facebook.net//sdk.js""://www.google-analytics.com/plugins/ua/ec.js""://static.chartbeat.com/js/chartbeat_video.js""://www.google-analytics.com/analytics.js""://adservex.media.net/videoAds.js""://.moatads.com//moatapi.js""://www.googletagmanager.com/gtm.js""://track.adform.net/Serving/TrackPoint/""://pubads.g.doubleclick.net/gampad/ad-blk""://pubads.g.doubleclick.net/gampad/ad""://www.facebook.com/platform/impression.php""://ads.stickyadstv.com/auto-user-sync""://ads.stickyadstv.com/user-matching""://.adsafeprotected.com/.gif""://vast.adsafeprotected.com/vast""://securepubads.g.doubleclick.net/gampad/ad""://.adsafeprotected.com/.png""https://ads.stickyadstv.com
Source: firefox.exe, 00000020.00000002.2933948328.0000017CDA0BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2931947413.0000017CD9EF7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2933948328.0000017CDA07C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 00000020.00000002.2933948328.0000017CDA036000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2931947413.0000017CD9ECE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2933948328.0000017CDA07C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: x://www.facebook.com/platform/impression.php equals www.facebook.com (Facebook)
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: {9e9a9283-0ce9-4e4a-8f1c-ba129a032c32}Got invalid request to save JSON dataFailed to listen. Callback argument missing.@mozilla.org/network/protocol;1?name=default^([a-z][a-z0-9.+\t-])(:\|;)?(\/\/)?get FIXUP_FLAGS_MAKE_ALTERNATE_URI@mozilla.org/uriloader/handler-service;1Failed to listen. Listener already attached.@mozilla.org/network/protocol;1?name=filebrowser.urlbar.dnsResolveFullyQualifiedNamesdevtools.debugger.remote-websocketresource://devtools/shared/security/socket.jsJSON Viewer's onSave failed in startPersistencedevtools.performance.popup.feature-flagUnable to start devtools server on devtools.performance.recording.ui-base-urldevtools/client/framework/devtoolsresource://devtools/server/devtools-server.jsNo callback set for this channel.WebChannel/this._originCheckCallbackbrowser.fixup.dns_first_for_single_words^([a-z+.-]+:\/{0,3})([^\/@]+@).+DevToolsStartup.jsm:handleDebuggerFlagreleaseDistinctSystemPrincipalLoader^[a-z0-9-]+(\.[a-z0-9-]+)*:[0-9]{1,5}([/?#]\|$)Can't invoke URIFixup in the content processextractScheme/fixupChangedProtocol<https://mail.inbox.lv/compose?to=%sresource://gre/modules/DeferredTask.sys.mjsresource://gre/modules/FileUtils.sys.mjshttps://poczta.interia.pl/mh/?mailto=%shttp://poczta.interia.pl/mh/?mailto=%sresource://gre/modules/ExtHandlerService.sys.mjshttp://win.mail.ru/cgi-bin/sentmsg?mailto=%s@mozilla.org/network/file-input-stream;1{c6cf88b7-452e-47eb-bdc9-86e3561648ef}https://mail.yahoo.co.jp/compose/?To=%shttp://www.inbox.lv/rfc2368/?value=%sresource://gre/modules/URIFixup.sys.mjsScheme should be either http or https@mozilla.org/uriloader/dbus-handler-app;1resource://gre/modules/DeferredTask.sys.mjs@mozilla.org/network/async-stream-copier;1http://compose.mail.yahoo.co.jp/ym/Compose?To=%s_injectDefaultProtocolHandlersIfNeededisDownloadsImprovementsAlreadyMigratedhttps://e.mail.ru/cgi-bin/sentmsg?mailto=%sresource://gre/modules/NetUtil.sys.mjs{33d75835-722f-42c0-89cc-44f328e56a86}@mozilla.org/uriloader/local-handler-app;1resource://gre/modules/FileUtils.sys.mjs_finalizeInternal/this._finalizePromise<@mozilla.org/uriloader/web-handler-app;1resource://gre/modules/JSONFile.sys.mjsgecko.handlerService.defaultHandlersVersionresource://gre/modules/JSONFile.sys.mjshandlerSvc fillHandlerInfo: don't know this typeMust have a source and a callback@mozilla.org/network/input-stream-pump;1newChannel requires a single object argumentSEC_ALLOW_CROSS_ORIGIN_SEC_CONTEXT_IS_NULL@mozilla.org/scriptableinputstream;1https://mail.yahoo.co.jp/compose/?To=%sNon-zero amount of bytes must be specifiedhttps://mail.yandex.ru/compose?mailto=%shttps://e.mail.ru/cgi-bin/sentmsg?mailto=%spdfjs.previousHandler.preferredActionpdfjs.previousHandler.alwaysAskBeforeHandlinghttps://mail.inbox.lv/compose?to=%shttps://poczta.interia.pl/mh/?mailto=%s@mozilla.org/uriloader/handler-service;1VALIDATE_DONT_COLLAPSE_WHITESPACE@mozilla.org/network/simple-stream-listener;1@mozilla.org/intl/converter-input-stream;1First argument should be an nsIInputStream@mo
Source: firefox.exe, 00000020.00000002.2933675468.0000017CD9F08000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: {incognito:null, tabId:null, types:["image"], urls:["://track.adform.net/Serving/TrackPoint/", "://pixel.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/"], windowId:null} equals www.facebook.com (Facebook)
Source: firefox.exe, 00000020.00000002.2933675468.0000017CD9F06000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: {incognito:null, tabId:null, types:["imageset"], urls:["://track.adform.net/Serving/TrackPoint/", "://pixel.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/"], windowId:null} equals www.facebook.com (Facebook)
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A46000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: {incognito:null, tabId:null, types:["script"], urls:["://webcompat-addon-testbed.herokuapp.com/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js", "://track.adform.net/serving/scripts/trackpoint/", "://track.adform.net/serving/scripts/trackpoint/async/", "://.adnxs.com//ast.js", "://.adnxs.com//pb.js", "://.adnxs.com//prebid", "://www.everestjs.net/static/st.v3.js", "://static.adsafeprotected.com/vans-adapter-google-ima.js", "://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "://cdn.branch.io/branch-latest.min.js", "://pub.doubleverify.com/signals/pub.js", "://c.amazon-adsystem.com/aax2/apstag.js", "://auth.9c9media.ca/auth/main.js", "://static.chartbeat.com/js/chartbeat.js", "://static.chartbeat.com/js/chartbeat_video.js", "://static.criteo.net/js/ld/publishertag.js", "://.imgur.com/js/vendor..bundle.js", "://.imgur.io/js/vendor..bundle.js", "://www.rva311.com/static/js/main..chunk.js", "://web-assets.toggl.com/app/assets/scripts/.js", "://libs.coremetrics.com/eluminate.js", "://connect.facebook.net//sdk.js", "://connect.facebook.net//all.js", "://secure.cdn.fastclick.net/js/cnvr-launcher//launcher-stub.min.js", "://www.google-analytics.com/analytics.js", "://www.google-analytics.com/gtm/js", "://www.googletagmanager.com/gtm.js", "://www.google-analytics.com/plugins/ua/ec.js", "://ssl.google-analytics.com/ga.js", "://s0.2mdn.net/instream/html5/ima3.js", "://imasdk.googleapis.com/js/sdkloader/ima3.js", "://www.googleadservices.com/pagead/conversion_async.js", "://www.googletagservices.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/gpt/pubads_impl_.js", "://securepubads.g.doubleclick.net/tag/js/gpt.js", "://securepubads.g.doubleclick.net/gpt/pubads_impl_.js", "://script.ioam.de/iam.js", "://cdn.adsafeprotected.com/iasPET.1.js", "://static.adsafeprotected.com/iasPET.1.js", "://adservex.media.net/videoAds.js", "://.moatads.com//moatad.js", "://.moatads.com//moatapi.js", "://.moatads.com//moatheader.js", "://.moatads.com//yi.js", "://.imrworldwide.com/v60.js", "://cdn.optimizely.com/js/.js", "://cdn.optimizely.com/public/.js", "://id.rambler.ru/rambler-id-helper/auth_events.js", "://media.richrelevance.com/rrserver/js/1.2/p13n.js", "://www.gstatic.com/firebasejs//firebase-messaging.js", "://.vidible.tv//vidible-min.js", "://vdb-cdn-files.s3.amazonaws.com//vidible-min.js", "://js.maxmind.com/js/apis/geoip2//geoip2.js", "://s.webtrends.com/js/advancedLinkTracking.js", "://s.webtrends.com/js/webtrends.js", "://s.webtrends.com/js/webtrends.min.js"], windowId:
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A46000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: {incognito:null, tabId:null, types:["script"], urls:["://webcompat-addon-testbed.herokuapp.com/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js", "://track.adform.net/serving/scripts/trackpoint/", "://track.adform.net/serving/scripts/trackpoint/async/", "://.adnxs.com//ast.js", "://.adnxs.com//pb.js", "://.adnxs.com//prebid", "://www.everestjs.net/static/st.v3.js", "://static.adsafeprotected.com/vans-adapter-google-ima.js", "://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "://cdn.branch.io/branch-latest.min.js", "://pub.doubleverify.com/signals/pub.js", "://c.amazon-adsystem.com/aax2/apstag.js", "://auth.9c9media.ca/auth/main.js", "://static.chartbeat.com/js/chartbeat.js", "://static.chartbeat.com/js/chartbeat_video.js", "://static.criteo.net/js/ld/publishertag.js", "://.imgur.com/js/vendor..bundle.js", "://.imgur.io/js/vendor..bundle.js", "://www.rva311.com/static/js/main..chunk.js", "://web-assets.toggl.com/app/assets/scripts/.js", "://libs.coremetrics.com/eluminate.js", "://connect.facebook.net//sdk.js", "://connect.facebook.net//all.js", "://secure.cdn.fastclick.net/js/cnvr-launcher//launcher-stub.min.js", "://www.google-analytics.com/analytics.js", "://www.google-analytics.com/gtm/js", "://www.googletagmanager.com/gtm.js", "://www.google-analytics.com/plugins/ua/ec.js", "://ssl.google-analytics.com/ga.js", "://s0.2mdn.net/instream/html5/ima3.js", "://imasdk.googleapis.com/js/sdkloader/ima3.js", "://www.googleadservices.com/pagead/conversion_async.js", "://www.googletagservices.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/gpt/pubads_impl_.js", "://securepubads.g.doubleclick.net/tag/js/gpt.js", "://securepubads.g.doubleclick.net/gpt/pubads_impl_.js", "://script.ioam.de/iam.js", "://cdn.adsafeprotected.com/iasPET.1.js", "://static.adsafeprotected.com/iasPET.1.js", "://adservex.media.net/videoAds.js", "://.moatads.com//moatad.js", "://.moatads.com//moatapi.js", "://.moatads.com//moatheader.js", "://.moatads.com//yi.js", "://.imrworldwide.com/v60.js", "://cdn.optimizely.com/js/.js", "://cdn.optimizely.com/public/.js", "://id.rambler.ru/rambler-id-helper/auth_events.js", "://media.richrelevance.com/rrserver/js/1.2/p13n.js", "://www.gstatic.com/firebasejs//firebase-messaging.js", "://.vidible.tv//vidible-min.js", "://vdb-cdn-files.s3.amazonaws.com//vidible-min.js", "://js.maxmind.com/js/apis/geoip2//geoip2.js", "://s.webtrends.com/js/advancedLinkTracking.js", "://s.webtrends.com/js/webtrends.js", "://s.webtrends.com/js/webtrends.min.js"], windowId:
Source: firefox.exe, 00000020.00000002.2933675468.0000017CD9F08000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: {incognito:null, tabId:null, types:["xmlhttprequest"], urls:["://track.adform.net/Serving/TrackPoint/", "://pagead2.googlesyndication.com/pagead/.jsfcd=true", "://pagead2.googlesyndication.com/pagead/js/.jsfcd=true", "://pixel.advertising.com/firefox-etp", "://cdn.cmp.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "https://static.adsafeprotected.com/firefox-etp-js", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/*"], windowId:null} equals www.facebook.com (Facebook)

Source: firefox.exe, 00000020.00000002.2919639043.0000017CD92A2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.2900114787.0000017CC985D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:
Source: f039f524ee.exe, 0000000F.00000003.2837717203.0000000001029000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/
Source: f039f524ee.exe, 0000000F.00000003.2837717203.0000000001029000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/9t
Source: f039f524ee.exe, 0000000F.00000003.2837717203.0000000001029000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/k
Source: file.exe, 00000000.00000002.2107233640.0000000000E57000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2107233640.0000000000ED6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: file.exe, 00000000.00000002.2107233640.0000000000E57000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exeg
Source: f039f524ee.exe, 0000000F.00000003.2848661309.0000000000FE5000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2848661309.0000000000FB0000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2849666702.0000000001004000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.3084418747.00000000011F9000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.3072941768.00000000011F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe
Source: f039f524ee.exe, 0000000F.00000003.2848661309.0000000000FE5000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2849666702.0000000001004000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exee
Source: f039f524ee.exe, 0000000F.00000003.2848661309.0000000000FE5000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2849666702.0000000001004000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exeq
Source: f039f524ee.exe, 0000000F.00000003.2848661309.0000000000FE5000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2837717203.0000000001029000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2849666702.0000000001004000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.3084418747.00000000011F9000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.3072941768.00000000011F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe
Source: f039f524ee.exe, 0000000F.00000003.2837717203.0000000001029000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exet_
Source: f039f524ee.exe, 0000000F.00000003.2848661309.0000000000FE5000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2849666702.0000000001004000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16:80/off/def.exeCLSID
Source: file.exe, 00000000.00000002.2107422140.0000000001117000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2107233640.0000000000DFE000.00000004.00000020.00020000.00000000.sdmp, f377015f96.exe, 00000010.00000002.2681962698.000000000155E000.00000004.00000020.00020000.00000000.sdmp, f377015f96.exe, 00000019.00000002.2861247425.0000000001A6B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: f377015f96.exe, 00000019.00000002.2861247425.0000000001A6B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206(K
Source: f377015f96.exe, 00000010.00000002.2681962698.00000000015B7000.00000004.00000020.00020000.00000000.sdmp, f377015f96.exe, 00000019.00000002.2861247425.0000000001A6B000.00000004.00000020.00020000.00000000.sdmp, f377015f96.exe, 00000019.00000002.2861247425.0000000001ABE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000000.00000002.2107233640.0000000000E57000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/1
Source: file.exe, 00000000.00000002.2107233640.0000000000E71000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll
Source: file.exe, 00000000.00000002.2107233640.0000000000E71000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll0
Source: file.exe, 00000000.00000002.2107233640.0000000000E71000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dllH
Source: file.exe, 00000000.00000002.2107233640.0000000000E57000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll
Source: file.exe, 00000000.00000002.2107233640.0000000000E71000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll
Source: file.exe, 00000000.00000002.2107233640.0000000000E57000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll
Source: file.exe, 00000000.00000002.2107233640.0000000000E57000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dllG
Source: file.exe, 00000000.00000002.2107233640.0000000000E71000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll
Source: file.exe, 00000000.00000002.2107233640.0000000000E71000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dllt
Source: file.exe, 00000000.00000002.2107233640.0000000000DFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll
Source: f377015f96.exe, 00000019.00000002.2861247425.0000000001ABE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/?
Source: f377015f96.exe, 00000019.00000002.2861247425.0000000001ABE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/H
Source: f377015f96.exe, 00000019.00000002.2861247425.0000000001ABE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/L
Source: f377015f96.exe, 00000010.00000002.2681962698.00000000015B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/V
Source: f377015f96.exe, 00000019.00000002.2861247425.0000000001ABE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: file.exe, 00000000.00000002.2112319814.000000000BD1A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php-
Source: f377015f96.exe, 00000010.00000002.2681962698.00000000015B7000.00000004.00000020.00020000.00000000.sdmp, f377015f96.exe, 00000019.00000002.2861247425.0000000001ABE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php/
Source: f377015f96.exe, 00000010.00000002.2681962698.00000000015B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php2
Source: f377015f96.exe, 00000019.00000002.2861247425.0000000001ABE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpV
Source: f377015f96.exe, 00000010.00000002.2681962698.000000000155E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpa-7368302a1ad4
Source: file.exe, 00000000.00000002.2107233640.0000000000E45000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpbK
Source: file.exe, 00000000.00000002.2107233640.0000000000E71000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpd
Source: file.exe, 00000000.00000002.2107422140.0000000001117000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phper
Source: f377015f96.exe, 00000010.00000002.2681962698.00000000015B7000.00000004.00000020.00020000.00000000.sdmp, f377015f96.exe, 00000019.00000002.2861247425.0000000001ABE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpn
Source: file.exe, 00000000.00000002.2112319814.000000000BD1A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phppresolver.dll
Source: f377015f96.exe, 00000010.00000002.2681962698.00000000015B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpr
Source: file.exe, 00000000.00000002.2107233640.0000000000E57000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/i
Source: f377015f96.exe, 00000019.00000002.2861247425.0000000001ABE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/ocal
Source: f377015f96.exe, 00000010.00000002.2681962698.000000000155E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/~
Source: f377015f96.exe, 00000019.00000002.2861247425.0000000001A6B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206H
Source: file.exe, 00000000.00000002.2107233640.0000000000DFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206M
Source: file.exe, 00000000.00000002.2107422140.0000000001117000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206c4becf79229cb002.phpser
Source: f377015f96.exe, 00000010.00000002.2681962698.000000000155E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206y
Source: a17088d8c7.exe, 0000000D.00000003.3117232730.00000000055B2000.00000004.00000020.00020000.00000000.sdmp, a17088d8c7.exe, 0000000D.00000003.3117232730.00000000055D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/
Source: a17088d8c7.exe, 0000000D.00000003.3117232730.00000000055D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/b%_
Source: a17088d8c7.exe, 0000000D.00000003.3117232730.00000000055CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/cdb-53011b87bd06
Source: a17088d8c7.exe, 0000000D.00000003.3078884337.00000000055B2000.00000004.00000020.00020000.00000000.sdmp, a17088d8c7.exe, 0000000D.00000003.3117232730.00000000055B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/dll/downloadhqos.dll.mui
Source: a17088d8c7.exe, 0000000D.00000003.3117232730.00000000055D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/dll/key
Source: a17088d8c7.exe, 0000000D.00000003.3117232730.00000000055D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/files/download
Source: a17088d8c7.exe, 0000000D.00000003.3078884337.00000000055D4000.00000004.00000020.00020000.00000000.sdmp, a17088d8c7.exe, 0000000D.00000003.3117232730.00000000055D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/files/download3&l
Source: a17088d8c7.exe, 0000000D.00000003.3078884337.00000000055D4000.00000004.00000020.00020000.00000000.sdmp, a17088d8c7.exe, 0000000D.00000003.3117232730.00000000055D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/files/download=&b
Source: a17088d8c7.exe, 0000000D.00000003.3078884337.00000000055D4000.00000004.00000020.00020000.00000000.sdmp, a17088d8c7.exe, 0000000D.00000003.3117232730.00000000055D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/files/downloadi
Source: f039f524ee.exe, 0000000F.00000003.2647391727.000000000574A000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2771585453.00000000058D5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2937492782.0000017CDA7C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: f039f524ee.exe, 0000000F.00000003.2647391727.000000000574A000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2771585453.00000000058D5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2937492782.0000017CDA7C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: firefox.exe, 00000020.00000002.2907178707.0000017CD557D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%s
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%s_injectDefaultProtocolHandlersIfNeeded
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%s_injectDefaultProtocolHandlersIfNeededisDownloadsImp
Source: firefox.exe, 00000020.00000002.2914904234.0000017CD79B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%ss
Source: f039f524ee.exe, 0000000F.00000003.2647391727.000000000574A000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2771585453.00000000058D5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2937492782.0000017CDA7C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: f039f524ee.exe, 0000000F.00000003.2647391727.000000000574A000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2771585453.00000000058D5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2937492782.0000017CDA7C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: f039f524ee.exe, 0000000F.00000003.2647391727.000000000574A000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2771585453.00000000058D5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2937492782.0000017CDA7C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: f039f524ee.exe, 0000000F.00000003.2647391727.000000000574A000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2771585453.00000000058D5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2937492782.0000017CDA7C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: f039f524ee.exe, 0000000F.00000003.2647391727.000000000574A000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2771585453.00000000058D5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2937492782.0000017CDA7C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: firefox.exe, 00000020.00000002.2944247945.0000017CDBA28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/canonical.html
Source: firefox.exe, 00000020.00000002.2933675468.0000017CD9F17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/canonical.htmlACTIVITY_SUBTYPE_REQUEST_BODY_SENTACTIVITY_SUBTYPE_PRO
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv4
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv6
Source: firefox.exe, 00000020.00000002.2908012090.0000017CD5912000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2908012090.0000017CD592C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.addEventListener
Source: firefox.exe, 00000020.00000002.2908012090.0000017CD5912000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2908012090.0000017CD592C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.removeEventListener
Source: firefox.exe, 00000020.00000002.2904680065.0000017CD4F26000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/common
Source: firefox.exe, 00000020.00000002.2904680065.0000017CD4F61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/dates-and-times$
Source: firefox.exe, 00000020.00000002.2904680065.0000017CD4F26000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/math
Source: firefox.exe, 00000020.00000002.2904680065.0000017CD4F61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/regular-expressionsh
Source: firefox.exe, 00000020.00000002.2904680065.0000017CD4F26000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/sets
Source: firefox.exe, 00000020.00000002.2900114787.0000017CC9803000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/strings
Source: firefox.exe, 00000020.00000002.2951694809.0000017CDCB2F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2944247945.0000017CDBACF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2923664473.0000017CD98DD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2831846902.0000017CD98C1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2906223989.0000017CD50B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2944247945.0000017CDBA62000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2935328508.0000017CDA103000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2943062764.0000017CDB31B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2949018481.0000017CDC044000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2951694809.0000017CDCB40000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2919639043.0000017CD9203000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2944247945.0000017CDBA51000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2924396777.0000017CD9988000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2937492782.0000017CDA71D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/MPL/2.0/.
Source: f039f524ee.exe, 0000000F.00000003.2647391727.000000000574A000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2771585453.00000000058D5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2937492782.0000017CDA7C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: f039f524ee.exe, 0000000F.00000003.2647391727.000000000574A000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2771585453.00000000058D5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2937492782.0000017CDA7C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2907178707.0000017CD557D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 00000020.00000002.2914904234.0000017CD79B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://poczta.interia.pl/mh/?mailto=%sw
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2907178707.0000017CD557D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 00000020.00000002.2914904234.0000017CD79B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%sy
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2907178707.0000017CD557D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.inbox.lv/rfc2368/?value=%s
Source: firefox.exe, 00000020.00000002.2914904234.0000017CD79B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.inbox.lv/rfc2368/?value=%su
Source: file.exe, file.exe, 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: firefox.exe, 00000020.00000002.2924396777.0000017CD9988000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2908457770.0000017CD5A9E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5AAF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulchrome://browser/content/browser-tabsin
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A9E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulchrome://browser/content/places/browser
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulchrome://global/content/elements/moz-me
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A9E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulchrome://passwordmgr/locale/passwordmgr
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A9E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulhttp://www.mozilla.org/keymaster/gateke
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5AE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulresource:///modules/UrlbarProviderTopSi
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5AE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulresource:///modules/sessionstore/Sessio
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5AE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulresource://gre/modules/PrivateBrowsingU
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A46000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulresource://gre/modules/URLDecorationAnn
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5AE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulsrc=image
Source: file.exe, 00000000.00000002.2109410050.0000000005CE9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2115895916.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: f039f524ee.exe, 0000000F.00000003.2647391727.000000000574A000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2771585453.00000000058D5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2937492782.0000017CDA7C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: f039f524ee.exe, 0000000F.00000003.2647391727.000000000574A000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2771585453.00000000058D5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2937492782.0000017CDA7C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.malware-error.mozilla.com/?url=
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.phish-error.mozilla.com/?url=
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.phish-report.mozilla.com/?url=
Source: firefox.exe, 00000020.00000002.2916806678.0000017CD8B70000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000003.2818869675.0000017CD945A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2817374710.0000017CD9200000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2817893137.0000017CD941F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2819165160.0000017CD9477000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2818486632.0000017CD943C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.duckduckgo.com/ac/
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.duckduckgo.com/ac/defaultPreventedByContenthttps://www.google.com/searchget
Source: file.exe, 00000000.00000003.1863399988.0000000000ED0000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2589952496.000000000573F000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2590072407.0000000005728000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2713287494.00000000058EB000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2713694037.00000000058E9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: firefox.exe, 00000020.00000002.2951694809.0000017CDCB78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://account.bellmedia.c
Source: firefox.exe, 00000020.00000002.2949018481.0000017CDC0E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://account.bellmedia.ca
Source: firefox.exe, 00000020.00000002.2914904234.0000017CD7978000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD6703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com/
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com/settings/clients
Source: firefox.exe, 00000020.00000002.2918847879.0000017CD9133000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2908457770.0000017CD5A03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2914904234.0000017CD79F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/language-tools/
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search-engines/
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search?q=%TERMS%&platform=%OS%&appver=%VERSION%
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/themes
Source: firefox.exe, 00000020.00000002.2933675468.0000017CD9F03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ads.stickyadstv.com/firefox-etp
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ads.stickyadstv.com/firefox-etpresource://gre/modules/ShortcutUtils.sys.mjs
Source: firefox.exe, 00000020.00000002.2914904234.0000017CD7978000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD677D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://amazon.com
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://api.accounts.firefox.com/v1
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://apps.apple.com/app/firefox-private-safe-browser/id989804926
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://apps.apple.com/us/app/firefox-private-network-vpn/id1489407738
Source: f039f524ee.exe, 0000000F.00000003.2848661309.0000000000FE5000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2646499229.0000000001011000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2843200148.0000000001012000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2848661309.0000000000FA5000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2589842358.0000000001013000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2589686211.000000000100F000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2590354965.0000000001013000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2616118705.0000000001012000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2777000037.0000000001012000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2904185884.00000000011FA000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2803779137.00000000011DC000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2771485025.00000000011DD000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2862654694.00000000011DE000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2742444167.00000000011DB000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2742195555.00000000011D8000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2770447800.00000000011D8000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2776788243.00000000011DD000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2771976922.00000000011DD000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2847569257.00000000011DC000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2889643830.00000000011FA000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2775962014.00000000011DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/
Source: f039f524ee.exe, 00000011.00000003.2889643830.00000000011E5000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2816854374.00000000011E7000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.3072941768.00000000011E8000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2809295731.00000000011E3000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2803779137.00000000011DC000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2803011829.00000000011D8000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2903405613.00000000011E8000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2771485025.00000000011DD000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2742444167.00000000011DB000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2742195555.00000000011D8000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2845300625.00000000011E8000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2770447800.00000000011D8000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2713492473.00000000011D9000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2776788243.00000000011DD000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2771976922.00000000011DD000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2775962014.00000000011DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/#
Source: f039f524ee.exe, 0000000F.00000003.2707665355.0000000001011000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/#4
Source: f039f524ee.exe, 0000000F.00000003.2848661309.0000000000FE5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/0
Source: f039f524ee.exe, 00000011.00000003.2803011829.00000000011D8000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2742444167.00000000011DB000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2742195555.00000000011D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/T
Source: f039f524ee.exe, 00000011.00000003.2713156874.00000000011D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/U
Source: f039f524ee.exe, 00000011.00000003.2904185884.00000000011FA000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2889643830.00000000011FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/VV
Source: f039f524ee.exe, 0000000F.00000003.2646499229.0000000001011000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2678578144.0000000001018000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2673028661.0000000001017000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2675427284.0000000001018000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2682193338.000000000101A000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2680574921.0000000001018000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2678009352.0000000001018000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2776383187.0000000001032000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2681445195.0000000001018000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2678906552.0000000001018000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2679263353.0000000001018000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2678083034.0000000001018000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2675179858.0000000001018000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2679554542.0000000001018000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2678456559.0000000001018000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2678381424.0000000001018000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2680795575.0000000001018000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2680339133.0000000001018000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2679363395.0000000001018000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2837717203.0000000001029000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2646636082.0000000001017000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/api
Source: f039f524ee.exe, 0000000F.00000003.2672861730.0000000001028000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/api.a
Source: f039f524ee.exe, 0000000F.00000003.2848661309.0000000000FE5000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2849666702.0000000001004000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/apiC
Source: f039f524ee.exe, 00000011.00000003.2904185884.00000000011FA000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.3084418747.00000000011F9000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2809295731.00000000011E3000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2861815157.00000000011F2000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2803779137.00000000011DC000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2803011829.00000000011D8000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2809371493.00000000011F2000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.3072941768.00000000011F9000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2842457103.00000000011F9000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2809334415.00000000011EA000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2814773574.00000000011F3000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2889643830.00000000011FA000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2817596296.00000000011FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/apiEW
Source: f039f524ee.exe, 00000011.00000003.2742444167.00000000011DB000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2742195555.00000000011D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/apiR
Source: f039f524ee.exe, 0000000F.00000003.2714506979.0000000001037000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2713837367.000000000102A000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2708103066.0000000001037000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/apiluv
Source: f039f524ee.exe, 00000011.00000003.2904185884.00000000011FA000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2889643830.00000000011FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/nV
Source: f039f524ee.exe, 0000000F.00000003.2672861730.0000000001011000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/s4p6
Source: f039f524ee.exe, 0000000F.00000003.2671657527.000000000571C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz:443/api
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/3/GMP/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%OS_VER
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/3/SystemAddons/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL
Source: firefox.exe, 00000020.00000002.2900114787.0000017CC9811000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/6/%PRODUCT%/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://blocked.cdn.mozilla.net/
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://blocked.cdn.mozilla.net/%blockID%.html
Source: file.exe, 00000000.00000002.2112319814.000000000BD12000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2107233640.0000000000ED6000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2649157391.0000000001027000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2776788243.00000000011D8000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2914904234.0000017CD7978000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD6757000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2904680065.0000017CD4FAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD677D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: file.exe, 00000000.00000002.2112319814.000000000BD12000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2107233640.0000000000ED6000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2649157391.0000000001027000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2914904234.0000017CD7978000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD6757000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2904680065.0000017CD4FAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD677D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: firefox.exe, 00000020.00000002.2931947413.0000017CD9E8B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD6725000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2929235826.0000017CD9B64000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mo
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5AAF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1238180
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5AAF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1238180Required
Source: file.exe, 00000000.00000003.1863399988.0000000000ED0000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2589952496.000000000573F000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2590072407.0000000005728000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2713287494.00000000058EB000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2713694037.00000000058E9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.1863399988.0000000000ED0000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2589952496.000000000573F000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2590072407.0000000005728000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2713287494.00000000058EB000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2713694037.00000000058E9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.1863399988.0000000000ED0000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2589952496.000000000573F000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2590072407.0000000005728000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2713287494.00000000058EB000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2713694037.00000000058E9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2819165160.0000017CD9477000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2818486632.0000017CD943C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://completion.amazon.com/search/complete?q=
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://content.cdn.mozilla.net
Source: file.exe, 00000000.00000002.2112319814.000000000BD12000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2107233640.0000000000ED6000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2649157391.0000000001027000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2776788243.00000000011D8000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2914904234.0000017CD7978000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD6757000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD6703000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2904680065.0000017CD4FAD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: file.exe, 00000000.00000002.2112319814.000000000BD12000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2107233640.0000000000ED6000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2649157391.0000000001027000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2914904234.0000017CD7978000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD6757000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2904680065.0000017CD4FAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD677D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com/v1/tiles
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://coverage.mozilla.org
Source: firefox.exe, 00000020.00000002.2900114787.0000017CC9811000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2900114787.0000017CC9830000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://crash-reports.mozilla.com/submit?id=
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://crash-stats.mozilla.org/report/index/
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://dap-02.api.divviup.org
Source: firefox.exe, 00000020.00000002.2908012090.0000017CD5912000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2908012090.0000017CD592C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/tabs/captureTab
Source: firefox.exe, 00000020.00000002.2908012090.0000017CD592C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/releasePointerCapture
Source: firefox.exe, 00000020.00000002.2908012090.0000017CD5912000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2908012090.0000017CD592C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/setPointerCapture
Source: firefox.exe, 00000020.00000002.2908012090.0000017CD5912000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2908012090.0000017CD592C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Push_API/Using_the_Push_API#Encryption
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/Add-ons/WebExtensions/manifest.json/commands#Key_combinations
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/Add-ons/WebExtensions/manifest.json/commands#Key_combinationsbro
Source: firefox.exe, 00000020.00000002.2908012090.0000017CD5912000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2908012090.0000017CD592C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsing
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developers.google.com/safe-browsing/v4/advisory
Source: firefox.exe, 00000020.00000002.2914904234.0000017CD7978000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD677D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com
Source: firefox.exe, 00000020.00000002.2916806678.0000017CD8B70000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.2962001308.000033A27A704000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2818869675.0000017CD945A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2817374710.0000017CD9200000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2931947413.0000017CD9E75000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2817893137.0000017CD941F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2819165160.0000017CD9477000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2961160758.00000D1113504000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2961027699.00000C5949A04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2818486632.0000017CD943C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/
Source: firefox.exe, 00000020.00000002.2962001308.000033A27A704000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/Z
Source: file.exe, 00000000.00000003.1863399988.0000000000ED0000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2589952496.000000000573F000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2590072407.0000000005728000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2713287494.00000000058EB000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2713694037.00000000058E9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.1863399988.0000000000ED0000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2589952496.000000000573F000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2590072407.0000000005728000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2713287494.00000000058EB000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2713694037.00000000058E9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.1863399988.0000000000ED0000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2589952496.000000000573F000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2590072407.0000000005728000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2713287494.00000000058EB000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2713694037.00000000058E9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: firefox.exe, 00000020.00000003.2821382400.0000017CD7A33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2823903373.0000017CD7A28000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2914904234.0000017CD79B1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2916219970.0000017CD7A28000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2907178707.0000017CD557D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 00000020.00000002.2914904234.0000017CD79B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%sz
Source: firefox.exe, 00000020.00000002.2914904234.0000017CD79B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%szw
Source: firefox.exe, 00000020.00000003.2821382400.0000017CD7A33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2823903373.0000017CD7A28000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2914904234.0000017CD79B1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2916219970.0000017CD7A28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://email.seznam.cz/newMessageScreen?mailto=%s
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://email.seznam.cz/newMessageScreen?mailto=%sAttempted
Source: firefox.exe, 00000020.00000002.2908012090.0000017CD5912000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2908012090.0000017CD592C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://extensionworkshop.com/documentation/publish/self-distribution/
Source: firefox.exe, 00000020.00000002.2914904234.0000017CD7978000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD6703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-api-proxy.cdn.mozilla.net/
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://firefox-source-docs.mozilla.org/networking/dns/trr-skip-reasons.html#
Source: firefox.exe, 00000020.00000002.2908012090.0000017CD5912000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-source-docs.mozilla.org/performance/scroll-linked_effects.html
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A26000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-source-docs.mozilla.org/remote/Security.html
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.allizom.org/v1/buckets/main-preview/collections/search-config/reco
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/records
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main-preview/collections/search-config/reco
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/search-config/records
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1AIzaSyB2h2OuRcUgy5N-5hsZqiPW6sH3n_rptiQ
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1AIzaSyB2h2OuRcUgy5N-5hsZqiPW6sH3n_rptiQPopulating
Source: firefox.exe, 00000020.00000002.2910130082.0000017CD6757000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2962100177.0000360BFBE04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2900114787.0000017CC988F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fpn.firefox.com
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://fpn.firefox.com/browser?utm_source=firefox-desktop&utm_medium=referral&utm_campaign=about-pr
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://ftp.mozilla.org/pub/labs/devtools/adb-extension/#OS#/adb-extension-latest-#OS#.xpi
Source: firefox.exe, 00000020.00000002.2914904234.0000017CD7978000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD6703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/
Source: firefox.exe, 00000020.00000002.2910130082.0000017CD6703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=
Source: firefox.exe, 00000020.00000002.2910130082.0000017CD6703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_l
Source: firefox.exe, 00000020.00000002.2914904234.0000017CD7978000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD6703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=bas
Source: firefox.exe, 00000020.00000002.2914904234.0000017CD7978000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD6703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=40249-e88c401e1b1f2242d9e4
Source: firefox.exe, 00000020.00000002.2914904234.0000017CD7978000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD6703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/career?utm_source=pocket-newtab
Source: firefox.exe, 00000020.00000002.2914904234.0000017CD7978000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD6703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/entertainment?utm_source=pocket-newtab
Source: firefox.exe, 00000020.00000002.2914904234.0000017CD7978000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD6703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/food?utm_source=pocket-newtab
Source: firefox.exe, 00000020.00000002.2914904234.0000017CD7978000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD6703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/health?utm_source=pocket-newtab
Source: firefox.exe, 00000020.00000002.2914904234.0000017CD7978000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD6703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/science?utm_source=pocket-newtab
Source: firefox.exe, 00000020.00000002.2914904234.0000017CD7978000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD6703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/self-improvement?utm_source=pocket-newtab
Source: firefox.exe, 00000020.00000002.2914904234.0000017CD7978000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD6703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/technology?utm_source=pocket-newtab
Source: firefox.exe, 00000020.00000002.2910130082.0000017CD6703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tab
Source: firefox.exe, 00000020.00000002.2914904234.0000017CD7978000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD6703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore?utm_source=pocket-newtab
Source: firefox.exe, 00000020.00000002.2910130082.0000017CD6703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_more
Source: firefox.exe, 00000020.00000002.2910130082.0000017CD6703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendations
Source: firefox.exe, 00000020.00000002.2913093502.0000017CD6903000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/
Source: firefox.exe, 00000020.00000002.2916806678.0000017CD8B70000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000003.2818869675.0000017CD945A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2817374710.0000017CD9200000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2817893137.0000017CD941F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2819165160.0000017CD9477000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2818486632.0000017CD943C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mozilla-services/screenshots
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mozilla-services/screenshots/shims/google-analytics-ecommerce-plugin.jsasyncEmitM
Source: firefox.exe, 00000020.00000002.2914904234.0000017CD7978000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD677D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://helper1.dap.cloudflareresearch.com/v02
Source: firefox.exe, 00000020.00000002.2900114787.0000017CC9811000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2908457770.0000017CD5A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881No
Source: firefox.exe, 00000020.00000002.2900114787.0000017CC9811000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881w
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://ideas.mozilla.org/
Source: firefox.exe, 00000020.00000002.2910130082.0000017CD677D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: firefox.exe, 00000020.00000002.2906223989.0000017CD50FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org
Source: firefox.exe, 00000020.00000002.2914904234.0000017CD7978000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD6703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submit
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://install.mozilla.org
Source: firefox.exe, 00000020.00000002.2929235826.0000017CD9B64000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com
Source: firefox.exe, 00000020.00000002.2937492782.0000017CDA71D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.2908457770.0000017CD5AE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/v1/country?key=%MOZILLA_API_KEY%
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5AE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/v1/country?key=%MOZILLA_API_KEY%primeBackground/extension.term
Source: firefox.exe, 00000020.00000002.2937492782.0000017CDA71D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/v1/country?key=7e40f68c-7938-4c5d-9f95-e61647c213eb
Source: firefox.exe, 00000020.00000002.2894411295.0000001882C3B000.00000004.00000010.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2949018481.0000017CDC0E4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2951694809.0000017CDCB78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: firefox.exe, 00000020.00000002.2949018481.0000017CDC0E4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2949018481.0000017CDC01C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2951694809.0000017CDCB78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com
Source: firefox.exe, 00000020.00000003.2821382400.0000017CD7A33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD67C8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2913093502.0000017CD6921000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2823903373.0000017CD7A28000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2914904234.0000017CD79B1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2916219970.0000017CD7A28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%s
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%sMicrosoft
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%shttps://outlook.live.com/default.aspx?rru=compose&
Source: firefox.exe, 00000020.00000003.2821382400.0000017CD7A33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2823903373.0000017CD7A28000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2914904234.0000017CD79B1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2916219970.0000017CD7A28000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2907178707.0000017CD557D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.inbox.lv/compose?to=%s
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.inbox.lv/compose?to=%sresource://gre/modules/DeferredTask.sys.mjsresource://gre/modules
Source: firefox.exe, 00000020.00000002.2914904234.0000017CD79B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.inbox.lv/compose?to=%sv
Source: firefox.exe, 00000020.00000003.2821382400.0000017CD7A33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2823903373.0000017CD7A28000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2914904234.0000017CD79B1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2916219970.0000017CD7A28000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2907178707.0000017CD557D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%s
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%sNon-zero
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%shttp://www.inbox.lv/rfc2368/?value=%sresource://gre/modules/U
Source: firefox.exe, 00000020.00000002.2914904234.0000017CD79B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%st
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2900114787.0000017CC98D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://merino.services.mozilla.com/api/v1/suggest
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://mitmdetection.services.mozilla.com/
Source: firefox.exe, 00000020.00000002.2918847879.0000017CD9133000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2908457770.0000017CD5A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/?entrypoint=protection_report_monitor&utm_source=about-protections
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/about
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/breach-details/
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/oauth/init?entrypoint=protection_report_monitor&utm_source=about-protect
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/breach-stats?includeResolved=true
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/dashboard
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/preferences
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://mozilla-ohttp-fakespot.fastly-edge.com/
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://mozilla.cloudflare-dns.com/dns-query
Source: firefox.exe, 00000020.00000002.2960702471.0000041B45E04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mozilla.org/
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mzl.la/3NS9KJd
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://normandy.cdn.mozilla.net/api/v1
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://oauth.accounts.firefox.com/v1
Source: firefox.exe, 00000020.00000003.2821382400.0000017CD7A33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2823903373.0000017CD7A28000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2914904234.0000017CD79B1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2916219970.0000017CD7A28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://outlook.live.com/default.aspx?rru=compose&to=%s
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox&referrer=utm_source%3Dprotection_r
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-
Source: firefox.exe, 00000020.00000003.2821382400.0000017CD7A33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2823903373.0000017CD7A28000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2914904234.0000017CD79B1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2916219970.0000017CD7A28000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2907178707.0000017CD557D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 00000020.00000002.2914904234.0000017CD79B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%sx
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://prod.ohttp-gateway.prod.webservices.mozgcp.net/ohttp-configs
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://profile.accounts.firefox.com/v1
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://profiler.firefox.com
Source: firefox.exe, 00000020.00000002.2914904234.0000017CD7978000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://profiler.firefox.com/
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://profiler.firefox.comFound
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://relay.firefox.com/accounts/profile/?utm_medium=firefox-desktop&utm_source=modal&utm_campaign
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://relay.firefox.com/api/v1/
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/diagnostic?site=
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&p
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/fullHashes:find?$ct=application/x-protobuf&key=%GOOGLE_SAFEBR
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatHits?$ct=application/x-protobuf&key=%GOOGLE_SAFEBROWSIN
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=%GOOGL
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://sb-ssl.google.com/safebrowsing/clientreport/download?key=%GOOGLE_SAFEBROWSING_API_KEY%
Source: firefox.exe, 00000020.00000002.2918847879.0000017CD9133000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2908457770.0000017CD5A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com
Source: firefox.exe, 00000020.00000003.2818486632.0000017CD943C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com/
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com/defineCursorUpdateMethods
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.comError:
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/abuse/report/addon/
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/addon/
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/language-tools/?app=firefox&type=language&appversi
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/discovery/?lang=%LOCALE%&edition=%DISTRIBUTION%
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5AE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://smartblock.firefox.etp/facebook.svg
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5AE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://smartblock.firefox.etp/play.svg
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://snippets.cdn.mozilla.net/%STARTPAGE_VERSION%/%NAME%/%VERSION%/%APPBUILDID%/%BUILD_TARGET%/%L
Source: firefox.exe, 00000020.00000002.2914904234.0000017CD7978000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD6703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/
Source: firefox.exe, 00000020.00000002.2914904234.0000017CD7978000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD6703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/spocs
Source: firefox.exe, 00000020.00000002.2914904234.0000017CD7978000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD6703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/user
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5AE0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2933948328.0000017CDA07C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-js
Source: firefox.exe, 00000020.00000002.2933675468.0000017CD9F03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-pixel
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-pixelhttps://static.adsafeprotected.com/firefox-etp-j
Source: f039f524ee.exe, 0000000F.00000003.2590447061.000000000576E000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2714415572.0000000005945000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.microsof
Source: firefox.exe, 00000020.00000002.2918847879.0000017CD9133000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2908457770.0000017CD5A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org
Source: firefox.exe, 00000020.00000002.2933675468.0000017CD9F17000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/
Source: firefox.exe, 00000020.00000002.2933675468.0000017CD9F17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/Master
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cryptominers-report
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/firefox-relay-integration
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/password-manager-report
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/search-engine-removal
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/send-tab
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/shield
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/social-media-tracking-report
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/tracking-content-report
Source: firefox.exe, 00000020.00000002.2933675468.0000017CD9F17000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2945286285.0000017CDBBA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/118.0.1/WINNT/en-US/
Source: firefox.exe, 00000020.00000002.2933675468.0000017CD9F17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/118.0.1/WINNT/en-US/browser.newtabpage.activity-stream.feeds.s
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5AE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/captive-portal
Source: f039f524ee.exe, 00000011.00000003.2776079766.00000000059C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: firefox.exe, 00000020.00000002.2908012090.0000017CD592C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windows
Source: firefox.exe, 00000020.00000002.2933675468.0000017CD9F17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/website-translation
Source: firefox.exe, 00000020.00000002.2933675468.0000017CD9F17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/website-translationtranslations-panel-settings-always-translate-langu
Source: f039f524ee.exe, 00000011.00000003.2776079766.00000000059C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: file.exe, 00000000.00000003.1990378087.000000000C0AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.orgbookmarksToolbarWasVisiblehttps://monitor.firefox.comnetwork.proxy.backup
Source: file.exe, 00000000.00000002.2107422140.0000000001034000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1850065167.0000000005BDD000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2590447061.000000000576C000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2615864764.0000000005765000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2590570427.0000000005765000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2615626694.0000000005765000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2714885498.00000000058F7000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2714415572.0000000005943000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2741888141.00000000058F7000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2742266532.00000000058F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: f039f524ee.exe, 0000000F.00000003.2590570427.0000000005740000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2714885498.00000000058D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: file.exe, 00000000.00000002.2107422140.0000000001034000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1850065167.0000000005BDD000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2590447061.000000000576C000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2615864764.0000000005765000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2590570427.0000000005765000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2615626694.0000000005765000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2714885498.00000000058F7000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2714415572.0000000005943000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2741888141.00000000058F7000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2742266532.00000000058F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: f039f524ee.exe, 0000000F.00000003.2590570427.0000000005740000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2714885498.00000000058D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://token.services.mozilla.com/1.0/sync/1.5
Source: firefox.exe, 00000020.00000002.2908012090.0000017CD592C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-2
Source: firefox.exe, 00000020.00000002.2908012090.0000017CD592C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-3.1
Source: firefox.exe, 00000020.00000002.2908012090.0000017CD592C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-4
Source: firefox.exe, 00000020.00000002.2908012090.0000017CD592C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc7515#appendix-C)
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://topsites.services.mozilla.com/cid/
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://tracking-protection-issues.herokuapp.com/new
Source: firefox.exe, 00000020.00000002.2918847879.0000017CD9133000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2908457770.0000017CD5A03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2914904234.0000017CD79F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://truecolors.firefox.com
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://truecolors.firefox.comhttps://addons.mozilla.orgpictureinpicture.settingsaccount-connection-
Source: firefox.exe, 00000020.00000002.2914904234.0000017CD7978000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD6757000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD6703000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD677D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://versioncheck.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM_ID
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-%CHANNEL%-browser&utm_campaig
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campaign=about-pr
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://webcompat.com/issues/new
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://webextensions.settings.services.mozilla.com/v1
Source: file.exe, 00000000.00000002.2112319814.000000000BD12000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2107233640.0000000000ED6000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2649157391.0000000001027000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2914904234.0000017CD7978000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD6757000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2904680065.0000017CD4FAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD677D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2819165160.0000017CD9477000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2818486632.0000017CD943C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/moz-extension://e2beb7c2-ef50-4ddd-9210-92a40514d
Source: firefox.exe, 00000020.00000002.2910130082.0000017CD6725000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.de/
Source: file.exe, 00000000.00000003.1863399988.0000000000ED0000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2589952496.000000000573F000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2590072407.0000000005728000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2713287494.00000000058EB000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2713694037.00000000058E9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe, 00000000.00000002.2112319814.000000000BD12000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2107233640.0000000000ED6000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2649157391.0000000001027000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2776788243.00000000011D8000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2914904234.0000017CD7978000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD6757000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2904680065.0000017CD4FAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD677D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2819165160.0000017CD9477000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2818486632.0000017CD943C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/search?client=firefox&q=
Source: file.exe, 00000000.00000003.1863399988.0000000000ED0000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2589952496.000000000573F000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2590072407.0000000005728000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2713287494.00000000058EB000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2713694037.00000000058E9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/policies/privacy/
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2819165160.0000017CD9477000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2818486632.0000017CD943C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/geolocation/v1/geolocate?key=%GOOGLE_LOCATION_SERVICE_API_KEY%
Source: firefox.exe, 00000020.00000002.2910130082.0000017CD679E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2962100177.0000360BFBE04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2900114787.0000017CC988F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2896531875.0000001889D3C000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/about/legal/terms/subscription-services/
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/releasenotes/?utm_source=firefox-browser&utm_medi
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/tour/
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/geolocation/
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/new?reason=manual-update
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/notes
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/set-as-default/thanks/
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/xr/
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/privacy/subscription-services/
Source: file.exe, 00000000.00000002.2107422140.0000000001117000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: f039f524ee.exe, 00000011.00000003.2776079766.00000000059C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: file.exe, 00000000.00000002.2107422140.0000000001117000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/t.exe
Source: file.exe, 00000000.00000002.2107422140.0000000001117000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: f039f524ee.exe, 00000011.00000003.2776079766.00000000059C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: file.exe, 00000000.00000002.2107422140.0000000001117000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: file.exe, 00000000.00000003.1990378087.000000000C0AA000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2648581024.0000000005834000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2776079766.00000000059C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: f039f524ee.exe, 00000011.00000003.2776079766.00000000059C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/android/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/ios/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campa
Source: firefox.exe, 00000020.00000002.2933675468.0000017CD9F17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/new/
Source: firefox.exe, 00000020.00000002.2933675468.0000017CD9F17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/new/resource:///modules/UrlbarPrefs.sys.mjsdelete-browsing-search-do
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#crash-reporter
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#health-report
Source: file.exe, 00000000.00000002.2107422140.0000000001117000.00000040.00000001.01000000.00000003.sdmp, firefox.exe, 00000020.00000002.2904680065.0000017CD4F5F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: firefox.exe, 00000020.00000002.2914904234.0000017CD7978000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD6703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/#suggest-relevant-content
Source: firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: file.exe, 00000000.00000003.1990378087.000000000C0AA000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2648581024.0000000005834000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2776079766.00000000059C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: file.exe, 00000000.00000002.2107422140.0000000001117000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/host.exe
Source: firefox.exe, 00000020.00000002.2896531875.0000001889D3C000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.orgo
Source: firefox.exe, 00000020.00000002.2918847879.0000017CD9176000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2894411295.0000001882C3B000.00000004.00000010.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2949018481.0000017CDC0E4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2951694809.0000017CDCB78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5AAF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2908457770.0000017CD5A03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2906223989.0000017CD50B5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.openh264.org/
Source: firefox.exe, 00000020.00000002.2914904234.0000017CD7978000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD6757000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD6703000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD677D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.reddit.com/
Source: firefox.exe, 00000020.00000002.2949018481.0000017CDC0E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.tsn.ca
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.widevine.com/
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.widevine.com/cleanupTemporaryAddons/existing
Source: firefox.exe, 00000020.00000002.2910130082.0000017CD6703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/
Source: firefox.exe, 00000020.00000002.2908012090.0000017CD5912000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2908012090.0000017CD592C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://xhr.spec.whatwg.org/#sync-warning
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5AE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com
Source: firefox.exe, 00000020.00000002.2943062764.0000017CDB3A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/
Source: firefox.exe, 00000020.00000002.2933675468.0000017CD9F17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5AE0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2899835765.0000017CC9630000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd#PlacesToolbarItems
Source: firefox.exe, 0000001E.00000002.2771235389.0000022DFE241000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2797673549.0000029CCDEEF000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2899622099.0000017CC9529000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd--no-default-browser
Source: 18d00389b3.exe, 00000012.00000003.2823899502.00000000017C2000.00000004.00000020.00020000.00000000.sdmp, 18d00389b3.exe, 00000012.00000002.2848331214.00000000017C6000.00000004.00000020.00020000.00000000.sdmp, 18d00389b3.exe, 00000012.00000003.2820838942.00000000017C1000.00000004.00000020.00020000.00000000.sdmp, 18d00389b3.exe, 00000012.00000003.2820621960.00000000017BC000.00000004.00000020.00020000.00000000.sdmp, 18d00389b3.exe, 00000012.00000003.2831596841.00000000017C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdBx
Source: firefox.exe, 00000020.00000002.2902487228.0000017CCB47F000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2902487228.0000017CCB43A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdMOZ_CRASHREPORTER_RE
Source: firefox.exe, 00000020.00000002.2900114787.0000017CC9803000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdg
Source: firefox.exe, 00000020.00000002.2900114787.0000017CC9811000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdhttps://crash-report
Source: firefox.exe, 00000020.00000002.2900114787.0000017CC985D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdx
Source: firefox.exe, 00000020.00000002.2933675468.0000017CD9F17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/accountgWindowsWithUnloadHandlerensureUnloadHandlerRegisteredstrippedUrlToTopPre
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5AE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.comFirefoxViewNotificationManager
Source: firefox.exe, 00000020.00000002.2908457770.0000017CD5AE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.comLOAD_FLAGS_FORCE_ALLOW_COOKIES
Source: firefox.exe, 00000020.00000002.2961359117.00000F1AEFE00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.comZ

System Summary

Binary is likely a compiled AutoIt script file

Source: 18d00389b3.exe, 00000012.00000000.2682081483.00000000008E2000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.		memstr_2b9b1b8b-e
Source: 18d00389b3.exe, 00000012.00000000.2682081483.00000000008E2000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer		memstr_8d194914-e

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: BAKFCBFHJD.exe.0.dr	Static PE information: section name:
Source: BAKFCBFHJD.exe.0.dr	Static PE information: section name: .idata
Source: skotes.exe.9.dr	Static PE information: section name:
Source: skotes.exe.9.dr	Static PE information: section name: .idata
Source: random[1].exe.12.dr	Static PE information: section name:
Source: random[1].exe.12.dr	Static PE information: section name: .idata
Source: random[1].exe.12.dr	Static PE information: section name:
Source: a17088d8c7.exe.12.dr	Static PE information: section name:
Source: a17088d8c7.exe.12.dr	Static PE information: section name: .idata
Source: a17088d8c7.exe.12.dr	Static PE information: section name:
Source: random[1].exe0.12.dr	Static PE information: section name:
Source: random[1].exe0.12.dr	Static PE information: section name: .idata
Source: random[1].exe0.12.dr	Static PE information: section name:
Source: f039f524ee.exe.12.dr	Static PE information: section name:
Source: f039f524ee.exe.12.dr	Static PE information: section name: .idata
Source: f039f524ee.exe.12.dr	Static PE information: section name:
Source: random[1].exe1.12.dr	Static PE information: section name:
Source: random[1].exe1.12.dr	Static PE information: section name: .idata
Source: random[1].exe1.12.dr	Static PE information: section name:
Source: f377015f96.exe.12.dr	Static PE information: section name:
Source: f377015f96.exe.12.dr	Static PE information: section name: .idata
Source: f377015f96.exe.12.dr	Static PE information: section name:
Source: random[2].exe0.12.dr	Static PE information: section name:
Source: random[2].exe0.12.dr	Static PE information: section name: .idata
Source: 9f6ad733e2.exe.12.dr	Static PE information: section name:
Source: 9f6ad733e2.exe.12.dr	Static PE information: section name: .idata

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C47ED10 malloc,NtFlushVirtualMemory,memset,memset,memset,memset,memset,memcpy,free,memset,memset,memcpy,memset,memset,memset,memset,memset,	0_2_6C47ED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4BB700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C4BB700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4BB8C0 rand_s,NtQueryVirtualMemory,	0_2_6C4BB8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4BB910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6C4BB910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C45F280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C45F280
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6862C0 PR_dtoa,PR_GetCurrentThread,strlen,NtFlushVirtualMemory,PR_GetCurrentThread,memcpy,memcpy,	0_2_6C6862C0

Source: C:\Users\user\Documents\BAKFCBFHJD.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4535A0	0_2_6C4535A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C465440	0_2_6C465440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4C545C	0_2_6C4C545C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4CAC00	0_2_6C4CAC00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C495C10	0_2_6C495C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4A2C10	0_2_6C4A2C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4C542B	0_2_6C4C542B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4664C0	0_2_6C4664C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C47D4D0	0_2_6C47D4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C45D4E0	0_2_6C45D4E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C496CF0	0_2_6C496CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C466C80	0_2_6C466C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4B34A0	0_2_6C4B34A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4BC4A0	0_2_6C4BC4A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C46FD00	0_2_6C46FD00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C47ED10	0_2_6C47ED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C480512	0_2_6C480512
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C490DD0	0_2_6C490DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4B85F0	0_2_6C4B85F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4A2E4E	0_2_6C4A2E4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C474640	0_2_6C474640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C479E50	0_2_6C479E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C493E50	0_2_6C493E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4C6E63	0_2_6C4C6E63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C45C670	0_2_6C45C670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4A5600	0_2_6C4A5600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C497E10	0_2_6C497E10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4B9E30	0_2_6C4B9E30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4C76E3	0_2_6C4C76E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C45BEF0	0_2_6C45BEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C46FEF0	0_2_6C46FEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4BE680	0_2_6C4BE680
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C475E90	0_2_6C475E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4B4EA0	0_2_6C4B4EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C469F00	0_2_6C469F00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C497710	0_2_6C497710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C45DFE0	0_2_6C45DFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C486FF0	0_2_6C486FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4A77A0	0_2_6C4A77A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C478850	0_2_6C478850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C47D850	0_2_6C47D850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C49F070	0_2_6C49F070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C467810	0_2_6C467810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C49B820	0_2_6C49B820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4A4820	0_2_6C4A4820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4C50C7	0_2_6C4C50C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C47C0E0	0_2_6C47C0E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4958E0	0_2_6C4958E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4860A0	0_2_6C4860A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C47A940	0_2_6C47A940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C46D960	0_2_6C46D960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4AB970	0_2_6C4AB970
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4CB170	0_2_6C4CB170
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C495190	0_2_6C495190
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4B2990	0_2_6C4B2990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C45C9A0	0_2_6C45C9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C48D9B0	0_2_6C48D9B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C499A60	0_2_6C499A60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C498AC0	0_2_6C498AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C471AF0	0_2_6C471AF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C49E2F0	0_2_6C49E2F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4CBA90	0_2_6C4CBA90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4522A0	0_2_6C4522A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C484AA0	0_2_6C484AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C46CAB0	0_2_6C46CAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4C2AB0	0_2_6C4C2AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C455340	0_2_6C455340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C46C370	0_2_6C46C370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C49D320	0_2_6C49D320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4C53C8	0_2_6C4C53C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C45F380	0_2_6C45F380
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C50AC60	0_2_6C50AC60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5C6C00	0_2_6C5C6C00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5DAC30	0_2_6C5DAC30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C55ECD0	0_2_6C55ECD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4FECC0	0_2_6C4FECC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5CED70	0_2_6C5CED70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C62AD50	0_2_6C62AD50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C688D20	0_2_6C688D20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68CDC0	0_2_6C68CDC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C596D90	0_2_6C596D90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C504DB0	0_2_6C504DB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C59EE70	0_2_6C59EE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E0E20	0_2_6C5E0E20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C50AEC0	0_2_6C50AEC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5A0EC0	0_2_6C5A0EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C586E90	0_2_6C586E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C56EF40	0_2_6C56EF40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5C2F70	0_2_6C5C2F70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C506F10	0_2_6C506F10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C640F20	0_2_6C640F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5DEFF0	0_2_6C5DEFF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C500FE0	0_2_6C500FE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C648FB0	0_2_6C648FB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C50EFB0	0_2_6C50EFB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D4840	0_2_6C5D4840
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C550820	0_2_6C550820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C58A820	0_2_6C58A820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6068E0	0_2_6C6068E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C538960	0_2_6C538960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C556900	0_2_6C556900
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C61C9E0	0_2_6C61C9E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5349F0	0_2_6C5349F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5C09B0	0_2_6C5C09B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5909A0	0_2_6C5909A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5BA9A0	0_2_6C5BA9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C57CA70	0_2_6C57CA70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5AEA00	0_2_6C5AEA00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5B8A30	0_2_6C5B8A30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C57EA80	0_2_6C57EA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C606BE0	0_2_6C606BE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5A0BA0	0_2_6C5A0BA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C518460	0_2_6C518460
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C58A430	0_2_6C58A430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C564420	0_2_6C564420
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5464D0	0_2_6C5464D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C59A4D0	0_2_6C59A4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C62A480	0_2_6C62A480
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C558540	0_2_6C558540
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C604540	0_2_6C604540
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5A0570	0_2_6C5A0570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C648550	0_2_6C648550
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C562560	0_2_6C562560
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C58E5F0	0_2_6C58E5F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5CA5E0	0_2_6C5CA5E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4F45B0	0_2_6C4F45B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C55C650	0_2_6C55C650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5246D0	0_2_6C5246D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C55E6E0	0_2_6C55E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C59E6E0	0_2_6C59E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C580700	0_2_6C580700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C52A7D0	0_2_6C52A7D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C54E070	0_2_6C54E070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5C8010	0_2_6C5C8010
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5CC000	0_2_6C5CC000
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4F8090	0_2_6C4F8090
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5100B0	0_2_6C5100B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5DC0B0	0_2_6C5DC0B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C568140	0_2_6C568140
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C576130	0_2_6C576130
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E4130	0_2_6C5E4130
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5001E0	0_2_6C5001E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C598250	0_2_6C598250
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C588260	0_2_6C588260
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5CA210	0_2_6C5CA210
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D8220	0_2_6C5D8220
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6862C0	0_2_6C6862C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5CE2B0	0_2_6C5CE2B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D22A0	0_2_6C5D22A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C61C360	0_2_6C61C360
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C508340	0_2_6C508340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C642370	0_2_6C642370
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Code function: 9_2_004C7049	9_2_004C7049
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Code function: 9_2_004C8860	9_2_004C8860
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Code function: 9_2_004C78BB	9_2_004C78BB
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Code function: 9_2_00598101	9_2_00598101
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Code function: 9_2_004C31A8	9_2_004C31A8
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Code function: 9_2_00484B30	9_2_00484B30
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Code function: 9_2_004C2D10	9_2_004C2D10
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Code function: 9_2_00484DE0	9_2_00484DE0
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Code function: 9_2_004B7F36	9_2_004B7F36
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Code function: 9_2_004C779B	9_2_004C779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 10_2_00F878BB	10_2_00F878BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 10_2_00F88860	10_2_00F88860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 10_2_00F87049	10_2_00F87049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 10_2_00F831A8	10_2_00F831A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 10_2_00F44B30	10_2_00F44B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 10_2_00F44DE0	10_2_00F44DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 10_2_00F82D10	10_2_00F82D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 10_2_00F8779B	10_2_00F8779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 10_2_00F77F36	10_2_00F77F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 11_2_00F878BB	11_2_00F878BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 11_2_00F88860	11_2_00F88860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 11_2_00F87049	11_2_00F87049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 11_2_00F831A8	11_2_00F831A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 11_2_00F44B30	11_2_00F44B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 11_2_00F44DE0	11_2_00F44DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 11_2_00F82D10	11_2_00F82D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 11_2_00F8779B	11_2_00F8779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 11_2_00F77F36	11_2_00F77F36

Source: Joe Sandbox View

Dropped File: C:\ProgramData\freebl3.dll EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C523620 appears 52 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C6809D0 appears 203 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C529B10 appears 46 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C4994D0 appears 90 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C48CBE8 appears 134 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C68D930 appears 38 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C68DAE0 appears 47 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00F580C0 appears 260 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00F5DF80 appears 36 times
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Code function: String function: 004980C0 appears 130 times

Source: random[1].exe.12.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: a17088d8c7.exe.12.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: file.exe, 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2116507763.000000006C6D5000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2112319814.000000000BD1A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: ipnqzgkg ZLIB complexity 0.9949173823395884
Source: random[1].exe0.12.dr	Static PE information: Section: ZLIB complexity 0.997627865484429
Source: random[1].exe0.12.dr	Static PE information: Section: xyjapqsh ZLIB complexity 0.9942076156859846
Source: f039f524ee.exe.12.dr	Static PE information: Section: ZLIB complexity 0.997627865484429
Source: f039f524ee.exe.12.dr	Static PE information: Section: xyjapqsh ZLIB complexity 0.9942076156859846
Source: random[1].exe1.12.dr	Static PE information: Section: ipnqzgkg ZLIB complexity 0.9949173823395884
Source: f377015f96.exe.12.dr	Static PE information: Section: ipnqzgkg ZLIB complexity 0.9949173823395884

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@135/49@0/23

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C4B7030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6C4B7030

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\EQMKVR6S.htm

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5664:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3752:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4428:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7724:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3964:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3588:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:980:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5472:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4556:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3192:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3848:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7624:64:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5904:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8148:120:WilError_03

Source: C:\Users\user\Documents\BAKFCBFHJD.exe

File created: C:\Users\user\AppData\Local\Temp\abc3bc1985

Jump to behavior

Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe, 00000000.00000002.2109410050.0000000005CE9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2115820620.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2116362437.000000006C68F000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: file.exe, 00000000.00000002.2109410050.0000000005CE9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2115820620.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2116362437.000000006C68F000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2109410050.0000000005CE9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2115820620.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2116362437.000000006C68F000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2109410050.0000000005CE9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2115820620.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2116362437.000000006C68F000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: file.exe, file.exe, 00000000.00000002.2109410050.0000000005CE9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2115820620.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2116362437.000000006C68F000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2109410050.0000000005CE9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2115820620.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000000.00000002.2109410050.0000000005CE9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2115820620.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2116362437.000000006C68F000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: file.exe, 00000000.00000003.1863137759.0000000005BD5000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2590687838.0000000005720000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2741888141.00000000058B9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2109410050.0000000005CE9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2115820620.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: file.exe, 00000000.00000002.2109410050.0000000005CE9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2115820620.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);

Source: file.exe

ReversingLabs: Detection: 44%

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2588 --field-trial-handle=2076,i,11101187424602966218,1363370709843346949,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\BAKFCBFHJD.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Documents\BAKFCBFHJD.exe "C:\Users\user\Documents\BAKFCBFHJD.exe"
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe "C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe "C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe "C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe "C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe "C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe"
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe "C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe"
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: unknown	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe "C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe"
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2272 -parentBuildID 20230927232528 -prefsHandle 2196 -prefMapHandle 2176 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0e2b88bc-fb1b-4ee6-b399-2d0b61fdaa7d} 7196 "\\.\pipe\gecko-crash-server-pipe.7196" 17cc9869f10 socket
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe "C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe"
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4500 -parentBuildID 20230927232528 -prefsHandle 4492 -prefMapHandle 4488 -prefsLen 26374 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {91de2f66-b71a-414e-a97d-01546071d5ac} 7196 "\\.\pipe\gecko-crash-server-pipe.7196" 17cc987e310 rdd
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe "C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe"
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe "C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe"
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=f039f524ee.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2448 --field-trial-handle=2280,i,510515106440553161,2480043565169282240,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2320 -parentBuildID 20230927232528 -prefsHandle 2264 -prefMapHandle 2260 -prefsLen 25359 -prefMapSize 238769 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2b17f485-0e86-472e-88cf-afe23e104bea} 280 "\\.\pipe\gecko-crash-server-pipe.280" 234f4b6a910 socket
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=f039f524ee.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2084 --field-trial-handle=1932,i,2083666299261817870,13908559142850350553,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe "C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe"
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=f039f524ee.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1956 --field-trial-handle=1860,i,10040747374664479283,16727769951129841397,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=f039f524ee.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\BAKFCBFHJD.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2588 --field-trial-handle=2076,i,11101187424602966218,1363370709843346949,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Documents\BAKFCBFHJD.exe "C:\Users\user\Documents\BAKFCBFHJD.exe"	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe "C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe "C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe "C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe "C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe "C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=f039f524ee.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=f039f524ee.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=f039f524ee.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=f039f524ee.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2272 -parentBuildID 20230927232528 -prefsHandle 2196 -prefMapHandle 2176 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0e2b88bc-fb1b-4ee6-b399-2d0b61fdaa7d} 7196 "\\.\pipe\gecko-crash-server-pipe.7196" 17cc9869f10 socket
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4500 -parentBuildID 20230927232528 -prefsHandle 4492 -prefMapHandle 4488 -prefsLen 26374 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {91de2f66-b71a-414e-a97d-01546071d5ac} 7196 "\\.\pipe\gecko-crash-server-pipe.7196" 17cc987e310 rdd
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2320 -parentBuildID 20230927232528 -prefsHandle 2264 -prefMapHandle 2260 -prefsLen 25359 -prefMapSize 238769 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2b17f485-0e86-472e-88cf-afe23e104bea} 280 "\\.\pipe\gecko-crash-server-pipe.280" 234f4b6a910 socket
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2448 --field-trial-handle=2280,i,510515106440553161,2480043565169282240,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2084 --field-trial-handle=1932,i,2083666299261817870,13908559142850350553,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1956 --field-trial-handle=1860,i,10040747374664479283,16727769951129841397,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: windows.shell.servicehostbuilder.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: ieframe.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: wkscli.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: mlang.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: policymanager.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: msvcp110_win.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: ieframe.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: wkscli.dll
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: windows.shell.servicehostbuilder.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: ieframe.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: wkscli.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: mlang.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: policymanager.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: msvcp110_win.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: ieframe.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Section loaded: wkscli.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Program Files\Mozilla Firefox\firefox.exe

File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\compatibility.ini

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1799168 > 1048576

Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: file.exe

Static PE information: Raw size of ipnqzgkg is bigger than: 0x100000 < 0x19d000

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2116362437.000000006C68F000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2116362437.000000006C68F000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: f039f524ee.exe, 00000011.00000003.3081089288.0000000008320000.00000004.00001000.00020000.00000000.sdmp, 9f6ad733e2.exe, 00000021.00000003.2802037515.0000000005190000.00000004.00001000.00020000.00000000.sdmp, 9f6ad733e2.exe, 00000021.00000002.2937994456.0000000000EF2000.00000040.00000001.01000000.00000014.sdmp
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.fb0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ipnqzgkg:EW;equqovlh:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;ipnqzgkg:EW;equqovlh:EW;.taggant:EW;
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Unpacked PE file: 9.2.BAKFCBFHJD.exe.480000.0.unpack :EW;.rsrc:W;.idata :W;nnwaoodm:EW;ocwkoyql:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;nnwaoodm:EW;ocwkoyql:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 10.2.skotes.exe.f40000.0.unpack :EW;.rsrc:W;.idata :W;nnwaoodm:EW;ocwkoyql:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;nnwaoodm:EW;ocwkoyql:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 11.2.skotes.exe.f40000.0.unpack :EW;.rsrc:W;.idata :W;nnwaoodm:EW;ocwkoyql:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;nnwaoodm:EW;ocwkoyql:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Unpacked PE file: 16.2.f377015f96.exe.db0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ipnqzgkg:EW;equqovlh:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;ipnqzgkg:EW;equqovlh:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Unpacked PE file: 25.2.f377015f96.exe.db0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ipnqzgkg:EW;equqovlh:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;ipnqzgkg:EW;equqovlh:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Unpacked PE file: 33.2.9f6ad733e2.exe.ef0000.0.unpack :EW;.rsrc:W;.idata :W;cdtvwakf:EW;qjmihuav:EW;.taggant:EW; vs :ER;.rsrc:W;
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Unpacked PE file: 49.2.f377015f96.exe.db0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ipnqzgkg:EW;equqovlh:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;ipnqzgkg:EW;equqovlh:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C4BC410 LoadLibraryW,GetProcAddress,FreeLibrary,

0_2_6C4BC410

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: random[1].exe.12.dr	Static PE information: real checksum: 0x1eebf3 should be: 0x1f2626
Source: a17088d8c7.exe.12.dr	Static PE information: real checksum: 0x1eebf3 should be: 0x1f2626
Source: random[1].exe.0.dr	Static PE information: real checksum: 0x31c073 should be: 0x31a034
Source: 9f6ad733e2.exe.12.dr	Static PE information: real checksum: 0x2cb988 should be: 0x2ccccb
Source: BAKFCBFHJD.exe.0.dr	Static PE information: real checksum: 0x31c073 should be: 0x31a034
Source: f377015f96.exe.12.dr	Static PE information: real checksum: 0x1bd78b should be: 0x1bf97a
Source: f039f524ee.exe.12.dr	Static PE information: real checksum: 0x1de5a6 should be: 0x1de476
Source: random[2].exe0.12.dr	Static PE information: real checksum: 0x2cb988 should be: 0x2ccccb
Source: random[1].exe0.12.dr	Static PE information: real checksum: 0x1de5a6 should be: 0x1de476
Source: random[1].exe1.12.dr	Static PE information: real checksum: 0x1bd78b should be: 0x1bf97a
Source: file.exe	Static PE information: real checksum: 0x1bd78b should be: 0x1bf97a
Source: skotes.exe.9.dr	Static PE information: real checksum: 0x31c073 should be: 0x31a034

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: ipnqzgkg
Source: file.exe	Static PE information: section name: equqovlh
Source: file.exe	Static PE information: section name: .taggant
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name: nnwaoodm
Source: random[1].exe.0.dr	Static PE information: section name: ocwkoyql
Source: random[1].exe.0.dr	Static PE information: section name: .taggant
Source: BAKFCBFHJD.exe.0.dr	Static PE information: section name:
Source: BAKFCBFHJD.exe.0.dr	Static PE information: section name: .idata
Source: BAKFCBFHJD.exe.0.dr	Static PE information: section name: nnwaoodm
Source: BAKFCBFHJD.exe.0.dr	Static PE information: section name: ocwkoyql
Source: BAKFCBFHJD.exe.0.dr	Static PE information: section name: .taggant
Source: skotes.exe.9.dr	Static PE information: section name:
Source: skotes.exe.9.dr	Static PE information: section name: .idata
Source: skotes.exe.9.dr	Static PE information: section name: nnwaoodm
Source: skotes.exe.9.dr	Static PE information: section name: ocwkoyql
Source: skotes.exe.9.dr	Static PE information: section name: .taggant
Source: random[1].exe.12.dr	Static PE information: section name:
Source: random[1].exe.12.dr	Static PE information: section name: .idata
Source: random[1].exe.12.dr	Static PE information: section name:
Source: random[1].exe.12.dr	Static PE information: section name: mkxflzam
Source: random[1].exe.12.dr	Static PE information: section name: ntycqcrd
Source: random[1].exe.12.dr	Static PE information: section name: .taggant
Source: a17088d8c7.exe.12.dr	Static PE information: section name:
Source: a17088d8c7.exe.12.dr	Static PE information: section name: .idata
Source: a17088d8c7.exe.12.dr	Static PE information: section name:
Source: a17088d8c7.exe.12.dr	Static PE information: section name: mkxflzam
Source: a17088d8c7.exe.12.dr	Static PE information: section name: ntycqcrd
Source: a17088d8c7.exe.12.dr	Static PE information: section name: .taggant
Source: random[1].exe0.12.dr	Static PE information: section name:
Source: random[1].exe0.12.dr	Static PE information: section name: .idata
Source: random[1].exe0.12.dr	Static PE information: section name:
Source: random[1].exe0.12.dr	Static PE information: section name: xyjapqsh
Source: random[1].exe0.12.dr	Static PE information: section name: fjnsenoe
Source: random[1].exe0.12.dr	Static PE information: section name: .taggant
Source: f039f524ee.exe.12.dr	Static PE information: section name:
Source: f039f524ee.exe.12.dr	Static PE information: section name: .idata
Source: f039f524ee.exe.12.dr	Static PE information: section name:
Source: f039f524ee.exe.12.dr	Static PE information: section name: xyjapqsh
Source: f039f524ee.exe.12.dr	Static PE information: section name: fjnsenoe
Source: f039f524ee.exe.12.dr	Static PE information: section name: .taggant
Source: random[1].exe1.12.dr	Static PE information: section name:
Source: random[1].exe1.12.dr	Static PE information: section name: .idata
Source: random[1].exe1.12.dr	Static PE information: section name:
Source: random[1].exe1.12.dr	Static PE information: section name: ipnqzgkg
Source: random[1].exe1.12.dr	Static PE information: section name: equqovlh
Source: random[1].exe1.12.dr	Static PE information: section name: .taggant
Source: f377015f96.exe.12.dr	Static PE information: section name:
Source: f377015f96.exe.12.dr	Static PE information: section name: .idata
Source: f377015f96.exe.12.dr	Static PE information: section name:
Source: f377015f96.exe.12.dr	Static PE information: section name: ipnqzgkg
Source: f377015f96.exe.12.dr	Static PE information: section name: equqovlh
Source: f377015f96.exe.12.dr	Static PE information: section name: .taggant
Source: random[2].exe0.12.dr	Static PE information: section name:
Source: random[2].exe0.12.dr	Static PE information: section name: .idata
Source: random[2].exe0.12.dr	Static PE information: section name: cdtvwakf
Source: random[2].exe0.12.dr	Static PE information: section name: qjmihuav
Source: random[2].exe0.12.dr	Static PE information: section name: .taggant
Source: 9f6ad733e2.exe.12.dr	Static PE information: section name:
Source: 9f6ad733e2.exe.12.dr	Static PE information: section name: .idata
Source: 9f6ad733e2.exe.12.dr	Static PE information: section name: cdtvwakf
Source: 9f6ad733e2.exe.12.dr	Static PE information: section name: qjmihuav
Source: 9f6ad733e2.exe.12.dr	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C48B536 push ecx; ret	0_2_6C48B549
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Code function: 9_2_0049D91C push ecx; ret	9_2_0049D92F
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Code function: 9_2_00491359 push es; ret	9_2_0049135A
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 10_2_00F5D91C push ecx; ret	10_2_00F5D92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 11_2_00F5D91C push ecx; ret	11_2_00F5D92F

Source: file.exe	Static PE information: section name: ipnqzgkg entropy: 7.954190185075461
Source: random[1].exe.0.dr	Static PE information: section name: entropy: 7.067745136702224
Source: BAKFCBFHJD.exe.0.dr	Static PE information: section name: entropy: 7.067745136702224
Source: skotes.exe.9.dr	Static PE information: section name: entropy: 7.067745136702224
Source: random[1].exe.12.dr	Static PE information: section name: mkxflzam entropy: 7.941774290386521
Source: a17088d8c7.exe.12.dr	Static PE information: section name: mkxflzam entropy: 7.941774290386521
Source: random[1].exe0.12.dr	Static PE information: section name: entropy: 7.97823310420282
Source: random[1].exe0.12.dr	Static PE information: section name: xyjapqsh entropy: 7.953197683807969
Source: f039f524ee.exe.12.dr	Static PE information: section name: entropy: 7.97823310420282
Source: f039f524ee.exe.12.dr	Static PE information: section name: xyjapqsh entropy: 7.953197683807969
Source: random[1].exe1.12.dr	Static PE information: section name: ipnqzgkg entropy: 7.954190185075461
Source: f377015f96.exe.12.dr	Static PE information: section name: ipnqzgkg entropy: 7.954190185075461
Source: random[2].exe0.12.dr	Static PE information: section name: entropy: 7.79776762494654
Source: 9f6ad733e2.exe.12.dr	Static PE information: section name: entropy: 7.79776762494654

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\Documents\BAKFCBFHJD.exe

Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[2].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Jump to dropped file
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\Documents\BAKFCBFHJD.exe	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Creates multiple autostart registry keys

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 18d00389b3.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run f039f524ee.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run f377015f96.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 9f6ad733e2.exe	Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Users\user\Documents\BAKFCBFHJD.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run f039f524ee.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run f039f524ee.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run f377015f96.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run f377015f96.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 18d00389b3.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 18d00389b3.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 9f6ad733e2.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 9f6ad733e2.exe	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C4B55F0 LoadLibraryW,LoadLibraryW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_6C4B55F0

Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	System information queried: FirmwareTableInformation
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	System information queried: FirmwareTableInformation
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	System information queried: FirmwareTableInformation
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	System information queried: FirmwareTableInformation

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1383678 second address: 138367C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138367C second address: 1383684 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1383684 second address: 138369A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F06B90E9DDCh 0x00000009 jne 00007F06B90E9DD6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138369A second address: 13836DE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F06B852D3C8h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edi 0x0000000c jg 00007F06B852D3B6h 0x00000012 pop edi 0x00000013 pop edx 0x00000014 pop eax 0x00000015 push eax 0x00000016 push edx 0x00000017 jns 00007F06B852D3BCh 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007F06B852D3BCh 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13836DE second address: 13836F8 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F06B90E9DD6h 0x00000008 jmp 00007F06B90E9DE0h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13836F8 second address: 13836FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138383D second address: 138384D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jl 00007F06B90E9DDEh 0x0000000c push eax 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1383B59 second address: 1383B5F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1383B5F second address: 1383B6D instructions: 0x00000000 rdtsc 0x00000002 jne 00007F06B90E9DD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1385F46 second address: 1385F4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1385F4A second address: 1385F60 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F06B90E9DD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e ja 00007F06B90E9DD8h 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1385F60 second address: 1385F65 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1385F65 second address: 1385F7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b push eax 0x0000000c push edx 0x0000000d jo 00007F06B90E9DD8h 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1385F7A second address: 1385F9A instructions: 0x00000000 rdtsc 0x00000002 jns 00007F06B852D3C0h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [eax] 0x0000000c push eax 0x0000000d push edx 0x0000000e js 00007F06B852D3BCh 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1385F9A second address: 1385F9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1385F9E second address: 1385FA4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1386028 second address: 1386073 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c jmp 00007F06B90E9DE0h 0x00000011 mov eax, dword ptr [eax] 0x00000013 push edi 0x00000014 jnl 00007F06B90E9DD8h 0x0000001a pop edi 0x0000001b mov dword ptr [esp+04h], eax 0x0000001f jnp 00007F06B90E9E04h 0x00000025 push eax 0x00000026 push edx 0x00000027 jmp 00007F06B90E9DE7h 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1386073 second address: 1386104 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B852D3C1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a mov esi, dword ptr [ebp+122D3A6Fh] 0x00000010 jmp 00007F06B852D3C8h 0x00000015 push 00000003h 0x00000017 push 00000000h 0x00000019 push esi 0x0000001a call 00007F06B852D3B8h 0x0000001f pop esi 0x00000020 mov dword ptr [esp+04h], esi 0x00000024 add dword ptr [esp+04h], 0000001Bh 0x0000002c inc esi 0x0000002d push esi 0x0000002e ret 0x0000002f pop esi 0x00000030 ret 0x00000031 push 00000000h 0x00000033 mov dword ptr [ebp+122D21ABh], ebx 0x00000039 push 00000003h 0x0000003b xor esi, dword ptr [ebp+122D39B3h] 0x00000041 or edx, 3201D4B3h 0x00000047 push 85D03809h 0x0000004c push eax 0x0000004d push edx 0x0000004e push ecx 0x0000004f jmp 00007F06B852D3C9h 0x00000054 pop ecx 0x00000055 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1386104 second address: 1386143 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F06B90E9DDCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xor dword ptr [esp], 45D03809h 0x00000011 jl 00007F06B90E9DD7h 0x00000017 lea ebx, dword ptr [ebp+12459E99h] 0x0000001d jng 00007F06B90E9DDCh 0x00000023 push eax 0x00000024 jns 00007F06B90E9DE2h 0x0000002a jnp 00007F06B90E9DDCh 0x00000030 push eax 0x00000031 push edx 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138619D second address: 13861A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13861A1 second address: 13861AB instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F06B90E9DD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13861AB second address: 1386256 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F06B852D3CFh 0x00000008 jmp 00007F06B852D3C9h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f nop 0x00000010 jnl 00007F06B852D3CEh 0x00000016 push 00000000h 0x00000018 xor ecx, dword ptr [ebp+122D2580h] 0x0000001e push 5C6D8844h 0x00000023 jng 00007F06B852D3BCh 0x00000029 pushad 0x0000002a push edx 0x0000002b pop edx 0x0000002c push eax 0x0000002d pop eax 0x0000002e popad 0x0000002f xor dword ptr [esp], 5C6D88C4h 0x00000036 mov edx, 57C5A234h 0x0000003b push 00000003h 0x0000003d jmp 00007F06B852D3BBh 0x00000042 push 00000000h 0x00000044 push eax 0x00000045 mov esi, ebx 0x00000047 pop esi 0x00000048 call 00007F06B852D3C2h 0x0000004d mov si, E982h 0x00000051 pop esi 0x00000052 push 00000003h 0x00000054 or esi, 3EF67F8Ah 0x0000005a call 00007F06B852D3B9h 0x0000005f pushad 0x00000060 push eax 0x00000061 push edx 0x00000062 jns 00007F06B852D3B6h 0x00000068 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1386256 second address: 1386276 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F06B90E9DDEh 0x0000000b popad 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push ecx 0x00000010 jo 00007F06B90E9DD6h 0x00000016 pop ecx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1386276 second address: 138631F instructions: 0x00000000 rdtsc 0x00000002 jno 00007F06B852D3CAh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e jmp 00007F06B852D3C8h 0x00000013 mov eax, dword ptr [eax] 0x00000015 push edx 0x00000016 jmp 00007F06B852D3BBh 0x0000001b pop edx 0x0000001c mov dword ptr [esp+04h], eax 0x00000020 jmp 00007F06B852D3C8h 0x00000025 pop eax 0x00000026 adc edx, 140D7800h 0x0000002c lea ebx, dword ptr [ebp+12459EA2h] 0x00000032 push 00000000h 0x00000034 push esi 0x00000035 call 00007F06B852D3B8h 0x0000003a pop esi 0x0000003b mov dword ptr [esp+04h], esi 0x0000003f add dword ptr [esp+04h], 00000019h 0x00000047 inc esi 0x00000048 push esi 0x00000049 ret 0x0000004a pop esi 0x0000004b ret 0x0000004c and cx, A046h 0x00000051 xchg eax, ebx 0x00000052 push eax 0x00000053 push edx 0x00000054 pushad 0x00000055 jbe 00007F06B852D3B6h 0x0000005b jbe 00007F06B852D3B6h 0x00000061 popad 0x00000062 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1397C0E second address: 1397C2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 jmp 00007F06B90E9DE5h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1397C2B second address: 1397C45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F06B852D3C0h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137284F second address: 1372855 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A44C1 second address: 13A44D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F06B852D3B6h 0x0000000a jc 00007F06B852D3B6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A44D1 second address: 13A450F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F06B90E9DE1h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jp 00007F06B90E9DDCh 0x00000011 pop edx 0x00000012 pop eax 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 push esi 0x00000017 pop esi 0x00000018 push ebx 0x00000019 pop ebx 0x0000001a jmp 00007F06B90E9DE1h 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A4659 second address: 13A465F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A4A78 second address: 13A4A88 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push edi 0x00000004 pop edi 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 pop ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a jnp 00007F06B90E9DD6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A4D03 second address: 13A4D0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F06B852D3B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A4D0D second address: 13A4D34 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 js 00007F06B90E9DEFh 0x0000000e jmp 00007F06B90E9DE9h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A5149 second address: 13A5167 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F06B852D3C7h 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A5167 second address: 13A5182 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B90E9DE1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A5182 second address: 13A5190 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnp 00007F06B852D3B6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A5190 second address: 13A5194 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A5194 second address: 13A51A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F06B852D3B6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1374288 second address: 13742A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007F06B90E9DE3h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13742A5 second address: 13742A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A559E second address: 13A55AA instructions: 0x00000000 rdtsc 0x00000002 jc 00007F06B90E9DD6h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A5C97 second address: 13A5C9D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A5C9D second address: 13A5CA4 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A5E20 second address: 13A5E36 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B852D3BFh 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A5F99 second address: 13A5FB0 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F06B90E9DD6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f jne 00007F06B90E9DD6h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A63DA second address: 13A63DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13AACD1 second address: 13AACD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13AACD5 second address: 13AACFB instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jc 00007F06B852D3B6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edi 0x0000000d jmp 00007F06B852D3C2h 0x00000012 pop edi 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13AACFB second address: 13AACFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13AACFF second address: 13AAD03 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13AAD03 second address: 13AAD15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jg 00007F06B90E9DD6h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13AAD15 second address: 13AAD19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13AAD19 second address: 13AAD1D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13AAD1D second address: 13AAD23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13AAD23 second address: 13AAD29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13AAD29 second address: 13AAD2F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13AAD2F second address: 13AAD33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137E3CE second address: 137E3D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137E3D2 second address: 137E3DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137E3DC second address: 137E3E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137E3E0 second address: 137E3EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F06B90E9DD6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13AD469 second address: 13AD483 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B852D3BFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13AD483 second address: 13AD489 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13AD489 second address: 13AD48F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B11F5 second address: 13B120F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push esi 0x00000006 push eax 0x00000007 pop eax 0x00000008 pushad 0x00000009 popad 0x0000000a pop esi 0x0000000b pop edi 0x0000000c push eax 0x0000000d push edx 0x0000000e jne 00007F06B90E9DDCh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B065D second address: 13B0671 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push ebx 0x00000006 jmp 00007F06B852D3BCh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B0807 second address: 13B0812 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F06B90E9DD6h 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B0959 second address: 13B095D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B0DD4 second address: 13B0DD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B0DD9 second address: 13B0DDE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B0DDE second address: 13B0DEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F06B90E9DD6h 0x0000000a push edi 0x0000000b pop edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B0DEC second address: 13B0E05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F06B852D3C1h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B0E05 second address: 13B0E0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B395B second address: 13B395F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1375CB4 second address: 1375CBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F06B90E9DD6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B5B67 second address: 13B5B6B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B5D69 second address: 13B5D73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B6214 second address: 13B6248 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 mov dword ptr [esp], ebx 0x00000009 push 00000000h 0x0000000b push ecx 0x0000000c call 00007F06B852D3B8h 0x00000011 pop ecx 0x00000012 mov dword ptr [esp+04h], ecx 0x00000016 add dword ptr [esp+04h], 00000018h 0x0000001e inc ecx 0x0000001f push ecx 0x00000020 ret 0x00000021 pop ecx 0x00000022 ret 0x00000023 nop 0x00000024 push eax 0x00000025 push edx 0x00000026 jc 00007F06B852D3BCh 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B6248 second address: 13B624C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B624C second address: 13B626D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B852D3C8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push ecx 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B6716 second address: 13B671C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B671C second address: 13B6733 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 jo 00007F06B852D3BCh 0x0000000e jc 00007F06B852D3B6h 0x00000014 push esi 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B67D5 second address: 13B67DF instructions: 0x00000000 rdtsc 0x00000002 jp 00007F06B90E9DD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B67DF second address: 13B67E4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B769C second address: 13B771F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B90E9DDBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push ebx 0x0000000e call 00007F06B90E9DD8h 0x00000013 pop ebx 0x00000014 mov dword ptr [esp+04h], ebx 0x00000018 add dword ptr [esp+04h], 0000001Bh 0x00000020 inc ebx 0x00000021 push ebx 0x00000022 ret 0x00000023 pop ebx 0x00000024 ret 0x00000025 jnl 00007F06B90E9DDCh 0x0000002b jbe 00007F06B90E9DD6h 0x00000031 push edx 0x00000032 add dword ptr [ebp+122D29FAh], eax 0x00000038 pop esi 0x00000039 push 00000000h 0x0000003b push 00000000h 0x0000003d push edx 0x0000003e call 00007F06B90E9DD8h 0x00000043 pop edx 0x00000044 mov dword ptr [esp+04h], edx 0x00000048 add dword ptr [esp+04h], 00000016h 0x00000050 inc edx 0x00000051 push edx 0x00000052 ret 0x00000053 pop edx 0x00000054 ret 0x00000055 or esi, 5BD013E9h 0x0000005b push 00000000h 0x0000005d mov dword ptr [ebp+122D2271h], edx 0x00000063 push eax 0x00000064 push eax 0x00000065 push edx 0x00000066 push eax 0x00000067 push edx 0x00000068 push eax 0x00000069 push edx 0x0000006a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B771F second address: 13B7723 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B7723 second address: 13B7729 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BA6CF second address: 13BA6DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F06B852D3BBh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BB0D8 second address: 13BB0DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BB174 second address: 13BB178 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BB178 second address: 13BB1C2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B90E9DE0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jo 00007F06B90E9DD6h 0x00000010 jmp 00007F06B90E9DE3h 0x00000015 popad 0x00000016 popad 0x00000017 push eax 0x00000018 pushad 0x00000019 pushad 0x0000001a jmp 00007F06B90E9DE1h 0x0000001f pushad 0x00000020 popad 0x00000021 popad 0x00000022 pushad 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BBC75 second address: 13BBC87 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B852D3BEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BC77B second address: 13BC782 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BC4B1 second address: 13BC4B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BC4B5 second address: 13BC4BF instructions: 0x00000000 rdtsc 0x00000002 jo 00007F06B90E9DD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BF938 second address: 13BF99A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F06B852D3C7h 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e push eax 0x0000000f mov edi, eax 0x00000011 pop edi 0x00000012 push 00000000h 0x00000014 pushad 0x00000015 push edx 0x00000016 mov dword ptr [ebp+122D33BEh], ecx 0x0000001c pop ecx 0x0000001d sub dword ptr [ebp+122D2AD8h], edx 0x00000023 popad 0x00000024 push 00000000h 0x00000026 mov dword ptr [ebp+122D29D9h], esi 0x0000002c mov di, 2C81h 0x00000030 xchg eax, esi 0x00000031 ja 00007F06B852D3C4h 0x00000037 push eax 0x00000038 jo 00007F06B852D3C4h 0x0000003e push eax 0x0000003f push edx 0x00000040 push ebx 0x00000041 pop ebx 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C597D second address: 13C5981 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C6AE3 second address: 13C6B45 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d jmp 00007F06B852D3BDh 0x00000012 push 00000000h 0x00000014 mov edi, 77A0BB0Eh 0x00000019 push 00000000h 0x0000001b push 00000000h 0x0000001d push ebp 0x0000001e call 00007F06B852D3B8h 0x00000023 pop ebp 0x00000024 mov dword ptr [esp+04h], ebp 0x00000028 add dword ptr [esp+04h], 0000001Bh 0x00000030 inc ebp 0x00000031 push ebp 0x00000032 ret 0x00000033 pop ebp 0x00000034 ret 0x00000035 jp 00007F06B852D3B9h 0x0000003b jnl 00007F06B852D3BCh 0x00000041 push eax 0x00000042 push eax 0x00000043 push edx 0x00000044 push eax 0x00000045 push edx 0x00000046 push eax 0x00000047 pop eax 0x00000048 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C0AE7 second address: 13C0AEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C1AA7 second address: 13C1AAB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C6B45 second address: 13C6B49 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C2B66 second address: 13C2B6A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C0AEB second address: 13C0B10 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 pushad 0x00000009 jmp 00007F06B90E9DE9h 0x0000000e push ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C1AAB second address: 13C1AB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a pushad 0x0000000b popad 0x0000000c pop ebx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C6B49 second address: 13C6B4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C2B6A second address: 13C2B70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C0BB1 second address: 13C0BB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C7BBE second address: 13C7BDD instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jo 00007F06B852D3B6h 0x0000000d ja 00007F06B852D3B6h 0x00000013 popad 0x00000014 popad 0x00000015 push eax 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 jl 00007F06B852D3B6h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C7BDD second address: 13C7BF6 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F06B90E9DD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F06B90E9DDDh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C6DBE second address: 13C6DC3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C8B05 second address: 13C8B5D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push edx 0x0000000a call 00007F06B90E9DD8h 0x0000000f pop edx 0x00000010 mov dword ptr [esp+04h], edx 0x00000014 add dword ptr [esp+04h], 00000016h 0x0000001c inc edx 0x0000001d push edx 0x0000001e ret 0x0000001f pop edx 0x00000020 ret 0x00000021 jmp 00007F06B90E9DDFh 0x00000026 push 00000000h 0x00000028 movzx ebx, si 0x0000002b add ebx, 5BD01066h 0x00000031 push 00000000h 0x00000033 sbb ebx, 30780C84h 0x00000039 push eax 0x0000003a push eax 0x0000003b push edx 0x0000003c pushad 0x0000003d ja 00007F06B90E9DD6h 0x00000043 jne 00007F06B90E9DD6h 0x00000049 popad 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C8B5D second address: 13C8B7B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F06B852D3C9h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CAB5C second address: 13CAB62 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CAB62 second address: 13CAB66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CBC78 second address: 13CBD1E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F06B90E9DDCh 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e ja 00007F06B90E9DEFh 0x00000014 push 00000000h 0x00000016 push 00000000h 0x00000018 push edi 0x00000019 call 00007F06B90E9DD8h 0x0000001e pop edi 0x0000001f mov dword ptr [esp+04h], edi 0x00000023 add dword ptr [esp+04h], 0000001Dh 0x0000002b inc edi 0x0000002c push edi 0x0000002d ret 0x0000002e pop edi 0x0000002f ret 0x00000030 mov bx, dx 0x00000033 push 00000000h 0x00000035 push 00000000h 0x00000037 push ebx 0x00000038 call 00007F06B90E9DD8h 0x0000003d pop ebx 0x0000003e mov dword ptr [esp+04h], ebx 0x00000042 add dword ptr [esp+04h], 00000014h 0x0000004a inc ebx 0x0000004b push ebx 0x0000004c ret 0x0000004d pop ebx 0x0000004e ret 0x0000004f mov ebx, dword ptr [ebp+122D180Ah] 0x00000055 xchg eax, esi 0x00000056 push eax 0x00000057 push edx 0x00000058 pushad 0x00000059 jmp 00007F06B90E9DE9h 0x0000005e ja 00007F06B90E9DD6h 0x00000064 popad 0x00000065 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CBD1E second address: 13CBD31 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F06B852D3BFh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CBD31 second address: 13CBD35 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CBD35 second address: 13CBD44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push ebx 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C9DFE second address: 13C9E04 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C9E04 second address: 13C9E0E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F06B852D3B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CCCAF second address: 13CCD25 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B90E9DDBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a mov edi, dword ptr [ebp+122D2203h] 0x00000010 push 00000000h 0x00000012 mov edi, dword ptr [ebp+122D3AABh] 0x00000018 push 00000000h 0x0000001a push 00000000h 0x0000001c push edx 0x0000001d call 00007F06B90E9DD8h 0x00000022 pop edx 0x00000023 mov dword ptr [esp+04h], edx 0x00000027 add dword ptr [esp+04h], 00000015h 0x0000002f inc edx 0x00000030 push edx 0x00000031 ret 0x00000032 pop edx 0x00000033 ret 0x00000034 jg 00007F06B90E9DDCh 0x0000003a xchg eax, esi 0x0000003b pushad 0x0000003c jmp 00007F06B90E9DE0h 0x00000041 push eax 0x00000042 push edx 0x00000043 jmp 00007F06B90E9DE9h 0x00000048 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CF360 second address: 13CF37E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F06B852D3C9h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CF37E second address: 13CF390 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push esi 0x0000000b jc 00007F06B90E9DD6h 0x00000011 pop esi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CF390 second address: 13CF396 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CF396 second address: 13CF39A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D0553 second address: 13D0557 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D9F40 second address: 13D9F46 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D9F46 second address: 13D9F4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D9F4A second address: 13D9F54 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D9F54 second address: 13D9F5A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D9A8E second address: 13D9AA4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F06B90E9DDCh 0x0000000d push edi 0x0000000e pop edi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D9AA4 second address: 13D9ABA instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F06B852D3BAh 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D9ABA second address: 13D9AF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F06B90E9DE3h 0x00000009 pushad 0x0000000a popad 0x0000000b push edx 0x0000000c pop edx 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F06B90E9DE8h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D9AF0 second address: 13D9AFA instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F06B852D3B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D9AFA second address: 13D9B15 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F06B90E9DEDh 0x00000008 jmp 00007F06B90E9DE1h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DCF18 second address: 13DCF22 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F06B852D3B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DCF22 second address: 13DCF40 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B90E9DE3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d pushad 0x0000000e popad 0x0000000f pop ecx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DCF40 second address: 13DCF45 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DCF45 second address: 13DCF58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DCF58 second address: 13DCF5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DCF5C second address: 13DCF78 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B90E9DE8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DCF78 second address: 13DCF8B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F06B852D3BFh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DCF8B second address: 13DCF9E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a jns 00007F06B90E9DDEh 0x00000010 push edi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DCF9E second address: 13DCFB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 mov dword ptr [esp+04h], eax 0x00000009 pushad 0x0000000a jmp 00007F06B852D3BDh 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DCFB8 second address: 13DCFBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DD07F second address: 13DD083 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DD083 second address: 13DD092 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E3BF0 second address: 13E3BFA instructions: 0x00000000 rdtsc 0x00000002 je 00007F06B852D3BCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136D78E second address: 136D793 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136D793 second address: 136D7B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F06B852D3C3h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 ja 00007F06B852D3B6h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E28AC second address: 13E28B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E28B0 second address: 13E28C1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B852D3BDh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E28C1 second address: 13E28D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jns 00007F06B90E9DD6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E28D1 second address: 13E28D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E28D5 second address: 13E28EC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B90E9DE3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E3029 second address: 13E3033 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E3033 second address: 13E303A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E303A second address: 13E3060 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007F06B852D3BEh 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F06B852D3BCh 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E3060 second address: 13E306E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 ja 00007F06B90E9DDCh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E306E second address: 13E3072 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E3072 second address: 13E3077 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E31C5 second address: 13E31D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 ja 00007F06B852D3BCh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E31D4 second address: 13E31DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E31DE second address: 13E31E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E31E2 second address: 13E31E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E3330 second address: 13E3334 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E3334 second address: 13E333A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E34BF second address: 13E34C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E34C3 second address: 13E34F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F06B90E9DE8h 0x0000000b pop esi 0x0000000c push edi 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F06B90E9DDFh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E9160 second address: 13E9166 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E7F7A second address: 13E7F91 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F06B90E9DE2h 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E80E2 second address: 13E80E7 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E80E7 second address: 13E8111 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F06B90E9DD6h 0x0000000a pop ebx 0x0000000b pushad 0x0000000c jmp 00007F06B90E9DDFh 0x00000011 jmp 00007F06B90E9DDDh 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E83A3 second address: 13E83D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 jmp 00007F06B852D3C6h 0x0000000d jmp 00007F06B852D3C0h 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E83D6 second address: 13E83DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E8513 second address: 13E852F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F06B852D3C1h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d pop esi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E852F second address: 13E8533 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E8533 second address: 13E8550 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 jp 00007F06B852D3C1h 0x0000000e push eax 0x0000000f push edx 0x00000010 push edi 0x00000011 pop edi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E79FC second address: 13E7A17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 pushad 0x00000008 jc 00007F06B90E9DD6h 0x0000000e jp 00007F06B90E9DD6h 0x00000014 jnl 00007F06B90E9DD6h 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E7A17 second address: 13E7A36 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 jmp 00007F06B852D3C9h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E7A36 second address: 13E7A3A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E8863 second address: 13E886B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E886B second address: 13E8870 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E8870 second address: 13E888C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F06B852D3C2h 0x00000009 jg 00007F06B852D3B6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E888C second address: 13E8890 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E89FB second address: 13E8A03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E8B90 second address: 13E8BA7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B90E9DE1h 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E8BA7 second address: 13E8BAB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E8E81 second address: 13E8EA1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B90E9DE8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13EA70F second address: 13EA714 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13EA714 second address: 13EA71C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F27A4 second address: 13F27D9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jp 00007F06B852D3B6h 0x00000009 jmp 00007F06B852D3C7h 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 pushad 0x00000012 jmp 00007F06B852D3BDh 0x00000017 pushad 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B4138 second address: 13B4180 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push esi 0x00000006 pop esi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b jmp 00007F06B90E9DE6h 0x00000010 lea eax, dword ptr [ebp+12487E7Ch] 0x00000016 push esi 0x00000017 xor dword ptr [ebp+122D29F4h], esi 0x0000001d pop ecx 0x0000001e push eax 0x0000001f pushad 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007F06B90E9DE5h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B4180 second address: 139BBE0 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 push eax 0x0000000a pop eax 0x0000000b popad 0x0000000c popad 0x0000000d mov dword ptr [esp], eax 0x00000010 sub dl, 00000000h 0x00000013 call dword ptr [ebp+122D212Eh] 0x00000019 jmp 00007F06B852D3C5h 0x0000001e push edi 0x0000001f pushad 0x00000020 pushad 0x00000021 popad 0x00000022 jmp 00007F06B852D3C4h 0x00000027 popad 0x00000028 push eax 0x00000029 push edx 0x0000002a jmp 00007F06B852D3C8h 0x0000002f jg 00007F06B852D3B6h 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B435D second address: 13B4391 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B90E9DE9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F06B90E9DE3h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B4391 second address: 13B439B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F06B852D3B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B4736 second address: 13B4771 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 ja 00007F06B90E9DDEh 0x0000000d jng 00007F06B90E9DD8h 0x00000013 pushad 0x00000014 popad 0x00000015 mov eax, dword ptr [esp+04h] 0x00000019 jmp 00007F06B90E9DE6h 0x0000001e mov eax, dword ptr [eax] 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 jnc 00007F06B90E9DD6h 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B4771 second address: 13B477B instructions: 0x00000000 rdtsc 0x00000002 jns 00007F06B852D3B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B477B second address: 13B47A2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B90E9DE5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d js 00007F06B90E9DE4h 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B47A2 second address: 13B47A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B4893 second address: 13B4899 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B4978 second address: 13B498F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B852D3C3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B4BCF second address: 13B4BD3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B526D second address: 13B5315 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F06B852D3B8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c pushad 0x0000000d jg 00007F06B852D3B6h 0x00000013 jg 00007F06B852D3B6h 0x00000019 popad 0x0000001a pop eax 0x0000001b nop 0x0000001c push 00000000h 0x0000001e push ebp 0x0000001f call 00007F06B852D3B8h 0x00000024 pop ebp 0x00000025 mov dword ptr [esp+04h], ebp 0x00000029 add dword ptr [esp+04h], 00000018h 0x00000031 inc ebp 0x00000032 push ebp 0x00000033 ret 0x00000034 pop ebp 0x00000035 ret 0x00000036 sub edx, dword ptr [ebp+122D389Fh] 0x0000003c jmp 00007F06B852D3BBh 0x00000041 lea eax, dword ptr [ebp+12487EC0h] 0x00000047 push 00000000h 0x00000049 push ebp 0x0000004a call 00007F06B852D3B8h 0x0000004f pop ebp 0x00000050 mov dword ptr [esp+04h], ebp 0x00000054 add dword ptr [esp+04h], 0000001Dh 0x0000005c inc ebp 0x0000005d push ebp 0x0000005e ret 0x0000005f pop ebp 0x00000060 ret 0x00000061 or dword ptr [ebp+122D2B00h], edx 0x00000067 nop 0x00000068 jno 00007F06B852D3C2h 0x0000006e push eax 0x0000006f push eax 0x00000070 pushad 0x00000071 jmp 00007F06B852D3C0h 0x00000076 push eax 0x00000077 push edx 0x00000078 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B5315 second address: 139C5D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 nop 0x00000007 mov edi, 213E84B9h 0x0000000c lea eax, dword ptr [ebp+12487E7Ch] 0x00000012 clc 0x00000013 push eax 0x00000014 jmp 00007F06B90E9DE2h 0x00000019 mov dword ptr [esp], eax 0x0000001c and edi, dword ptr [ebp+122D2B15h] 0x00000022 call dword ptr [ebp+122D2507h] 0x00000028 jo 00007F06B90E9DEEh 0x0000002e push eax 0x0000002f push edx 0x00000030 push eax 0x00000031 push edx 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 139C5D9 second address: 139C5E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F06B852D3B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 139C5E3 second address: 139C5E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1370D3E second address: 1370D42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1370D42 second address: 1370D59 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B90E9DE3h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1370D59 second address: 1370D8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 jg 00007F06B852D3B6h 0x0000000d pop ecx 0x0000000e jnp 00007F06B852D3DBh 0x00000014 pushad 0x00000015 jmp 00007F06B852D3BAh 0x0000001a jmp 00007F06B852D3C1h 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F1C88 second address: 13F1C8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F1C8C second address: 13F1CBB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F06B852D3BFh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jng 00007F06B852D3BEh 0x00000011 jc 00007F06B852D3B6h 0x00000017 push ecx 0x00000018 pop ecx 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F06B852D3BAh 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F206E second address: 13F2072 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F2072 second address: 13F2078 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F21EB second address: 13F21F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 pop eax 0x00000008 push edi 0x00000009 pop edi 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F21F6 second address: 13F2212 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F06B852D3C1h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d push ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F7F6A second address: 13F7F6E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F7F6E second address: 13F7F77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F6BE0 second address: 13F6BF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F06B90E9DDFh 0x00000009 pop edx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F6F16 second address: 13F6F2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F06B852D3C2h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F6F2C second address: 13F6F4D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B90E9DDBh 0x00000007 jmp 00007F06B90E9DE2h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F70D0 second address: 13F70E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jng 00007F06B852D3BCh 0x0000000b jnl 00007F06B852D3B6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F725F second address: 13F7288 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pushad 0x0000000a jmp 00007F06B90E9DDEh 0x0000000f jp 00007F06B90E9DD6h 0x00000015 push edx 0x00000016 pop edx 0x00000017 popad 0x00000018 pop esi 0x00000019 push eax 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d pop eax 0x0000001e push edi 0x0000001f pop edi 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F7288 second address: 13F72A4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B852D3C8h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F72A4 second address: 13F72B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnp 00007F06B90E9DE2h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F72B2 second address: 13F72B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F753C second address: 13F7546 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F06B90E9DD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F768B second address: 13F7691 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F7691 second address: 13F76AB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B90E9DE0h 0x00000007 jnp 00007F06B90E9DD6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F782C second address: 13F7834 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F7834 second address: 13F7838 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F7838 second address: 13F783C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FAF1F second address: 13FAF53 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007F06B90E9DE6h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F06B90E9DE8h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FDF98 second address: 13FDFA8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007F06B852D3B6h 0x0000000a jl 00007F06B852D3B6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1400DA1 second address: 1400DA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1400DA5 second address: 1400DA9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14005DF second address: 14005F3 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F06B90E9DD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b push ecx 0x0000000c js 00007F06B90E9DDEh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140075D second address: 1400777 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B852D3BDh 0x00000007 jnc 00007F06B852D3B6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1400777 second address: 140077F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140077F second address: 1400788 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1400788 second address: 1400797 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B90E9DDBh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1400797 second address: 14007A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14007A1 second address: 14007A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1408AEB second address: 1408AF8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 jns 00007F06B852D3B6h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140749C second address: 14074A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14078DB second address: 14078F9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B852D3BCh 0x00000007 jmp 00007F06B852D3BBh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14078F9 second address: 1407917 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F06B90E9DE8h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1407917 second address: 140794D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F06B852D3C6h 0x0000000a popad 0x0000000b pushad 0x0000000c push ebx 0x0000000d pushad 0x0000000e popad 0x0000000f pop ebx 0x00000010 jmp 00007F06B852D3BFh 0x00000015 push eax 0x00000016 push edx 0x00000017 push ebx 0x00000018 pop ebx 0x00000019 push edx 0x0000001a pop edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B4E0F second address: 13B4E30 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 jmp 00007F06B90E9DE3h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push esi 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B4E30 second address: 13B4E34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B4E34 second address: 13B4E38 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1407D1B second address: 1407D22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1407D22 second address: 1407D55 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 pushad 0x00000006 popad 0x00000007 jmp 00007F06B90E9DDCh 0x0000000c push edx 0x0000000d pop edx 0x0000000e popad 0x0000000f js 00007F06B90E9DD8h 0x00000015 push esi 0x00000016 pop esi 0x00000017 pop edx 0x00000018 pop eax 0x00000019 push edi 0x0000001a jmp 00007F06B90E9DDAh 0x0000001f push eax 0x00000020 push edx 0x00000021 jnl 00007F06B90E9DD6h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137C820 second address: 137C826 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137C826 second address: 137C84E instructions: 0x00000000 rdtsc 0x00000002 js 00007F06B90E9DD6h 0x00000008 jp 00007F06B90E9DD6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F06B90E9DE4h 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137C84E second address: 137C87B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F06B852D3C0h 0x0000000d push eax 0x0000000e push edx 0x0000000f jbe 00007F06B852D3B6h 0x00000015 jmp 00007F06B852D3BDh 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140CF40 second address: 140CF44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140CF44 second address: 140CF48 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140CF48 second address: 140CF4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140C9C6 second address: 140C9CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140C9CC second address: 140C9D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140FFC6 second address: 140FFE5 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jmp 00007F06B852D3BFh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b js 00007F06B852D3BEh 0x00000011 push edi 0x00000012 pop edi 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14100F9 second address: 1410104 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1410104 second address: 1410108 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1410108 second address: 1410117 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B90E9DDBh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1410117 second address: 1410136 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 jp 00007F06B852D3D8h 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F06B852D3BEh 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1410702 second address: 1410708 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14108A4 second address: 14108AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14108AA second address: 14108B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14108B0 second address: 14108B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1417822 second address: 1417847 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B90E9DE5h 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f jnc 00007F06B90E9DD6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1417847 second address: 141786A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B852D3C6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edi 0x0000000b pop edi 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e pop eax 0x0000000f push ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141786A second address: 1417885 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 popad 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F06B90E9DDEh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1417885 second address: 1417889 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1417889 second address: 1417892 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1417892 second address: 1417898 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1419394 second address: 141939A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141939A second address: 14193A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14193A0 second address: 14193C2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B90E9DDAh 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F06B90E9DE2h 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14193C2 second address: 14193C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141DD6D second address: 141DD72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1420B4F second address: 1420B55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1420B55 second address: 1420B95 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B90E9DDCh 0x00000007 jmp 00007F06B90E9DE8h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F06B90E9DE0h 0x00000015 jl 00007F06B90E9DD6h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1420CF1 second address: 1420CF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1420CF5 second address: 1420D69 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B90E9DDDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007F06B90E9DEAh 0x0000000f jmp 00007F06B90E9DE7h 0x00000014 pushad 0x00000015 pushad 0x00000016 popad 0x00000017 jmp 00007F06B90E9DDDh 0x0000001c popad 0x0000001d popad 0x0000001e push eax 0x0000001f push edx 0x00000020 ja 00007F06B90E9DDAh 0x00000026 pushad 0x00000027 popad 0x00000028 push edx 0x00000029 pop edx 0x0000002a jmp 00007F06B90E9DE4h 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1420ECA second address: 1420ED6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F06B852D3C2h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1420ED6 second address: 1420EFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F06B90E9DD6h 0x0000000a pop eax 0x0000000b push eax 0x0000000c jnp 00007F06B90E9DE5h 0x00000012 jmp 00007F06B90E9DDFh 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1420EFA second address: 1420F00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1421076 second address: 1421093 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F06B90E9DDBh 0x00000009 jmp 00007F06B90E9DDEh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1421093 second address: 1421099 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14215E9 second address: 14215ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14215ED second address: 14215F3 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14215F3 second address: 142160B instructions: 0x00000000 rdtsc 0x00000002 jns 00007F06B90E9DE2h 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142160B second address: 1421611 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142175E second address: 1421764 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1421764 second address: 1421769 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1429291 second address: 142929B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F06B90E9DD6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14293C4 second address: 14293F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnc 00007F06B852D3BCh 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F06B852D3C7h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14293F0 second address: 14293F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14293F4 second address: 14293F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14293F8 second address: 1429408 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F06B90E9DD6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142971D second address: 1429758 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F06B852D3C3h 0x00000009 popad 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jno 00007F06B852D3C8h 0x00000013 push eax 0x00000014 push edx 0x00000015 je 00007F06B852D3B6h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1429758 second address: 142975E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14298CC second address: 14298E6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 jmp 00007F06B852D3C1h 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1429A49 second address: 1429A4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142A134 second address: 142A14C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 jmp 00007F06B852D3C1h 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143011C second address: 1430120 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1430120 second address: 1430148 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jp 00007F06B852D3B6h 0x0000000f jmp 00007F06B852D3C6h 0x00000014 pushad 0x00000015 popad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1430148 second address: 1430181 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F06B90E9DE2h 0x00000008 pushad 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push ebx 0x00000015 jmp 00007F06B90E9DE1h 0x0000001a jnc 00007F06B90E9DD6h 0x00000020 pop ebx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14302E2 second address: 14302E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14302E9 second address: 1430311 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F06B90E9DE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jo 00007F06B90E9DD8h 0x00000012 push edi 0x00000013 pop edi 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 pop eax 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1430311 second address: 1430319 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1430319 second address: 1430333 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F06B90E9DE6h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1430333 second address: 1430337 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143DEFF second address: 143DF09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop ebx 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1443492 second address: 14434B4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push edx 0x00000006 pop edx 0x00000007 pushad 0x00000008 popad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jno 00007F06B852D3BCh 0x00000014 jo 00007F06B852D3B8h 0x0000001a push eax 0x0000001b pop eax 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14434B4 second address: 14434D2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B90E9DE2h 0x00000007 push eax 0x00000008 push edx 0x00000009 jnl 00007F06B90E9DD6h 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1449429 second address: 1449436 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jo 00007F06B852D3B6h 0x00000009 pop edi 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1449436 second address: 1449454 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F06B90E9DDAh 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jnp 00007F06B90E9DD8h 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1449454 second address: 144945A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144945A second address: 1449461 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1449461 second address: 144946D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jbe 00007F06B852D3B6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1459B69 second address: 1459B80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 jmp 00007F06B90E9DDEh 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1459DA9 second address: 1459DAD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1459F2F second address: 1459F35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 145ADF3 second address: 145AE0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F06B852D3C6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1466788 second address: 146678E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 146678E second address: 1466793 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1466793 second address: 14667AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F06B90E9DE8h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14667AF second address: 14667B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1368836 second address: 1368842 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jns 00007F06B90E9DD6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1368842 second address: 1368846 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 147FBB8 second address: 147FBC4 instructions: 0x00000000 rdtsc 0x00000002 js 00007F06B90E9DD6h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14943E5 second address: 14943FC instructions: 0x00000000 rdtsc 0x00000002 jp 00007F06B852D3B6h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f je 00007F06B852D3B6h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1494CAB second address: 1494CB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1494CB1 second address: 1494CCA instructions: 0x00000000 rdtsc 0x00000002 ja 00007F06B852D3B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F06B852D3BFh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1494CCA second address: 1494CD0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1494CD0 second address: 1494CD6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1498FE1 second address: 1498FE7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14994AB second address: 14994AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 149C7B7 second address: 149C7BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop eax 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137AE38 second address: 137AE3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0283 second address: 53B0287 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0287 second address: 53B0299 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B852D3BEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B02FA second address: 53B02FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B02FE second address: 53B0304 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B8043 second address: 13B804D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B820D second address: 13B8211 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B83F6 second address: 13B8400 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B8400 second address: 13B8404 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B03F9 second address: 53B0431 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F06B90E9DE5h 0x00000008 pop ecx 0x00000009 push ebx 0x0000000a pop esi 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e xchg eax, ebp 0x0000000f jmp 00007F06B90E9DE3h 0x00000014 mov ebp, esp 0x00000016 pushad 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B04B9 second address: 53B04BF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B04BF second address: 53B051A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edi, ax 0x00000006 mov cx, AF13h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d xor dword ptr [esp], 48BA3DABh 0x00000014 jmp 00007F06B90E9DE6h 0x00000019 call 00007F0728B2D8DFh 0x0000001e push 74DF27D0h 0x00000023 push dword ptr fs:[00000000h] 0x0000002a mov eax, dword ptr [esp+10h] 0x0000002e mov dword ptr [esp+10h], ebp 0x00000032 lea ebp, dword ptr [esp+10h] 0x00000036 sub esp, eax 0x00000038 push ebx 0x00000039 push esi 0x0000003a push edi 0x0000003b mov eax, dword ptr [74E80140h] 0x00000040 xor dword ptr [ebp-04h], eax 0x00000043 xor eax, ebp 0x00000045 push eax 0x00000046 mov dword ptr [ebp-18h], esp 0x00000049 push dword ptr [ebp-08h] 0x0000004c mov eax, dword ptr [ebp-04h] 0x0000004f mov dword ptr [ebp-04h], FFFFFFFEh 0x00000056 mov dword ptr [ebp-08h], eax 0x00000059 lea eax, dword ptr [ebp-10h] 0x0000005c mov dword ptr fs:[00000000h], eax 0x00000062 ret 0x00000063 jmp 00007F06B90E9DE0h 0x00000068 and dword ptr [ebp-04h], 00000000h 0x0000006c jmp 00007F06B90E9DE0h 0x00000071 mov edx, dword ptr [ebp+0Ch] 0x00000074 push eax 0x00000075 push edx 0x00000076 pushad 0x00000077 push eax 0x00000078 push edx 0x00000079 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B051A second address: 53B0521 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov esi, edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0521 second address: 53B0530 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F06B90E9DDBh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0530 second address: 53B0579 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov esi, edx 0x0000000a jmp 00007F06B852D3C5h 0x0000000f mov al, byte ptr [edx] 0x00000011 jmp 00007F06B852D3BEh 0x00000016 inc edx 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F06B852D3C7h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0579 second address: 53B057E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B057E second address: 53B0584 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0584 second address: 53B0579 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 test al, al 0x00000009 jmp 00007F06B90E9DE1h 0x0000000e jne 00007F06B90E9D81h 0x00000014 mov al, byte ptr [edx] 0x00000016 jmp 00007F06B90E9DDEh 0x0000001b inc edx 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007F06B90E9DE7h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B065B second address: 53B0661 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0661 second address: 53B0665 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0665 second address: 53B0669 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0669 second address: 53B06EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov al, byte ptr [edi+01h] 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007F06B90E9DE4h 0x00000012 or eax, 1FFF8888h 0x00000018 jmp 00007F06B90E9DDBh 0x0000001d popfd 0x0000001e push eax 0x0000001f pushfd 0x00000020 jmp 00007F06B90E9DDFh 0x00000025 sub ch, FFFFFFCEh 0x00000028 jmp 00007F06B90E9DE9h 0x0000002d popfd 0x0000002e pop esi 0x0000002f popad 0x00000030 inc edi 0x00000031 pushad 0x00000032 push edx 0x00000033 mov ch, C1h 0x00000035 pop edx 0x00000036 mov esi, 416BF7E1h 0x0000003b popad 0x0000003c test al, al 0x0000003e push eax 0x0000003f push edx 0x00000040 jmp 00007F06B90E9DE3h 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B06EF second address: 53B06F5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B06F5 second address: 53B078B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jne 00007F0728B22158h 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007F06B90E9DDDh 0x00000015 add cx, 9116h 0x0000001a jmp 00007F06B90E9DE1h 0x0000001f popfd 0x00000020 popad 0x00000021 mov ecx, edx 0x00000023 jmp 00007F06B90E9DDAh 0x00000028 shr ecx, 02h 0x0000002b jmp 00007F06B90E9DE0h 0x00000030 rep movsd 0x00000032 rep movsd 0x00000034 rep movsd 0x00000036 rep movsd 0x00000038 rep movsd 0x0000003a jmp 00007F06B90E9DE0h 0x0000003f mov ecx, edx 0x00000041 pushad 0x00000042 jmp 00007F06B90E9DDEh 0x00000047 movzx ecx, bx 0x0000004a popad 0x0000004b and ecx, 03h 0x0000004e push eax 0x0000004f push edx 0x00000050 pushad 0x00000051 push eax 0x00000052 pop ebx 0x00000053 jmp 00007F06B90E9DE2h 0x00000058 popad 0x00000059 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B078B second address: 53B0790 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0790 second address: 53B07D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov cx, di 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rep movsb 0x0000000c pushad 0x0000000d mov eax, edi 0x0000000f pushfd 0x00000010 jmp 00007F06B90E9DDBh 0x00000015 sub eax, 6F31026Eh 0x0000001b jmp 00007F06B90E9DE9h 0x00000020 popfd 0x00000021 popad 0x00000022 mov dword ptr [ebp-04h], FFFFFFFEh 0x00000029 push eax 0x0000002a push edx 0x0000002b push eax 0x0000002c push edx 0x0000002d pushad 0x0000002e popad 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B07D9 second address: 53B07DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B07DD second address: 53B07E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B07E3 second address: 53B0800 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B852D3C2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, ebx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e push ecx 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0800 second address: 53B0804 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0804 second address: 53B084D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushfd 0x00000007 jmp 00007F06B852D3C6h 0x0000000c add ax, 5B78h 0x00000011 jmp 00007F06B852D3BBh 0x00000016 popfd 0x00000017 popad 0x00000018 mov ecx, dword ptr [ebp-10h] 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007F06B852D3C5h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B084D second address: 53B08C1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B90E9DE1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr fs:[00000000h], ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 pushfd 0x00000014 jmp 00007F06B90E9DE3h 0x00000019 sbb esi, 743D654Eh 0x0000001f jmp 00007F06B90E9DE9h 0x00000024 popfd 0x00000025 pushfd 0x00000026 jmp 00007F06B90E9DE0h 0x0000002b add cl, FFFFFFC8h 0x0000002e jmp 00007F06B90E9DDBh 0x00000033 popfd 0x00000034 popad 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B08C1 second address: 53B094F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F06B852D3BFh 0x00000009 xor si, 100Eh 0x0000000e jmp 00007F06B852D3C9h 0x00000013 popfd 0x00000014 jmp 00007F06B852D3C0h 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c pop ecx 0x0000001d pushad 0x0000001e pushad 0x0000001f mov cx, 63A3h 0x00000023 pushfd 0x00000024 jmp 00007F06B852D3C8h 0x00000029 and cx, 90E8h 0x0000002e jmp 00007F06B852D3BBh 0x00000033 popfd 0x00000034 popad 0x00000035 movzx ecx, bx 0x00000038 popad 0x00000039 pop edi 0x0000003a jmp 00007F06B852D3BBh 0x0000003f pop esi 0x00000040 push eax 0x00000041 push edx 0x00000042 push eax 0x00000043 push edx 0x00000044 pushad 0x00000045 popad 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B094F second address: 53B096A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B90E9DE7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B096A second address: 53B099A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cx, bx 0x00000006 pushfd 0x00000007 jmp 00007F06B852D3BBh 0x0000000c jmp 00007F06B852D3C3h 0x00000011 popfd 0x00000012 popad 0x00000013 pop edx 0x00000014 pop eax 0x00000015 pop ebx 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B099A second address: 53B099E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B099E second address: 53B09B9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B852D3C7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B09B9 second address: 53B04B9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B90E9DE9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 leave 0x0000000a pushad 0x0000000b mov ax, AEF3h 0x0000000f mov esi, 4312474Fh 0x00000014 popad 0x00000015 retn 0008h 0x00000018 cmp dword ptr [ebp-2Ch], 10h 0x0000001c mov eax, dword ptr [ebp-40h] 0x0000001f jnc 00007F06B90E9DD5h 0x00000021 push eax 0x00000022 lea edx, dword ptr [ebp-00000590h] 0x00000028 push edx 0x00000029 call esi 0x0000002b push 00000008h 0x0000002d jmp 00007F06B90E9DE6h 0x00000032 push 3C5C2183h 0x00000037 push eax 0x00000038 push edx 0x00000039 push eax 0x0000003a push edx 0x0000003b pushad 0x0000003c popad 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0ACE second address: 53B0B0C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B852D3C9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F06B852D3BEh 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F06B852D3BDh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0B0C second address: 53B0B12 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0B12 second address: 53B0B32 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B852D3BCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b mov di, ax 0x0000000e mov edx, esi 0x00000010 popad 0x00000011 mov ebp, esp 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0B32 second address: 53B0B36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0B36 second address: 53B0B3A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0B3A second address: 53B0B40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 4EF8C1 second address: 4EF8C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 4EF8C6 second address: 4EF8CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 658A44 second address: 658A6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 push eax 0x00000007 pop eax 0x00000008 jmp 00007F06B852D3C9h 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 pop eax 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 6696DF second address: 669701 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F06B90E9DD6h 0x0000000a pop ebx 0x0000000b pop esi 0x0000000c push esi 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F06B90E9DE1h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 669701 second address: 669705 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 66997B second address: 669981 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 669981 second address: 669985 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 669985 second address: 6699A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F06B90E9DDDh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop eax 0x0000000c push eax 0x0000000d jne 00007F06B90E9DE9h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 669AE3 second address: 669AE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 669AE9 second address: 669AEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 669D54 second address: 669D5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 669D5F second address: 669D65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 669D65 second address: 669D69 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 669E95 second address: 669ED8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F06B90E9DE9h 0x00000009 popad 0x0000000a pushad 0x0000000b push esi 0x0000000c pushad 0x0000000d popad 0x0000000e pop esi 0x0000000f jng 00007F06B90E9DDAh 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F06B90E9DE4h 0x0000001c rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 669ED8 second address: 669EF5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B852D3C9h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 66CF8D second address: 66CF92 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 66CF92 second address: 66CFAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [eax] 0x00000009 jmp 00007F06B852D3BBh 0x0000000e mov dword ptr [esp+04h], eax 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 push esi 0x00000016 pop esi 0x00000017 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 66CFAF second address: 66CFBC instructions: 0x00000000 rdtsc 0x00000002 je 00007F06B90E9DD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 66CFF7 second address: 66CFFB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 66D174 second address: 66D198 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B90E9DE3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F06B90E9DDBh 0x00000010 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 66D198 second address: 66D209 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 add dword ptr [esp], 6603B300h 0x0000000e mov edx, dword ptr [ebp+122D1CE1h] 0x00000014 jmp 00007F06B852D3BFh 0x00000019 push 00000003h 0x0000001b mov ecx, dword ptr [ebp+122D3DDCh] 0x00000021 push 00000000h 0x00000023 and edx, 72EB46EEh 0x00000029 push 00000003h 0x0000002b jmp 00007F06B852D3C7h 0x00000030 push 6887205Fh 0x00000035 js 00007F06B852D3DEh 0x0000003b push eax 0x0000003c push edx 0x0000003d jmp 00007F06B852D3C8h 0x00000042 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 66D209 second address: 66D27C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B90E9DDAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 add dword ptr [esp], 5778DFA1h 0x00000010 push ebx 0x00000011 mov ecx, dword ptr [ebp+122D3E44h] 0x00000017 pop edi 0x00000018 push eax 0x00000019 mov edx, dword ptr [ebp+122D3DACh] 0x0000001f pop ecx 0x00000020 lea ebx, dword ptr [ebp+12451E5Fh] 0x00000026 jmp 00007F06B90E9DE2h 0x0000002b mov esi, dword ptr [ebp+122D39CCh] 0x00000031 xchg eax, ebx 0x00000032 jmp 00007F06B90E9DE9h 0x00000037 push eax 0x00000038 push eax 0x00000039 push edx 0x0000003a pushad 0x0000003b js 00007F06B90E9DD6h 0x00000041 jmp 00007F06B90E9DDBh 0x00000046 popad 0x00000047 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 66D27C second address: 66D286 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F06B852D3BCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 66D35F second address: 66D3BC instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push ebx 0x0000000b call 00007F06B90E9DD8h 0x00000010 pop ebx 0x00000011 mov dword ptr [esp+04h], ebx 0x00000015 add dword ptr [esp+04h], 00000015h 0x0000001d inc ebx 0x0000001e push ebx 0x0000001f ret 0x00000020 pop ebx 0x00000021 ret 0x00000022 sub dword ptr [ebp+122D1CDCh], ecx 0x00000028 push 00000000h 0x0000002a push 00000000h 0x0000002c push ebx 0x0000002d call 00007F06B90E9DD8h 0x00000032 pop ebx 0x00000033 mov dword ptr [esp+04h], ebx 0x00000037 add dword ptr [esp+04h], 00000017h 0x0000003f inc ebx 0x00000040 push ebx 0x00000041 ret 0x00000042 pop ebx 0x00000043 ret 0x00000044 xor dword ptr [ebp+122D263Dh], eax 0x0000004a push 5D5FCE2Fh 0x0000004f push eax 0x00000050 push edx 0x00000051 push eax 0x00000052 push edx 0x00000053 push eax 0x00000054 push edx 0x00000055 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 66D3BC second address: 66D3C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 66D3C0 second address: 66D3C6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 68D3D3 second address: 68D419 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B852D3C4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F06B852D3C7h 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 jc 00007F06B852D3B8h 0x00000017 js 00007F06B852D3BCh 0x0000001d je 00007F06B852D3B6h 0x00000023 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 68B304 second address: 68B32C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F06B90E9DDFh 0x00000009 popad 0x0000000a push ecx 0x0000000b jmp 00007F06B90E9DDCh 0x00000010 jbe 00007F06B90E9DD6h 0x00000016 pop ecx 0x00000017 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 68B479 second address: 68B47E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 68B47E second address: 68B48C instructions: 0x00000000 rdtsc 0x00000002 jne 00007F06B90E9DD8h 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 68BD51 second address: 68BD6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F06B852D3B6h 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F06B852D3C1h 0x00000012 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 68BD6F second address: 68BD75 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 68BD75 second address: 68BD7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 68BD7B second address: 68BD80 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 68BD80 second address: 68BD86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 68BD86 second address: 68BD99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F06B90E9DDAh 0x0000000e rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 68C193 second address: 68C19D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 655457 second address: 655467 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F06B90E9DDAh 0x00000008 push edx 0x00000009 pop edx 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push edi 0x0000000f pop edi 0x00000010 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 68CA41 second address: 68CA47 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 68CA47 second address: 68CA60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F06B90E9DE5h 0x00000009 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 68CA60 second address: 68CA64 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 68CA64 second address: 68CA78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 68CA78 second address: 68CA7C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 68CA7C second address: 68CA84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 68CA84 second address: 68CAA8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B852D3C4h 0x00000007 pushad 0x00000008 jmp 00007F06B852D3BBh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 68CAA8 second address: 68CAAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 68CC1B second address: 68CC2E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F06B852D3BEh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 68CF68 second address: 68CF6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 68CF6C second address: 68CF73 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 68D24C second address: 68D250 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 68D250 second address: 68D258 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 68D258 second address: 68D281 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 jmp 00007F06B90E9DDEh 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F06B90E9DE1h 0x00000014 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 68E87F second address: 68E885 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 68E885 second address: 68E889 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 68E889 second address: 68E88D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 68E88D second address: 68E8A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jg 00007F06B90E9DD8h 0x00000011 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 69175E second address: 691762 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 691762 second address: 691766 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 69811A second address: 698124 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F06B852D3B6h 0x0000000a rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 698124 second address: 69812A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 69812A second address: 698130 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 698130 second address: 698137 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 697842 second address: 697857 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F06B852D3C0h 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 6979CA second address: 6979D4 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F06B90E9DD6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 697CAA second address: 697CCB instructions: 0x00000000 rdtsc 0x00000002 jng 00007F06B852D3D3h 0x00000008 jmp 00007F06B852D3C7h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 697F99 second address: 697FB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F06B90E9DE6h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 69ABC6 second address: 69ABD1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnl 00007F06B852D3B6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 69ABD1 second address: 69ABE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 jbe 00007F06B90E9DDCh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 69B0B2 second address: 69B0B9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 69B19C second address: 69B1A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F06B90E9DD6h 0x0000000a rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 69B671 second address: 69B676 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 69C07C second address: 69C080 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 69C080 second address: 69C0A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a mov esi, dword ptr [ebp+122D3F5Ch] 0x00000010 push 00000000h 0x00000012 xor si, E10Bh 0x00000017 push 00000000h 0x00000019 adc di, 30A6h 0x0000001e xchg eax, ebx 0x0000001f push eax 0x00000020 pushad 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 69D9EA second address: 69DA6A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B90E9DE6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push ebx 0x00000010 call 00007F06B90E9DD8h 0x00000015 pop ebx 0x00000016 mov dword ptr [esp+04h], ebx 0x0000001a add dword ptr [esp+04h], 00000016h 0x00000022 inc ebx 0x00000023 push ebx 0x00000024 ret 0x00000025 pop ebx 0x00000026 ret 0x00000027 sub dword ptr [ebp+122D1D02h], edx 0x0000002d push 00000000h 0x0000002f cmc 0x00000030 push 00000000h 0x00000032 push 00000000h 0x00000034 push eax 0x00000035 call 00007F06B90E9DD8h 0x0000003a pop eax 0x0000003b mov dword ptr [esp+04h], eax 0x0000003f add dword ptr [esp+04h], 00000014h 0x00000047 inc eax 0x00000048 push eax 0x00000049 ret 0x0000004a pop eax 0x0000004b ret 0x0000004c mov esi, dword ptr [ebp+122DBC8Bh] 0x00000052 xchg eax, ebx 0x00000053 push eax 0x00000054 push edx 0x00000055 push edx 0x00000056 jmp 00007F06B90E9DE2h 0x0000005b pop edx 0x0000005c rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 69E503 second address: 69E51B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F06B852D3C3h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 69EE52 second address: 69EEDB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F06B90E9DE1h 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov dword ptr [esp], eax 0x00000010 sbb esi, 15047600h 0x00000016 push 00000000h 0x00000018 push 00000000h 0x0000001a push esi 0x0000001b call 00007F06B90E9DD8h 0x00000020 pop esi 0x00000021 mov dword ptr [esp+04h], esi 0x00000025 add dword ptr [esp+04h], 00000018h 0x0000002d inc esi 0x0000002e push esi 0x0000002f ret 0x00000030 pop esi 0x00000031 ret 0x00000032 pushad 0x00000033 mov eax, ebx 0x00000035 pushad 0x00000036 mov dh, bh 0x00000038 or cl, FFFFFFFAh 0x0000003b popad 0x0000003c popad 0x0000003d push 00000000h 0x0000003f push 00000000h 0x00000041 push ebx 0x00000042 call 00007F06B90E9DD8h 0x00000047 pop ebx 0x00000048 mov dword ptr [esp+04h], ebx 0x0000004c add dword ptr [esp+04h], 0000001Ah 0x00000054 inc ebx 0x00000055 push ebx 0x00000056 ret 0x00000057 pop ebx 0x00000058 ret 0x00000059 mov dword ptr [ebp+122D22A9h], ecx 0x0000005f xchg eax, ebx 0x00000060 js 00007F06B90E9DE4h 0x00000066 pushad 0x00000067 je 00007F06B90E9DD6h 0x0000006d push eax 0x0000006e push edx 0x0000006f rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 6A029D second address: 6A02A7 instructions: 0x00000000 rdtsc 0x00000002 js 00007F06B852D3B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 6A0CEB second address: 6A0D16 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F06B90E9DE4h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e js 00007F06B90E9DE8h 0x00000014 push eax 0x00000015 push edx 0x00000016 je 00007F06B90E9DD6h 0x0000001c rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 6A0D16 second address: 6A0D76 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F06B852D3B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b jp 00007F06B852D3BEh 0x00000011 pushad 0x00000012 or dword ptr [ebp+122D1F4Eh], edi 0x00000018 sbb ch, 00000007h 0x0000001b popad 0x0000001c push 00000000h 0x0000001e push 00000000h 0x00000020 push ecx 0x00000021 call 00007F06B852D3B8h 0x00000026 pop ecx 0x00000027 mov dword ptr [esp+04h], ecx 0x0000002b add dword ptr [esp+04h], 00000014h 0x00000033 inc ecx 0x00000034 push ecx 0x00000035 ret 0x00000036 pop ecx 0x00000037 ret 0x00000038 push esi 0x00000039 sbb si, 1841h 0x0000003e pop edi 0x0000003f push 00000000h 0x00000041 mov dword ptr [ebp+1247974Eh], edi 0x00000047 xchg eax, ebx 0x00000048 pushad 0x00000049 pushad 0x0000004a push esi 0x0000004b pop esi 0x0000004c jnc 00007F06B852D3B6h 0x00000052 popad 0x00000053 pushad 0x00000054 push eax 0x00000055 push edx 0x00000056 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 6A4295 second address: 6A4299 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 6A4299 second address: 6A42AD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F06B852D3BBh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 6A42AD second address: 6A42B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 65042F second address: 65043F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B852D3BAh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 65043F second address: 65044F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F06B90E9DD6h 0x0000000a ja 00007F06B90E9DD6h 0x00000010 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 65044F second address: 650453 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 650453 second address: 650472 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jnc 00007F06B90E9DD6h 0x00000010 jmp 00007F06B90E9DDFh 0x00000015 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 650472 second address: 650476 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 6A765D second address: 6A769C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 mov dword ptr [esp], eax 0x0000000a mov bx, F5EDh 0x0000000e push 00000000h 0x00000010 push 00000000h 0x00000012 push edi 0x00000013 call 00007F06B90E9DD8h 0x00000018 pop edi 0x00000019 mov dword ptr [esp+04h], edi 0x0000001d add dword ptr [esp+04h], 0000001Dh 0x00000025 inc edi 0x00000026 push edi 0x00000027 ret 0x00000028 pop edi 0x00000029 ret 0x0000002a push 00000000h 0x0000002c mov bl, 71h 0x0000002e xchg eax, esi 0x0000002f pushad 0x00000030 push eax 0x00000031 push edx 0x00000032 pushad 0x00000033 popad 0x00000034 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 6A8772 second address: 6A8776 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 6A8776 second address: 6A877A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 6A877A second address: 6A87D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push edi 0x0000000b call 00007F06B852D3B8h 0x00000010 pop edi 0x00000011 mov dword ptr [esp+04h], edi 0x00000015 add dword ptr [esp+04h], 00000016h 0x0000001d inc edi 0x0000001e push edi 0x0000001f ret 0x00000020 pop edi 0x00000021 ret 0x00000022 jns 00007F06B852D3B8h 0x00000028 mov ebx, dword ptr [ebp+122D3C58h] 0x0000002e push 00000000h 0x00000030 clc 0x00000031 push 00000000h 0x00000033 mov bh, 5Ch 0x00000035 mov di, ax 0x00000038 xchg eax, esi 0x00000039 jmp 00007F06B852D3BFh 0x0000003e push eax 0x0000003f jo 00007F06B852D3BEh 0x00000045 push ebx 0x00000046 push eax 0x00000047 push edx 0x00000048 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 6A971B second address: 6A971F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 6A971F second address: 6A9729 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F06B852D3B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 6AA75C second address: 6AA7D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 mov dword ptr [esp], eax 0x00000008 push 00000000h 0x0000000a push edx 0x0000000b call 00007F06B90E9DD8h 0x00000010 pop edx 0x00000011 mov dword ptr [esp+04h], edx 0x00000015 add dword ptr [esp+04h], 0000001Ch 0x0000001d inc edx 0x0000001e push edx 0x0000001f ret 0x00000020 pop edx 0x00000021 ret 0x00000022 push 00000000h 0x00000024 push edx 0x00000025 sub ebx, dword ptr [ebp+122D2414h] 0x0000002b pop edi 0x0000002c push 00000000h 0x0000002e push 00000000h 0x00000030 push eax 0x00000031 call 00007F06B90E9DD8h 0x00000036 pop eax 0x00000037 mov dword ptr [esp+04h], eax 0x0000003b add dword ptr [esp+04h], 0000001Ch 0x00000043 inc eax 0x00000044 push eax 0x00000045 ret 0x00000046 pop eax 0x00000047 ret 0x00000048 xchg eax, esi 0x00000049 js 00007F06B90E9DE0h 0x0000004f jmp 00007F06B90E9DDAh 0x00000054 push eax 0x00000055 jc 00007F06B90E9DE2h 0x0000005b jp 00007F06B90E9DDCh 0x00000061 push eax 0x00000062 push edx 0x00000063 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 6AC763 second address: 6AC7EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F06B852D3C0h 0x00000009 popad 0x0000000a pop esi 0x0000000b push eax 0x0000000c js 00007F06B852D3C4h 0x00000012 pushad 0x00000013 jp 00007F06B852D3B6h 0x00000019 jo 00007F06B852D3B6h 0x0000001f popad 0x00000020 nop 0x00000021 push 00000000h 0x00000023 push ecx 0x00000024 call 00007F06B852D3B8h 0x00000029 pop ecx 0x0000002a mov dword ptr [esp+04h], ecx 0x0000002e add dword ptr [esp+04h], 00000017h 0x00000036 inc ecx 0x00000037 push ecx 0x00000038 ret 0x00000039 pop ecx 0x0000003a ret 0x0000003b adc edi, 0EC0C071h 0x00000041 push 00000000h 0x00000043 push 00000000h 0x00000045 push esi 0x00000046 call 00007F06B852D3B8h 0x0000004b pop esi 0x0000004c mov dword ptr [esp+04h], esi 0x00000050 add dword ptr [esp+04h], 00000019h 0x00000058 inc esi 0x00000059 push esi 0x0000005a ret 0x0000005b pop esi 0x0000005c ret 0x0000005d mov ebx, dword ptr [ebp+122D3CE0h] 0x00000063 push 00000000h 0x00000065 mov dword ptr [ebp+122D1F99h], esi 0x0000006b xchg eax, esi 0x0000006c js 00007F06B852D3BEh 0x00000072 push edi 0x00000073 push eax 0x00000074 push edx 0x00000075 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 6AC7EF second address: 6AC7FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 6AC7FB second address: 6AC7FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 6AC7FF second address: 6AC80D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06B90E9DDAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 6AD850 second address: 6AD854 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 6AD854 second address: 6AD85A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 6B37FF second address: 6B3867 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F06B852D3C0h 0x0000000b pushad 0x0000000c jmp 00007F06B852D3BEh 0x00000011 jmp 00007F06B852D3C8h 0x00000016 js 00007F06B852D3B6h 0x0000001c pushad 0x0000001d popad 0x0000001e popad 0x0000001f popad 0x00000020 pushad 0x00000021 jmp 00007F06B852D3C8h 0x00000026 push eax 0x00000027 push edx 0x00000028 jl 00007F06B852D3B6h 0x0000002e rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 653984 second address: 65398A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 6B3E2A second address: 6B3E30 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 6B3E30 second address: 6B3E75 instructions: 0x00000000 rdtsc 0x00000002 je 00007F06B90E9DD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f push 00000000h 0x00000011 push edx 0x00000012 call 00007F06B90E9DD8h 0x00000017 pop edx 0x00000018 mov dword ptr [esp+04h], edx 0x0000001c add dword ptr [esp+04h], 00000015h 0x00000024 inc edx 0x00000025 push edx 0x00000026 ret 0x00000027 pop edx 0x00000028 ret 0x00000029 movzx edi, dx 0x0000002c push 00000000h 0x0000002e sub ebx, dword ptr [ebp+122D3C40h] 0x00000034 push 00000000h 0x00000036 mov dword ptr [ebp+122D1E3Dh], esi 0x0000003c push eax 0x0000003d push eax 0x0000003e push edx 0x0000003f pushad 0x00000040 push eax 0x00000041 push edx 0x00000042 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 6B3E75 second address: 6B3E7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 6B3E7C second address: 6B3E91 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F06B90E9DE1h 0x00000009 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 6B4DA3 second address: 6B4DDE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jng 00007F06B852D3B6h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f pushad 0x00000010 jmp 00007F06B852D3C8h 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F06B852D3C1h 0x0000001c rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 6B5E27 second address: 6B5E2D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 6CA1B5 second address: 6CA1CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 jnc 00007F06B852D3B6h 0x0000000c jmp 00007F06B852D3BDh 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 6CA1CF second address: 6CA1D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 6CA1D5 second address: 6CA1DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 6CA1DB second address: 6CA1DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 6CA1DF second address: 6CA1E9 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F06B852D3B6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 6C9506 second address: 6C950C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	RDTSC instruction interceptor: First address: 6C950C second address: 6C9512 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 11FFC3D instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 11FFB5B instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 14327A4 instructions caused by: Self-modifying code
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Special instruction interceptor: First address: 68F6B5 instructions caused by: Self-modifying code
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Special instruction interceptor: First address: 71C8EF instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 114F6B5 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 11DC8EF instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Special instruction interceptor: First address: 8257BC instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Special instruction interceptor: First address: 8256F8 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Special instruction interceptor: First address: 9CD725 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Special instruction interceptor: First address: 9F6B00 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Special instruction interceptor: First address: 9D73EE instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Special instruction interceptor: First address: A58594 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Special instruction interceptor: First address: 663277 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Special instruction interceptor: First address: 4B608E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Special instruction interceptor: First address: 67442E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Special instruction interceptor: First address: 6F184C instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Special instruction interceptor: First address: FFFC3D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Special instruction interceptor: First address: FFFB5B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Special instruction interceptor: First address: 12327A4 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Special instruction interceptor: First address: EFDE86 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Special instruction interceptor: First address: EFDDE9 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Special instruction interceptor: First address: 10B1E84 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Special instruction interceptor: First address: EFDD93 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Special instruction interceptor: First address: 1150B23 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Special instruction interceptor: First address: F01E23 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Special instruction interceptor: First address: 618DE86 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Special instruction interceptor: First address: 618DDE9 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Special instruction interceptor: First address: 6341E84 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Special instruction interceptor: First address: 618DD93 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Special instruction interceptor: First address: 63E0B23 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Special instruction interceptor: First address: 648DE86 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Special instruction interceptor: First address: 648DDE9 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Special instruction interceptor: First address: 6191E23 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Special instruction interceptor: First address: 6641E84 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Special instruction interceptor: First address: 648DD93 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Special instruction interceptor: First address: 66E0B23 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Special instruction interceptor: First address: 6491E23 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Special instruction interceptor: First address: 5A1DE86 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Special instruction interceptor: First address: 5A1DDE9 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Special instruction interceptor: First address: 5BD1E84 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Special instruction interceptor: First address: 5A1DD93 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Special instruction interceptor: First address: 5C70B23 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Special instruction interceptor: First address: 641DE86 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Special instruction interceptor: First address: 641DDE9 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Special instruction interceptor: First address: 5A21E23 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Special instruction interceptor: First address: 65D1E84 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Special instruction interceptor: First address: 641DD93 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Special instruction interceptor: First address: 6670B23 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Memory allocated: 5370000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Memory allocated: 55B0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Memory allocated: 53B0000 memory reserve \| memory write watch

Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\Documents\BAKFCBFHJD.exe

Code function: 9_2_05220D46 rdtsc

9_2_05220D46

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 4332	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Window / User API: threadDelayed 1590
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Window / User API: threadDelayed 1072
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Window / User API: threadDelayed 910
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Window / User API: threadDelayed 689
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Window / User API: threadDelayed 1628
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Window / User API: threadDelayed 1516
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Window / User API: threadDelayed 1068
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Window / User API: threadDelayed 652

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

API coverage: 0.3 %

Source: C:\Users\user\Desktop\file.exe TID: 4348	Thread sleep time: -36018s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5740	Thread sleep time: -38019s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 4144	Thread sleep time: -32000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 3752	Thread sleep time: -42021s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 3332	Thread sleep time: -38019s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5228	Thread sleep time: -36018s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7396	Thread sleep count: 87 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7396	Thread sleep time: -174087s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7404	Thread sleep count: 70 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7404	Thread sleep time: -140070s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7364	Thread sleep count: 231 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7364	Thread sleep time: -6930000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7336	Thread sleep count: 4332 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7336	Thread sleep time: -8668332s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7384	Thread sleep count: 85 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7384	Thread sleep time: -170085s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7400	Thread sleep time: -180000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7336	Thread sleep time: -32016s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe TID: 8028	Thread sleep count: 1590 > 30
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe TID: 8028	Thread sleep time: -3181590s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe TID: 8008	Thread sleep count: 1072 > 30
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe TID: 8008	Thread sleep time: -2145072s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe TID: 7976	Thread sleep count: 77 > 30
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe TID: 7976	Thread sleep count: 78 > 30
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe TID: 7976	Thread sleep count: 79 > 30
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe TID: 2424	Thread sleep count: 910 > 30
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe TID: 2424	Thread sleep time: -1820910s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe TID: 796	Thread sleep count: 689 > 30
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe TID: 796	Thread sleep time: -1378689s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe TID: 2232	Thread sleep count: 1628 > 30
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe TID: 2232	Thread sleep time: -3257628s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe TID: 8056	Thread sleep count: 1516 > 30
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe TID: 8056	Thread sleep time: -3033516s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe TID: 1228	Thread sleep count: 1068 > 30
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe TID: 1228	Thread sleep time: -2137068s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe TID: 6748	Thread sleep time: -58029s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe TID: 6760	Thread sleep time: -44022s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe TID: 7096	Thread sleep time: -32000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe TID: 6764	Thread sleep time: -54027s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe TID: 7120	Thread sleep time: -210000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe TID: 6828	Thread sleep time: -44022s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe TID: 6832	Thread sleep time: -54027s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe TID: 6808	Thread sleep time: -54027s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe TID: 6804	Thread sleep time: -62031s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe TID: 1168	Thread sleep time: -56028s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe TID: 396	Thread sleep time: -46023s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe TID: 6840	Thread sleep time: -36000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe TID: 5376	Thread sleep time: -42021s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe TID: 6928	Thread sleep time: -210000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe TID: 6192	Thread sleep time: -56028s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe TID: 3492	Thread sleep time: -48024s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe TID: 412	Thread sleep time: -44022s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe TID: 3668	Thread sleep time: -40020s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe TID: 5368	Thread sleep count: 103 > 30
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe TID: 5368	Thread sleep count: 144 > 30
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe TID: 1420	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe TID: 4284	Thread sleep count: 652 > 30
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe TID: 4284	Thread sleep count: 280 > 30
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe TID: 4284	Thread sleep count: 141 > 30
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe TID: 2740	Thread sleep time: -48024s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe TID: 2716	Thread sleep time: -36018s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe TID: 2288	Thread sleep time: -48024s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe TID: 2832	Thread sleep time: -34017s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe TID: 7996	Thread sleep time: -270000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe TID: 6040	Thread sleep time: -34017s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe TID: 2784	Thread sleep time: -36018s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe TID: 4944	Thread sleep time: -34017s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe TID: 2496	Thread sleep time: -180000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe TID: 3752	Thread sleep time: -32016s >= -30000s

Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Documents\BAKFCBFHJD.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C46C930 GetSystemInfo,VirtualAlloc,GetSystemInfo,VirtualFree,VirtualAlloc,

0_2_6C46C930

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.2107629430.000000000138B000.00000040.00000001.01000000.00000003.sdmp, BAKFCBFHJD.exe, 00000009.00000002.2157881884.0000000000673000.00000040.00000001.01000000.0000000B.sdmp, BAKFCBFHJD.exe, 00000009.00000000.2088224331.0000000000673000.00000080.00000001.01000000.0000000B.sdmp, skotes.exe, 0000000A.00000002.2198440738.0000000001133000.00000040.00000001.01000000.0000000D.sdmp, skotes.exe, 0000000A.00000000.2127869098.0000000001133000.00000080.00000001.01000000.0000000D.sdmp, skotes.exe, 0000000B.00000000.2132260235.0000000001133000.00000080.00000001.01000000.0000000D.sdmp, skotes.exe, 0000000B.00000002.2199681608.0000000001133000.00000040.00000001.01000000.0000000D.sdmp, skotes.exe, 0000000C.00000000.2299229146.0000000001133000.00000080.00000001.01000000.0000000D.sdmp, f377015f96.exe, 00000010.00000002.2679711119.000000000118B000.00000040.00000001.01000000.00000010.sdmp, f377015f96.exe, 00000019.00000002.2850082344.000000000118B000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: f039f524ee.exe, 0000000F.00000003.2646499229.0000000001011000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2646636082.0000000001017000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2622538163.0000000001019000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2646669500.0000000001019000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2616118705.0000000001012000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ItQegq4KuCKrUeyRbO71YP7nEBBLPLkYmFsftqEMuZoh
Source: a17088d8c7.exe, 0000000D.00000003.3078884337.00000000055D4000.00000004.00000020.00020000.00000000.sdmp, a17088d8c7.exe, 0000000D.00000003.3117232730.00000000055D4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWZ:u
Source: f039f524ee.exe, 0000000F.00000003.2848661309.0000000000FB0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWQ
Source: file.exe, 00000000.00000002.2107233640.0000000000E45000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWhw
Source: file.exe, 00000000.00000002.2107233640.0000000000E71000.00000004.00000020.00020000.00000000.sdmp, a17088d8c7.exe, 0000000D.00000003.3078884337.00000000055D4000.00000004.00000020.00020000.00000000.sdmp, a17088d8c7.exe, 0000000D.00000003.3117232730.00000000055D4000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2848661309.0000000000FB0000.00000004.00000020.00020000.00000000.sdmp, f377015f96.exe, 00000010.00000002.2681962698.00000000015CF000.00000004.00000020.00020000.00000000.sdmp, 18d00389b3.exe, 00000012.00000003.2824173672.0000000001801000.00000004.00000020.00020000.00000000.sdmp, 18d00389b3.exe, 00000012.00000003.2818519812.00000000017FD000.00000004.00000020.00020000.00000000.sdmp, 18d00389b3.exe, 00000012.00000002.2849633497.0000000001802000.00000004.00000020.00020000.00000000.sdmp, f377015f96.exe, 00000019.00000002.2861247425.0000000001AD5000.00000004.00000020.00020000.00000000.sdmp, f377015f96.exe, 00000019.00000002.2861247425.0000000001AAA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.2107233640.0000000000E71000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW9
Source: f377015f96.exe, 00000019.00000002.2861247425.0000000001A6B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: f377015f96.exe, 00000010.00000002.2681962698.00000000015A4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW(F]
Source: firefox.exe, 00000020.00000002.2906223989.0000017CD50B5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW : 2 : 34 : 1 : 1 : 0x20026 : 0x8 : %SystemRoot%\system32\mswsock.dll : : 1234191b-4bf7-4ca7-86e0-dfd7c32b5445
Source: f039f524ee.exe, 0000000F.00000003.2589748747.0000000001021000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2589686211.000000000100F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: hi/UVNPhErBJsEzz8BycqmCn70pmM0K3FspTC9nXO+nZZIRTzaVB7hz6Xp6Ze8CjPr2bcAcrXrlZmEtq2Ycn78RigFzD7UHsEKsm7udUju1unb1OKGAR+kDTHl+I3R73wnGXZO6ACq5b7Vn49QKOsT/+9wx0MEWqAYhBTNeJae+UOcYegrMKuFusF62mT8C2PKypXzBoV8do6hBSkJMs/sVfqn/JoFrtCuYdtutjxbQ+s75RIn0h713ZGki1nT/+xVzORcWoUeBK7UOgp1nJixCQol0lZSHvVc4UE9fQJrmMWNRCzLZFrAr4F6uxS4GgLbDvY2grCLkOmD9ej5c4uZohkhCa8wSgH/pZ+PceleB96f8OOSUJuUCYSwHX0Du5jCHTU9CzTOMN6F6emW3DuS+5vUozZgD3UOYtf5SGLuHfb5pTgu8K71uzIOCLQdiyP+XjWiYrL7cWwFML2bwk79Nw2XzPt034EOUXo+cCjrNu5v0SZm8BuQ6IQQjMw36phn7aSYK3CrhJpVmy5xSO8i2svVolfRO+aOYlWZ7SCfrCItQegq4KuCKrUeyRbO71YP7nEBBLPLkYmFsftqEMuZoh3BzljmSgVatR7Ih97vVg/ucQKWsd4xaWUxvVswnflC/UGI6FZNpbpVno63runG7w7xRqQTDSFpZTG9WGM++UXtoQ2uESoDToEq7lbcC+KbK5TWtdGv522wUT19AvuYww2hDGsAq4S7lC9fQbnucx8LYcMCtIqxiYARPB0Aih6l+mf+GKZKBVqxbg/3WO/WKfg3NmJVCxGuo8d9neabGYU7t8gu8KqFfZNo7nAo79D52OdgEnItYWllMb1aUb1pQv1BiOk2WgVatR7JB9/vUR8O9EZjNQ1lXTHRG4niL+2HeFHfCmT+MK/Ajg6QzI9Xbv4RwielChBopIBsrHeavLL40Q1OESslWrC+D/DIm7I7+sUiV5Av9VzhAUp64G+t9vlFvSp3TeKv0UsKAMgPUh/vdlZiNc/1aYLB3ZiGmhlE6XW8zja+4Q7BW2tgHhtiWwr1c2bVC3Ft5TC8jeaf3FIcwAkPofs0y7S7/pVY6jbub9EmZ5UKEWnxBBi5Yq79cmqm7FjgjBFeAerLEMgPUh/vdlZiNc/1XOUx3Z2GX/13fbQciuCq5bo1WmpFqBoC2w7xJmI1z+WdZTbNfQMbmMIbtTya8IwRXgHqyxXYOSIZ+hVyFnBrkYmBUTwcFnudBw1AiS8xG1SLxJ8rhz0Q==
Source: file.exe, 00000000.00000002.2107629430.000000000138B000.00000040.00000001.01000000.00000003.sdmp, BAKFCBFHJD.exe, 00000009.00000002.2157881884.0000000000673000.00000040.00000001.01000000.0000000B.sdmp, BAKFCBFHJD.exe, 00000009.00000000.2088224331.0000000000673000.00000080.00000001.01000000.0000000B.sdmp, skotes.exe, 0000000A.00000002.2198440738.0000000001133000.00000040.00000001.01000000.0000000D.sdmp, skotes.exe, 0000000A.00000000.2127869098.0000000001133000.00000080.00000001.01000000.0000000D.sdmp, skotes.exe, 0000000B.00000000.2132260235.0000000001133000.00000080.00000001.01000000.0000000D.sdmp, skotes.exe, 0000000B.00000002.2199681608.0000000001133000.00000040.00000001.01000000.0000000D.sdmp, skotes.exe, 0000000C.00000000.2299229146.0000000001133000.00000080.00000001.01000000.0000000D.sdmp, f377015f96.exe, 00000010.00000002.2679711119.000000000118B000.00000040.00000001.01000000.00000010.sdmp, f377015f96.exe, 00000019.00000002.2850082344.000000000118B000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: firefox.exe, 00000022.00000002.2931706128.0000029454540000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: f377015f96.exe, 00000019.00000002.2861247425.0000000001AD5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWD

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	API call chain: ExitProcess graph end node

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: SIWVID

Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe

System information queried: KernelDebuggerInformation

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process queried: DebugPort

Source: C:\Users\user\Documents\BAKFCBFHJD.exe

Code function: 9_2_05220D46 rdtsc

9_2_05220D46

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C4B5FF0 IsDebuggerPresent,??0PrintfTarget@mozilla@@IAE@XZ,?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z,OutputDebugStringA,__acrt_iob_func,_fileno,_dup,_fdopen,__stdio_common_vfprintf,fclose,

0_2_6C4B5FF0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C4BC410 LoadLibraryW,GetProcAddress,FreeLibrary,

0_2_6C4BC410

Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Code function: 9_2_004B652B mov eax, dword ptr fs:[00000030h]	9_2_004B652B
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Code function: 9_2_004BA302 mov eax, dword ptr fs:[00000030h]	9_2_004BA302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 10_2_00F7A302 mov eax, dword ptr fs:[00000030h]	10_2_00F7A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 10_2_00F7652B mov eax, dword ptr fs:[00000030h]	10_2_00F7652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 11_2_00F7A302 mov eax, dword ptr fs:[00000030h]	11_2_00F7A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 11_2_00F7652B mov eax, dword ptr fs:[00000030h]	11_2_00F7652B

Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C48B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_6C48B66C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C48B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6C48B1F7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C63AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6C63AC62

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: file.exe PID: 3152, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: f377015f96.exe PID: 8, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: f377015f96.exe PID: 5228, type: MEMORYSTR

Excessive usage of taskkill to terminate processes

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\BAKFCBFHJD.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Documents\BAKFCBFHJD.exe "C:\Users\user\Documents\BAKFCBFHJD.exe"	Jump to behavior
Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe "C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe "C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe "C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe "C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe "C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=f039f524ee.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=f039f524ee.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=f039f524ee.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=f039f524ee.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Process created: unknown unknown

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C684760 malloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetSecurityDescriptorGroup,GetLengthSid,GetLengthSid,GetLengthSid,malloc,InitializeAcl,AddAccessAllowedAce,AddAccessAllowedAce,AddAccessAllowedAce,SetSecurityDescriptorDacl,PR_SetError,GetLastError,free,GetLastError,GetLastError,free,free,free,

0_2_6C684760

Source: 18d00389b3.exe, 00000012.00000000.2682081483.00000000008E2000.00000002.00000001.01000000.00000011.sdmp	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: file.exe, file.exe, 00000000.00000002.2107629430.000000000138B000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: dProgram Manager
Source: firefox.exe, 00000020.00000002.2896023910.00000018880BB000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: ?ProgmanListenerWi
Source: BAKFCBFHJD.exe, 00000009.00000002.2158184442.00000000006B7000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, 0000000A.00000002.2198597904.0000000001177000.00000040.00000001.01000000.0000000D.sdmp, skotes.exe, 0000000B.00000002.2199941474.0000000001177000.00000040.00000001.01000000.0000000D.sdmp	Binary or memory string: ^lProgram Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C48B341 cpuid

0_2_6C48B341

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C4535A0 ?Startup@TimeStamp@mozilla@@SAXXZ,InitializeCriticalSectionAndSpinCount,getenv,QueryPerformanceFrequency,_strnicmp,GetSystemTimeAdjustment,__aulldiv,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,__aulldiv,strcmp,strcmp,_strnicmp,

0_2_6C4535A0

Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Lowering of HIPS / PFW / Operating System Security Settings

Disable Windows Defender notifications (registry)

Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe

Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1

Disable Windows Defender real time protection (registry)

Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableIOAVProtection 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRealtimeMonitoring 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	Registry value created: DisableNotifications 1

Disables Windows Defender Tamper protection

Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe

Registry value created: TamperProtection 0

Modifies windows update settings

Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AutoInstallMinorUpdates
Source: C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotConnectToWindowsUpdateInternetLocations

Source: f039f524ee.exe, 0000000F.00000003.2714506979.0000000001037000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2713928133.000000000101B000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2713837367.000000000102A000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2848661309.0000000000FA5000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2714116427.000000000571C000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2714035777.000000000101D000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2904185884.00000000011FA000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2861815157.00000000011F2000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2889643830.00000000011FA000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 11.2.skotes.exe.f40000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.skotes.exe.f40000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.BAKFCBFHJD.exe.480000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.2153108799.0000000000481000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2198230771.0000000000F41000.00000040.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2199343337.0000000000F41000.00000040.00000001.01000000.0000000D.sdmp, type: MEMORY

Yara detected Credential Flusher

Source: Yara match

File source: Process Memory Space: 18d00389b3.exe PID: 3284, type: MEMORYSTR

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: f039f524ee.exe PID: 6696, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: f039f524ee.exe PID: 2840, type: MEMORYSTR

Yara detected Stealc

Source: Yara match	File source: 00000000.00000003.1658639876.0000000005220000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000031.00000002.3117979567.0000000000DB1000.00000040.00000001.01000000.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.2848099754.0000000000DB1000.00000040.00000001.01000000.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2107422140.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.2629217512.00000000050B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.2861247425.0000000001A6B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000031.00000003.3020544677.0000000004B00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000003.2757599430.00000000056A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.2681962698.000000000155E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.2679338417.0000000000DB1000.00000040.00000001.01000000.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000031.00000002.3112834532.000000000068B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2107233640.0000000000DFE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 3152, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: f377015f96.exe PID: 8, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: f377015f96.exe PID: 5228, type: MEMORYSTR

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 3152, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.2107422140.0000000001034000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2107422140.0000000001034000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2107422140.0000000001034000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2107422140.0000000001117000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Jaxx Liberty
Source: file.exe, 00000000.00000002.2107422140.0000000001034000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2107422140.0000000001034000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2107422140.0000000001034000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2107422140.0000000001034000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2107422140.0000000001034000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2107422140.0000000001034000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2107422140.0000000001034000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2107422140.0000000001034000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2107422140.0000000001034000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2107422140.0000000001034000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2107422140.0000000001034000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2107422140.0000000001034000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2107422140.0000000001034000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2107422140.0000000001034000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2107422140.0000000001034000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2107422140.0000000001034000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2107422140.0000000001034000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2107233640.0000000000E71000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\.

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: C:\Users\user\Documents\BAKFCBFHJD.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents\JSDNGYCOWY
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents\JSDNGYCOWY
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents\JSDNGYCOWY
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents\JSDNGYCOWY
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents\SQRKHNBNYN
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents\SQRKHNBNYN
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents\JSDNGYCOWY
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents\JSDNGYCOWY
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents\SQRKHNBNYN
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents\SQRKHNBNYN
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents\WKXEWIOTXI
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents\WKXEWIOTXI
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN

Source: Yara match	File source: 0000000F.00000003.2681081649.0000000001018000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2680221886.0000000001018000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2673800698.0000000001018000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2646499229.0000000001011000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.2809295731.00000000011E3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.2713156874.00000000011D8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2678578144.0000000001018000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2673028661.0000000001017000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2675427284.0000000001018000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2682030732.000000000101F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2678009352.0000000001018000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2680574921.0000000001018000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2678906552.0000000001018000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2681445195.0000000001018000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.2803779137.00000000011DC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.2809371493.00000000011F2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2679263353.0000000001018000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.2803011829.00000000011D8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2675179858.0000000001018000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2679554542.0000000001018000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2678083034.0000000001018000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2678456559.0000000001018000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2678381424.0000000001018000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2680795575.0000000001018000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2680339133.0000000001018000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2679363395.0000000001018000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2646636082.0000000001017000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.2771485025.00000000011DD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2679980400.0000000001018000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2673739066.0000000001018000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2680696251.0000000001018000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.2742195555.00000000011D8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.2742444167.00000000011DB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2680117370.0000000001018000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2674348099.0000000001018000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.2809334415.00000000011EA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2672861730.0000000001011000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2678514734.0000000001018000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.2770447800.00000000011D8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2679869482.0000000001018000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.2713492473.00000000011D9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.2814773574.00000000011F3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2677615654.0000000001018000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2622538163.0000000001019000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2678714450.0000000001018000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.2776788243.00000000011DD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2679680520.0000000001018000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.2771976922.00000000011DD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2677513754.0000000001018000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2678158093.0000000001018000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2646669500.0000000001019000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2674962634.0000000001018000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2673677963.0000000001018000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2589686211.000000000100F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2673586366.0000000001018000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2675285735.0000000001018000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2679462403.0000000001018000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2679006727.0000000001018000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.2775962014.00000000011DD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2679087482.0000000001018000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2678304397.0000000001018000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2680932860.0000000001018000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2673513530.0000000001018000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2678818521.0000000001018000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2616118705.0000000001012000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 3152, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: f039f524ee.exe PID: 6696, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: f039f524ee.exe PID: 2840, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""

Yara detected Credential Flusher

Source: Yara match

File source: Process Memory Space: 18d00389b3.exe PID: 3284, type: MEMORYSTR

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: f039f524ee.exe PID: 6696, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: f039f524ee.exe PID: 2840, type: MEMORYSTR

Yara detected Stealc

Source: Yara match	File source: 00000000.00000003.1658639876.0000000005220000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000031.00000002.3117979567.0000000000DB1000.00000040.00000001.01000000.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.2848099754.0000000000DB1000.00000040.00000001.01000000.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2107422140.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.2629217512.00000000050B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.2861247425.0000000001A6B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000031.00000003.3020544677.0000000004B00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000003.2757599430.00000000056A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.2681962698.000000000155E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.2679338417.0000000000DB1000.00000040.00000001.01000000.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000031.00000002.3112834532.000000000068B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2107233640.0000000000DFE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 3152, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: f377015f96.exe PID: 8, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: f377015f96.exe PID: 5228, type: MEMORYSTR

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 3152, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C640C40 sqlite3_bind_zeroblob,	0_2_6C640C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C640D60 sqlite3_bind_parameter_name,	0_2_6C640D60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C568EA0 sqlite3_clear_bindings,	0_2_6C568EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C640B40 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob,	0_2_6C640B40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C566410 bind,WSAGetLastError,	0_2_6C566410
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C56C050 sqlite3_bind_parameter_index,strlen,strncmp,strncmp,	0_2_6C56C050
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C566070 PR_Listen,	0_2_6C566070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C56C030 sqlite3_bind_parameter_count,	0_2_6C56C030
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5660B0 listen,WSAGetLastError,	0_2_6C5660B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4F22D0 sqlite3_bind_blob,	0_2_6C4F22D0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	21 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	511 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Native API	1 Scheduled Task/Job	2 Bypass User Account Control	1 Deobfuscate/Decode Files or Information	LSASS Memory	13 File and Directory Discovery	Remote Desktop Protocol	41 Data from Local System	2 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	11 Registry Run Keys / Startup Folder	1 Extra Window Memory Injection	3 Obfuscated Files or Information	Security Account Manager	248 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	Login Hook	12 Process Injection	12 Software Packing	NTDS	1 Query Registry	Distributed Component Object Model	Input Capture	1 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Scheduled Task/Job	1 DLL Side-Loading	LSA Secrets	881 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	11 Registry Run Keys / Startup Folder	2 Bypass User Account Control	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Extra Window Memory Injection	DCSync	371 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Masquerading	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	371 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	12 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	45%	ReversingLabs	Win32.Trojan.Symmi
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Avira	HEUR/AGEN.1320706
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Avira	TR/Crypt.XPACK.Gen
C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	100%	Avira	TR/ATRAPS.Gen
C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	100%	Avira	TR/Crypt.XPACK.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	100%	Avira	TR/ATRAPS.Gen
C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	100%	Avira	HEUR/AGEN.1320706
C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	100%	Joe Sandbox ML
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	39%	ReversingLabs	Win32.Trojan.Symmi
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	45%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[2].exe	24%	ReversingLabs	Win32.Ransomware.Generic
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe	34%	ReversingLabs	Win32.Rootkit.BootkitX
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe	45%	ReversingLabs	Win32.Trojan.Symmi
C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe	34%	ReversingLabs	Win32.Rootkit.BootkitX
C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe	39%	ReversingLabs	Win32.Trojan.Symmi
C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe	45%	ReversingLabs	Win32.Trojan.Symmi
C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe	24%	ReversingLabs	Win32.Ransomware.Generic
C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe	45%	ReversingLabs	Win32.Infostealer.Tinba

Source	Detection	Scanner	Label
https://atten-supporse.biz/apiluv	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phppresolver.dll	100%	Avira URL Cloud	malware
https://atten-supporse.biz/U	100%	Avira URL Cloud	malware
https://atten-supporse.biz/#4	100%	Avira URL Cloud	malware
https://atten-supporse.biz/s4p6	100%	Avira URL Cloud	malware
https://atten-supporse.biz/apiEW	100%	Avira URL Cloud	malware
http://185.215.113.206H	0%	Avira URL Cloud	safe
http://185.215.113.16/mine/random.exeg	100%	Avira URL Cloud	malware
http://185.215.113.206M	0%	Avira URL Cloud	safe
http://185.215.113.206/c4becf79229cb002.phper	100%	Avira URL Cloud	malware
http://185.215.113.206y	0%	Avira URL Cloud	safe
http://80.82.65.70/cdb-53011b87bd06	0%	Avira URL Cloud	safe
https://profiler.firefox.comFound	0%	Avira URL Cloud	safe

Name	Malicious	Reputation
dare-curbys.biz	false	high
formy-spill.biz	false	high
atten-supporse.biz	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.1863399988.0000000000ED0000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2589952496.000000000573F000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2590072407.0000000005728000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2713287494.00000000058EB000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2713694037.00000000058E9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://youtube.comZ	firefox.exe, 00000020.00000002.2961359117.00000F1AEFE00000.00000004.00000800.00020000.00000000.sdmp	false		high
https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-	firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.1863399988.0000000000ED0000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2589952496.000000000573F000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2590072407.0000000005728000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2713287494.00000000058EB000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2713694037.00000000058E9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=40249-e88c401e1b1f2242d9e4	firefox.exe, 00000020.00000002.2914904234.0000017CD7978000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD6703000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.206/	f377015f96.exe, 00000010.00000002.2681962698.00000000015B7000.00000004.00000020.00020000.00000000.sdmp, f377015f96.exe, 00000019.00000002.2861247425.0000000001A6B000.00000004.00000020.00020000.00000000.sdmp, f377015f96.exe, 00000019.00000002.2861247425.0000000001ABE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_l	firefox.exe, 00000020.00000002.2910130082.0000017CD6703000.00000004.00000800.00020000.00000000.sdmp	false		high
https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%	firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	file.exe, 00000000.00000002.2112319814.000000000BD12000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2107233640.0000000000ED6000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2649157391.0000000001027000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2776788243.00000000011D8000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2914904234.0000017CD7978000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD6757000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2904680065.0000017CD4FAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD677D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/records	firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp	false		high
https://atten-supporse.biz/U	f039f524ee.exe, 00000011.00000003.2713156874.00000000011D8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://merino.services.mozilla.com/api/v1/suggest	firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2900114787.0000017CC98D7000.00000004.00000800.00020000.00000000.sdmp	false		high
https://atten-supporse.biz/apiluv	f039f524ee.exe, 0000000F.00000003.2714506979.0000000001037000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2713837367.000000000102A000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2708103066.0000000001037000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://firefox.settings.services.mozilla.com/v1AIzaSyB2h2OuRcUgy5N-5hsZqiPW6sH3n_rptiQPopulating	firefox.exe, 00000020.00000002.2908457770.0000017CD5A03000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.206/ocal	f377015f96.exe, 00000019.00000002.2861247425.0000000001ABE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://atten-supporse.biz/T	f039f524ee.exe, 00000011.00000003.2803011829.00000000011D8000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2742444167.00000000011DB000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2742195555.00000000011D8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://monitor.firefox.com/oauth/init?entrypoint=protection_report_monitor&utm_source=about-protect	firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://spocs.getpocket.com/spocs	firefox.exe, 00000020.00000002.2914904234.0000017CD7978000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD6703000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.phppresolver.dll	file.exe, 00000000.00000002.2112319814.000000000BD1A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://atten-supporse.biz/s4p6	f039f524ee.exe, 0000000F.00000003.2672861730.0000000001011000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://screenshots.firefox.com	firefox.exe, 00000020.00000002.2918847879.0000017CD9133000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2908457770.0000017CD5A03000.00000004.00000800.00020000.00000000.sdmp	false		high
https://completion.amazon.com/search/complete?q=	firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2819165160.0000017CD9477000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2818486632.0000017CD943C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/social-media-tracking-report	firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://ads.stickyadstv.com/firefox-etp	firefox.exe, 00000020.00000002.2933675468.0000017CD9F03000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mail.inbox.lv/compose?to=%sresource://gre/modules/DeferredTask.sys.mjsresource://gre/modules	firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.206M	file.exe, 00000000.00000002.2107233640.0000000000DFE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://atten-supporse.biz/#	f039f524ee.exe, 00000011.00000003.2889643830.00000000011E5000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2816854374.00000000011E7000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.3072941768.00000000011E8000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2809295731.00000000011E3000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2803779137.00000000011DC000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2803011829.00000000011D8000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2903405613.00000000011E8000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2771485025.00000000011DD000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2742444167.00000000011DB000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2742195555.00000000011D8000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2845300625.00000000011E8000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2770447800.00000000011D8000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2713492473.00000000011D9000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2776788243.00000000011DD000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2771976922.00000000011DD000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2775962014.00000000011DD000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/send-tab	firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://monitor.firefox.com/breach-details/	firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/118.0.1/WINNT/en-US/browser.newtabpage.activity-stream.feeds.s	firefox.exe, 00000020.00000002.2933675468.0000017CD9F17000.00000004.00000800.00020000.00000000.sdmp	false		high
https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM	firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://xhr.spec.whatwg.org/#sync-warning	firefox.exe, 00000020.00000002.2908012090.0000017CD5912000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2908012090.0000017CD592C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://atten-supporse.biz/0	f039f524ee.exe, 0000000F.00000003.2848661309.0000000000FE5000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.amazon.com/exec/obidos/external-search/	firefox.exe, 00000020.00000002.2908457770.0000017CD5A03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2819165160.0000017CD9477000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2818486632.0000017CD943C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.206H	f377015f96.exe, 00000019.00000002.2861247425.0000000001A6B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://profiler.firefox.com/	firefox.exe, 00000020.00000002.2914904234.0000017CD7978000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.msn.com	firefox.exe, 00000020.00000002.2918847879.0000017CD9176000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2894411295.0000001882C3B000.00000004.00000010.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2949018481.0000017CDC0E4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2951694809.0000017CDCB78000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.206/68b591d6548ec281/nss3.dll	file.exe, 00000000.00000002.2107233640.0000000000E71000.00000004.00000020.00020000.00000000.sdmp	false		high
https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881No	firefox.exe, 00000020.00000002.2908457770.0000017CD5A03000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/mozilla-services/screenshots/shims/google-analytics-ecommerce-plugin.jsasyncEmitM	firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.phper	file.exe, 00000000.00000002.2107422140.0000000001117000.00000040.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: malware	unknown
https://github.com/mozilla-services/screenshots	firefox.exe, 00000020.00000002.2916806678.0000017CD8B70000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000003.2818869675.0000017CD945A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2817374710.0000017CD9200000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2817893137.0000017CD941F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2819165160.0000017CD9477000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000003.2818486632.0000017CD943C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://services.addons.mozilla.org/api/v4/addons/addon/	firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://tracking-protection-issues.herokuapp.com/new	firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	false		high
http://exslt.org/sets	firefox.exe, 00000020.00000002.2904680065.0000017CD4F26000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/password-manager-report	firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://youtube.com/	firefox.exe, 00000020.00000002.2943062764.0000017CDB3A4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	file.exe, 00000000.00000002.2112319814.000000000BD12000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2107233640.0000000000ED6000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2649157391.0000000001027000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2914904234.0000017CD7978000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD6757000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2904680065.0000017CD4FAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD677D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsing	firefox.exe, 00000020.00000002.2908012090.0000017CD5912000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2908012090.0000017CD592C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report	firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://api.accounts.firefox.com/v1	firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	false		high
http://exslt.org/common	firefox.exe, 00000020.00000002.2904680065.0000017CD4F26000.00000004.00000800.00020000.00000000.sdmp	false		high
https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/	firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://fpn.firefox.com	firefox.exe, 00000020.00000002.2910130082.0000017CD6757000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2962100177.0000360BFBE04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2900114787.0000017CC988F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.widevine.com/	firefox.exe, 00000020.00000002.2908457770.0000017CD5A03000.00000004.00000800.00020000.00000000.sdmp	false		high
https://monitor.firefox.com/?entrypoint=protection_report_monitor&utm_source=about-protections	firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.1863399988.0000000000ED0000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2589952496.000000000573F000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2590072407.0000000005728000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2713287494.00000000058EB000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2713694037.00000000058E9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	file.exe, 00000000.00000002.2112319814.000000000BD12000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2107233640.0000000000ED6000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2649157391.0000000001027000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2914904234.0000017CD7978000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD6757000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2904680065.0000017CD4FAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD677D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://atten-supporse.biz/api	f039f524ee.exe, 0000000F.00000003.2646499229.0000000001011000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2678578144.0000000001018000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2673028661.0000000001017000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2675427284.0000000001018000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2682193338.000000000101A000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2680574921.0000000001018000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2678009352.0000000001018000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2776383187.0000000001032000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2681445195.0000000001018000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2678906552.0000000001018000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2679263353.0000000001018000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2678083034.0000000001018000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2675179858.0000000001018000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2679554542.0000000001018000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2678456559.0000000001018000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2678381424.0000000001018000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2680795575.0000000001018000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2680339133.0000000001018000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2679363395.0000000001018000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2837717203.0000000001029000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2646636082.0000000001017000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	f039f524ee.exe, 0000000F.00000003.2647391727.000000000574A000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2771585453.00000000058D5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2937492782.0000017CDA7C9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://atten-supporse.biz/#4	f039f524ee.exe, 0000000F.00000003.2707665355.0000000001011000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://win.mail.ru/cgi-bin/sentmsg?mailto=%s	firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2907178707.0000017CD557D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	file.exe, 00000000.00000003.1863399988.0000000000ED0000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2589952496.000000000573F000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2590072407.0000000005728000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2713287494.00000000058EB000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2713694037.00000000058E9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.youtube.com/	firefox.exe, 00000020.00000002.2910130082.0000017CD6703000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/shield	firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://atten-supporse.biz/apiEW	f039f524ee.exe, 00000011.00000003.2904185884.00000000011FA000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.3084418747.00000000011F9000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2809295731.00000000011E3000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2861815157.00000000011F2000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2803779137.00000000011DC000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2803011829.00000000011D8000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2809371493.00000000011F2000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.3072941768.00000000011F9000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2842457103.00000000011F9000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2809334415.00000000011EA000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2814773574.00000000011F3000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2889643830.00000000011FA000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2817596296.00000000011FE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=	firefox.exe, 00000020.00000002.2910130082.0000017CD6703000.00000004.00000800.00020000.00000000.sdmp	false		high
http://127.0.0.1:	firefox.exe, 00000020.00000002.2919639043.0000017CD92A2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.2900114787.0000017CC985D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bugzilla.mo	firefox.exe, 00000020.00000002.2931947413.0000017CD9E8B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD6725000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2929235826.0000017CD9B64000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mitmdetection.services.mozilla.com/	firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://amazon.com	firefox.exe, 00000020.00000002.2914904234.0000017CD7978000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD677D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bugzilla.mozilla.org/show_bug.cgi?id=1238180Required	firefox.exe, 00000020.00000002.2908457770.0000017CD5AAF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.16/mine/random.exeg	file.exe, 00000000.00000002.2107233640.0000000000E57000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://static.adsafeprotected.com/firefox-etp-js	firefox.exe, 00000020.00000002.2908457770.0000017CD5AE0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2933948328.0000017CDA07C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://80.82.65.70/cdb-53011b87bd06	a17088d8c7.exe, 0000000D.00000003.3117232730.00000000055CB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.amazon.com/exec/obidos/external-search/moz-extension://e2beb7c2-ef50-4ddd-9210-92a40514d	firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.16/off/def.exe	f039f524ee.exe, 0000000F.00000003.2848661309.0000000000FE5000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2848661309.0000000000FB0000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2849666702.0000000001004000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.3084418747.00000000011F9000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.3072941768.00000000011F9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://developer.mozilla.org/docs/Web/API/Element/releasePointerCapture	firefox.exe, 00000020.00000002.2908012090.0000017CD592C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://spocs.getpocket.com/	firefox.exe, 00000020.00000002.2914904234.0000017CD7978000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2910130082.0000017CD6703000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	f039f524ee.exe, 0000000F.00000003.2590570427.0000000005740000.00000004.00000800.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2714885498.00000000058D2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://atten-supporse.biz/	f039f524ee.exe, 0000000F.00000003.2848661309.0000000000FE5000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2646499229.0000000001011000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2843200148.0000000001012000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2848661309.0000000000FA5000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2589842358.0000000001013000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2589686211.000000000100F000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2590354965.0000000001013000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2616118705.0000000001012000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 0000000F.00000003.2777000037.0000000001012000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2904185884.00000000011FA000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2803779137.00000000011DC000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2771485025.00000000011DD000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2862654694.00000000011DE000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2742444167.00000000011DB000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2742195555.00000000011D8000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2770447800.00000000011D8000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2776788243.00000000011DD000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2771976922.00000000011DD000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2847569257.00000000011DC000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2889643830.00000000011FA000.00000004.00000020.00020000.00000000.sdmp, f039f524ee.exe, 00000011.00000003.2775962014.00000000011DD000.00000004.00000020.00020000.00000000.sdmp	false		high
https://services.addons.mozilla.org/api/v4/abuse/report/addon/	firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%	firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f	firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://profiler.firefox.comFound	firefox.exe, 00000020.00000002.2908457770.0000017CD5A72000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://detectportal.firefox.com/canonical.htmlACTIVITY_SUBTYPE_REQUEST_BODY_SENTACTIVITY_SUBTYPE_PRO	firefox.exe, 00000020.00000002.2933675468.0000017CD9F17000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.206y	f377015f96.exe, 00000010.00000002.2681962698.000000000155E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://exslt.org/strings	firefox.exe, 00000020.00000002.2900114787.0000017CC9803000.00000004.00000800.00020000.00000000.sdmp	false		high
https://play.google.com/store/apps/details?id=org.mozilla.firefox&referrer=utm_source%3Dprotection_r	firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	false		high
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll	file.exe, 00000000.00000002.2107233640.0000000000DFE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://monitor.firefox.com/user/breach-stats?includeResolved=true	firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/Master	firefox.exe, 00000020.00000002.2933675468.0000017CD9F17000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report	firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.phpd	file.exe, 00000000.00000002.2107233640.0000000000E71000.00000004.00000020.00020000.00000000.sdmp	false		high
https://safebrowsing.google.com/safebrowsing/diagnostic?site=	firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	false		high
http://www.inbox.lv/rfc2368/?value=%su	firefox.exe, 00000020.00000002.2914904234.0000017CD79B1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://monitor.firefox.com/user/dashboard	firefox.exe, 00000020.00000002.2906926148.0000017CD53C0000.00000002.08000000.00040000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
104.21.48.1	unknown	United States	13335	CLOUDFLARENETUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
172.217.19.238	unknown	United States	15169	GOOGLEUS	false
23.218.210.69	unknown	United States	6453	AS6453US	false
13.107.246.63	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
80.82.65.70	unknown	Netherlands	202425	INT-NETWORKSC	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
216.58.208.227	unknown	United States	15169	GOOGLEUS	false
142.250.181.110	unknown	United States	15169	GOOGLEUS	false
2.20.41.214	unknown	European Union	16625	AKAMAI-ASUS	false
216.58.208.234	unknown	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
142.250.181.68	unknown	United States	15169	GOOGLEUS	false
172.217.21.35	unknown	United States	15169	GOOGLEUS	false
64.233.162.84	unknown	United States	15169	GOOGLEUS	false
35.190.72.216	unknown	United States	15169	GOOGLEUS	false
172.217.21.36	unknown	United States	15169	GOOGLEUS	false
173.194.222.84	unknown	United States	15169	GOOGLEUS	false
31.41.244.11	unknown	Russian Federation	61974	AEROEXPRESS-ASRU	false

Private

IP
192.168.2.4
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1571960
Start date and time:	2024-12-09 22:34:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 18m 32s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	64
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@135/49@0/23
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Max analysis timeout: 600s exceeded, the analysis took too long
Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Skipping network analysis since amount of network traffic is too extensive
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
16:35:25	API Interceptor	84x Sleep call for process: file.exe modified
16:36:02	API Interceptor	20591584x Sleep call for process: skotes.exe modified
16:36:26	API Interceptor	361x Sleep call for process: f039f524ee.exe modified
16:36:47	API Interceptor	608081x Sleep call for process: a17088d8c7.exe modified
21:35:43	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
21:36:26	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run f039f524ee.exe C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe
21:36:35	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run f377015f96.exe C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe
21:36:43	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 18d00389b3.exe C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe
21:36:52	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run f039f524ee.exe C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe
21:37:01	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run f377015f96.exe C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe
21:37:09	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 18d00389b3.exe C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe
21:37:18	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 9f6ad733e2.exe C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe
21:37:31	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 9f6ad733e2.exe C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe

LLM Input / Output

Input	Output
URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=f039f524ee.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "This application could not be started", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: https://learn.microsoft.com Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": true, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: https://learn.microsoft.com
URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=f039f524ee.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "This application could not be started", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=f039f524ee.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }
	{ "brands": [ "Microsoft" ] }
URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=f039f524ee.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }
	{ "brands": [ "Microsoft" ] }

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	SJqOoILabX.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	8GHb2yuPOk.exe	Get hash	malicious	Amadey, LummaC Stealer	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, AsyncRAT, Credential Flusher, LummaC Stealer, Stealc, Vidar, XWorm	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
104.21.48.1	SN500, SN150 Spec.exe	Get hash	malicious	FormBook	Browse	www.antipromil.site/7ykh/
1.1.1.1	6fW0GedR6j.xls	Get hash	malicious	Unknown	Browse	1.1.1.1/ctrl/playback.php
	PO-230821_pdf.exe	Get hash	malicious	FormBook, NSISDropper	Browse	www.974dp.com/sn26/?kJBLpb8=qaEGeuQorcUQurUZCuE8d9pas+Z0M0brqtX248JBolEfq8j8F1R9i1jKZexhxY54UlRG&ML0tl=NZlpi
	AFfv8HpACF.exe	Get hash	malicious	Unknown	Browse	1.1.1.1/
	INVOICE_90990_PDF.exe	Get hash	malicious	FormBook	Browse	www.quranvisor.com/usvr/?mN9d3vF=HHrW7cA9N4YJlebHFvlsdlDciSnnaQItEG8Ccfxp291VjnjcuwoPACt7EOqEq4SWjIf8&Pjf81=-Zdd-V5hqhM4p2S
	Go.exe	Get hash	malicious	Unknown	Browse	1.1.1.1/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.48.1
	https://bcnys.us11.list-manage.com/track/click?u=b3ce03a042f3f32fe41fe1faf&id=8c15544f56&e=24911589a5	Get hash	malicious	Unknown	Browse	1.1.1.1
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.48.1
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	172.67.139.78
	GLAMPITECT++LTD+(PROPOSAL).eml	Get hash	malicious	unknown	Browse	104.16.144.15
	https://xxx.cloudlawservices.com/fROBJ/	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	104.21.64.1
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.79.7
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.64.1
	https://quiet-sun-5d9f.atmos4.workers.dev/login	Get hash	malicious	Unknown	Browse	104.21.50.75
CLOUDFLARENETUS	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.48.1
	https://bcnys.us11.list-manage.com/track/click?u=b3ce03a042f3f32fe41fe1faf&id=8c15544f56&e=24911589a5	Get hash	malicious	Unknown	Browse	1.1.1.1
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.48.1
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	172.67.139.78
	GLAMPITECT++LTD+(PROPOSAL).eml	Get hash	malicious	unknown	Browse	104.16.144.15
	https://xxx.cloudlawservices.com/fROBJ/	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	104.21.64.1
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.79.7
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.64.1
	https://quiet-sun-5d9f.atmos4.workers.dev/login	Get hash	malicious	Unknown	Browse	104.21.50.75
AS6453US	GLAMPITECT++LTD+(PROPOSAL).eml	Get hash	malicious	unknown	Browse	23.218.208.236
	nshkarm.elf	Get hash	malicious	Mirai	Browse	41.206.191.231
	RCTYJFM.exe	Get hash	malicious	Phisher	Browse	23.218.208.109
	https://www.dropbox.com/l/AADbLOqftgPkdsTWgBgFyNpmu-iGeYJGM4I	Get hash	malicious	Unknown	Browse	23.218.208.137
	nshmips.elf	Get hash	malicious	Mirai	Browse	41.206.191.206
	nshppc.elf	Get hash	malicious	Mirai	Browse	41.206.191.200
	BACS190027-01.pdf	Get hash	malicious	Unknown	Browse	23.218.208.137
	Doc Copy-PTD- P2139 INV- P2238.eml	Get hash	malicious	Unknown	Browse	23.218.208.109
	rdpguard-9-7-9.exe	Get hash	malicious	Unknown	Browse	23.218.208.109
	phish_alert_sp2_2.0.0.0 lazz.msg	Get hash	malicious	Unknown	Browse	23.218.208.109
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	SJqOoILabX.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.206

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	hD7SED8r8Q.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	5EZLEXDveC.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, AsyncRAT, Credential Flusher, LummaC Stealer, Stealc, Vidar, XWorm	Browse
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, DarkVision Rat, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse

Created / dropped Files

C:\ProgramData\CBKJEGCBKKJECBGCGDBAKJEBAA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EBGCGHIDHCBFHIDGHCBK

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HDAFBGIJ

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JDBGHIIDAECBFIDHIIDG

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	9571
Entropy (8bit):	5.536643647658967
Encrypted:	false
SSDEEP:	192:qnaRt+YbBp6ihj4qyaaX86KKkfGNBw8DJSl:yegqumcwQ0
MD5:	5D8E5D85E880FB2D153275FCBE9DA6E5
SHA1:	72332A8A92B77A8B1E3AA00893D73FC2704B0D13
SHA-256:	50490DC0D0A953FA7D5E06105FE9676CDB9B49C399688068541B19DD911B90F9
SHA-512:	57441B4CCBA58F557E08AAA0918D1F9AC36D0AF6F6EB3D3C561DA7953ED156E89857FFB829305F65D220AE1075BC825F131D732B589B5844C82CA90B53AAF4EE
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696333856);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\JECGIIIDAKJDHJKFHIEB

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JJKFBAKFBGDHIEBGDAKFCAFHCB

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KFIIJJJD

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: hD7SED8r8Q.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: 5EZLEXDveC.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\9f6ad733e2.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\add[1].htm

Download File

Process:	C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\download[1].htm

Download File

Process:	C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1895424
Entropy (8bit):	7.948081310283833
Encrypted:	false
SSDEEP:	49152:4Dkjoj13w8WgZENdIWFHmIy2LRwIi2CUMozodAh:4DjI/UWFHg2LRv1CUHoY
MD5:	52F0F216DFBB86683B1E318A0796DD81
SHA1:	2E2B8710E0A077ED8A2124FDE2486F397857B8F6
SHA-256:	1D95373C2284B657B614F07051EED5FED72F34F787350409E49E8DC30A5EA494
SHA-512:	BF3BFF59A42E2D10238306FE34F072C14BD482CAC5C20563987A27174BF304A06CFC9C0B3914254F17695D80B006261B29EA025E2B31324CA3CAEEDF3DA211CB
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 39%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....Ug..............................J...........@...........................K...........@.................................\@..p....0.......................A...................................................................................... . . .......B..................@....rsrc........0.......R..............@....idata .....@.......V..............@... ..+..P.......X..............@...xyjapqsh.p...`0..l...Z..............@...fjnsenoe......J.....................@....taggant.0....J.."..................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2895872
Entropy (8bit):	6.4258400887207126
Encrypted:	false
SSDEEP:	49152:zB4Yi9Rp4WR0viJeLgv+WRLr97P9XZiSdHSy1IJ:z2YyRp4WCaAkGahPVZRIJ
MD5:	6CFAA4B02B026AA1631EDA2E570A1298
SHA1:	28724AB39CD0F9F86C80C1F1FCEDCA8DDE14E77F
SHA-256:	2A68C5304DEEBB741759B134BE32D6C0F8E64DFBB8C06D9765E3035D3AF6CBFD
SHA-512:	06EEE70A62C5819CDE765C683382F0C53A3C4757D7387656D2E80B4FB36A3611E9B86E425FE6E0248B0F91860440FD1D77598C011C82CDCDEC0911EE4DB59BAE
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 45%
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$............,.. ...`....@.. ........................,.......,...`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...cdtvwakf..+.......+..:..............@...qjmihuav. ....,.......,.............@....taggant.@....,.."....,.............@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\fuckingdllENCR[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe
File Type:	data
Category:	dropped
Size (bytes):	97296
Entropy (8bit):	7.9982317718947025
Encrypted:	true
SSDEEP:	1536:A1FazaNKjs9ezO6kGnCRFVjltPjM9Ew1MhiIeJfZCQdOlnq32YTCUZiyAS3tUX9F:k4zaMjVUGCRzbgqw1MoIeJyQ4nyqX9F
MD5:	E6743949BBF24B39B25399CD7C5D3A2E
SHA1:	DBE84C91A9B0ACCD2C1C16D49B48FAEAEC830239
SHA-256:	A3B82FC46635A467CC8375D40DDBDDD71CAE3B7659D2BB5C3C4370930AE9468C
SHA-512:	3D50396CDF33F5C6522D4C485D96425C0DDB341DB9BD66C43EAE6D8617B26A4D9B4B9A5AEE0457A4F1EC6FAC3CB8208C562A479DCAE024A50143CBFA4E1F15F6
Malicious:	false
Preview:	XM .4Ih..]...t.&.s...v.0{.v.vs'...:.l.h...e.....R....1...r.R+Fk....~.s.....Q.....r.T.b.....~c..[........;...j.@.0.%.....x...v.w.....<ru....Yre;.b6...HQ-...8.B..Q.a...R.:.h&r.......=.;r.k..T.@....l..;#..3!.O..x.}........y'<.GfQ.K.#.L5v..].......d....N{e..@................A\..<.t.u.X.O.n..Z.. .Xb.O<.Z...h~.(.W.f.z.V.4..L...%5.0...H..`s...y.B......(IL5s:aS}X.......M9.J.o....).'..M;n6]...W..n....)...L...._..e.....>....[....RA.........'...6.N..g6....IY.%h.. 3r....^..\.b~y./....h.2......ZLk....u}..V..<.fbD.<!.._2.zo..IE...P..O...u......P.......w#.6N..&l.R}GI...LY...N.yz..j..Hy.'..._.5..Pd9.y..+....6.q...).G.c...L#....5\.M....5U])....U(..~H.m....Y....G1.r.4.B..h........P..]i...M%.............)q......]....~\|..j...b..K!..N.7R.}T.2bsq..1...L^..!.\|q.D'...s.Ln...D@..bn%0=b.Q1.....+l...QXO\|.......NC.d......{.0....8F.....<.W.y..{o..j.3.....n..4.....eS]. K...o.B.H~.sh.1....m8....6{.ls..R..q..~....w._;....X*.#..U....6n.ODbT.+Zc....q....S.$-S`YT....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3210240
Entropy (8bit):	6.6609161202022875
Encrypted:	false
SSDEEP:	49152:xiF3GbjN188C7PW+r5iGNWF79gUeKBlI3uv/zQKsE6d94/Ubd:xiF3UH8D7W+9iGNWhgBmi+vbpsjd94U
MD5:	F5DB9DCEA4098275CB46B5D6FE73CEF8
SHA1:	9B623E4CFFF93BFFBAF7034EBBF893773700BA94
SHA-256:	34959918550EF8A11FE8E0EF9DDE5F85F0DAC541E62A2CAD53998D4A0EB07D9D
SHA-512:	C68DDB34D1268D47F28F7B8E4ED7AC807B39424D09097AABC3274690D1F37BFC3615BDFB69ACEC1E8C08EEE0A3EBBAC6FCC99192441CF94AB4D7E14CB917B9C4
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................1...........@..........................01.....s.1...@.................................W...k...........................P.0...............................0..................................................... . ............................@....rsrc...............................@....idata ............................@...nnwaoodm.@......@.................@...ocwkoyql......0.......0.............@....taggant.0....1.."....0.............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	971776
Entropy (8bit):	6.706374744993215
Encrypted:	false
SSDEEP:	24576:LqDEvCTbMWu7rQYlBQcBiT6rprG8aTwV:LTvC/MTQYxsWR7aT
MD5:	5DD5F67D25C20DFF1AC926ABDC8C2EB0
SHA1:	E166D8E6544D137AE62FE204C59E53C962342703
SHA-256:	9661D8306B9BF658642A01718AC746113E19741A560A48A5583BACD52998AF22
SHA-512:	DB420ECBD8CFB63766D84BCFED8CD61147F5E6F99FC3EF95548A99CB615893CE47E554E1E94A6FDBCEEDC529973DC716CDB54BEE071D4FAC4FFAFFD056C22897
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 24%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L....\Wg.........."..........$......w.............@..........................0......<.....@...@.......@.....................d...\|....@...h.......................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc....h...@...j..................@..@.reloc...u.......v...^..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\download[1].htm

Download File

Process:	C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1982464
Entropy (8bit):	7.935448466546174
Encrypted:	false
SSDEEP:	49152:hBaTNWc+BVUPcCQZBoJmnYUD/gSVvgU6PEzIK7iSqWykxb1SaTeoEUshsh:hBagBi0HBoJiDVBSEsKAhQYa1E6h
MD5:	08EFA0BF248584557641DC5DB156248E
SHA1:	8B64A7D0EA9AF4524E7BE713BA22AB0191528403
SHA-256:	15DF6347F76B4D0C86E07C4482E0B81B119265A4DD71F2C729C6BCC59E1CFA9B
SHA-512:	3880C4BB59D0A00BE445C3571EFB0FBCD679B982D86ED88574F51B788C917F943F10CD71A35AC4389F1B320F6947A15FEABD1A5D206BB7BE88E8C77990E89ADD
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 34%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........!J..@$..@$..@$......@$......@$......@$..._..@$..@%..@$......@$......@$......@$.Rich.@$.........PE..L......d..........................................@..........................@..............................................Z.B.n.....@.h!...................................................N...................................................... . ..@......T..................@....rsrc...h!....@......d..............@....idata ......B.....................@... ..).. B.....................@...mkxflzam. ....k.....................@...ntycqcrd............................@....taggant.0......."..................@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.375761888344348
Encrypted:	false
SSDEEP:	48:SfNaoQBTEQYfNaoQyRTQy+fNaoQhQWfNaoQg0UrU0U8Qq:6NnQBTEQkNnQyRTQymNnQhQ+NnQg0Url
MD5:	E6318C4EBADAA27E2EEC6CC15E611EF4
SHA1:	B7242AB0238DB8CF45FA5A669ECDDBDCAC5B4EFA
SHA-256:	CA1624D70035400AAF36576B6F9FDB71DBE0105DE295926D514829B1B02558D5
SHA-512:	8A7D4A37A0530372C7D65E7B712AB6ADB8B2F54125376E8C48B8392F2215F5140B78234A47B5985F2EF4ACFF6C295796F029F3F35A6DB546CFC818D325C4CFA4
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/D5036986670BF0929942EBB41A084C4B",.. "id": "D5036986670BF0929942EBB41A084C4B",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/D5036986670BF0929942EBB41A084C4B"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/7ADE4B346884DF19061B93B7BEB8200C",.. "id": "7ADE4B346884DF19061B93B7BEB8200C",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/7ADE4B346884DF19061B93B7BEB8200C"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\key[1].htm

Download File

Process:	C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	21
Entropy (8bit):	3.880179922675737
Encrypted:	false
SSDEEP:	3:gFsR0GOWW:gyRhI
MD5:	408E94319D97609B8E768415873D5A14
SHA1:	E1F56DE347505607893A0A1442B6F3659BEF79C4
SHA-256:	E29A4FD2CB1F367A743EA7CFD356DBD19AEB271523BBAE49D4F53257C3B0A78D
SHA-512:	994FA19673C6ADC2CC5EF31C6A5C323406BB351551219EE0EEDA4663EC32DAF2A1D14702472B5CF7B476809B088C85C5BE684916B73046DA0DF72236BC6F5608
Malicious:	false
Preview:	9tKiK3bsYm4fMuK47Pk3s

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1799168
Entropy (8bit):	7.945638239226882
Encrypted:	false
SSDEEP:	49152:JHwIuVNz7KeE3qh5Mr1OeRw2iKZHZPQs23/kOWNY:NuT+ednCwI1ZH5Qs23x
MD5:	CBF2B84F9B993A77C0E2170CCCBACB7C
SHA1:	33FDF37B3A3F1394EDC5D64C0952064B7F4177EA
SHA-256:	9C9687E8C61B784D08F6D80853666FAA0884043CE7B99F4FB3676F3BC563C2F5
SHA-512:	33FC97AD5723E42C856E8797877E2CFB8A6AFB48718834DBC4EFC3407CF96499844910EFF60D60270F72ED288CA7C05552287283FF412F0901739EC9C19EF2D1
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 45%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... ...d..d..d....s.\|....F.i....r.^..m.[.g..m.K.b....g..d.......w.w....E.e..Richd..........PE..L....dTg.....................(.......@i...........@..........................pi...........@.................................M.$.a.....$.......................$..................................................................................... . ..$......h..................@....rsrc.........$......x..............@....idata ......$......z..............@... ..*...$......\|..............@...ipnqzgkg.....`O......~..............@...equqovlh.....0i......N..............@....taggant.0...@i.."...R..............@...................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1982464
Entropy (8bit):	7.935448466546174
Encrypted:	false
SSDEEP:	49152:hBaTNWc+BVUPcCQZBoJmnYUD/gSVvgU6PEzIK7iSqWykxb1SaTeoEUshsh:hBagBi0HBoJiDVBSEsKAhQYa1E6h
MD5:	08EFA0BF248584557641DC5DB156248E
SHA1:	8B64A7D0EA9AF4524E7BE713BA22AB0191528403
SHA-256:	15DF6347F76B4D0C86E07C4482E0B81B119265A4DD71F2C729C6BCC59E1CFA9B
SHA-512:	3880C4BB59D0A00BE445C3571EFB0FBCD679B982D86ED88574F51B788C917F943F10CD71A35AC4389F1B320F6947A15FEABD1A5D206BB7BE88E8C77990E89ADD
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 34%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........!J..@$..@$..@$......@$......@$......@$..._..@$..@%..@$......@$......@$......@$.Rich.@$.........PE..L......d..........................................@..........................@..............................................Z.B.n.....@.h!...................................................N...................................................... . ..@......T..................@....rsrc...h!....@......d..............@....idata ......B.....................@... ..).. B.....................@...mkxflzam. ....k.....................@...ntycqcrd............................@....taggant.0......."..................@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1895424
Entropy (8bit):	7.948081310283833
Encrypted:	false
SSDEEP:	49152:4Dkjoj13w8WgZENdIWFHmIy2LRwIi2CUMozodAh:4DjI/UWFHg2LRv1CUHoY
MD5:	52F0F216DFBB86683B1E318A0796DD81
SHA1:	2E2B8710E0A077ED8A2124FDE2486F397857B8F6
SHA-256:	1D95373C2284B657B614F07051EED5FED72F34F787350409E49E8DC30A5EA494
SHA-512:	BF3BFF59A42E2D10238306FE34F072C14BD482CAC5C20563987A27174BF304A06CFC9C0B3914254F17695D80B006261B29EA025E2B31324CA3CAEEDF3DA211CB
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 39%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....Ug..............................J...........@...........................K...........@.................................\@..p....0.......................A...................................................................................... . . .......B..................@....rsrc........0.......R..............@....idata .....@.......V..............@... ..+..P.......X..............@...xyjapqsh.p...`0..l...Z..............@...fjnsenoe......J.....................@....taggant.0....J.."..................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1799168
Entropy (8bit):	7.945638239226882
Encrypted:	false
SSDEEP:	49152:JHwIuVNz7KeE3qh5Mr1OeRw2iKZHZPQs23/kOWNY:NuT+ednCwI1ZH5Qs23x
MD5:	CBF2B84F9B993A77C0E2170CCCBACB7C
SHA1:	33FDF37B3A3F1394EDC5D64C0952064B7F4177EA
SHA-256:	9C9687E8C61B784D08F6D80853666FAA0884043CE7B99F4FB3676F3BC563C2F5
SHA-512:	33FC97AD5723E42C856E8797877E2CFB8A6AFB48718834DBC4EFC3407CF96499844910EFF60D60270F72ED288CA7C05552287283FF412F0901739EC9C19EF2D1
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 45%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... ...d..d..d....s.\|....F.i....r.^..m.[.g..m.K.b....g..d.......w.w....E.e..Richd..........PE..L....dTg.....................(.......@i...........@..........................pi...........@.................................M.$.a.....$.......................$..................................................................................... . ..$......h..................@....rsrc.........$......x..............@....idata ......$......z..............@... ..*...$......\|..............@...ipnqzgkg.....`O......~..............@...equqovlh.....0i......N..............@....taggant.0...@i.."...R..............@...................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	971776
Entropy (8bit):	6.706374744993215
Encrypted:	false
SSDEEP:	24576:LqDEvCTbMWu7rQYlBQcBiT6rprG8aTwV:LTvC/MTQYxsWR7aT
MD5:	5DD5F67D25C20DFF1AC926ABDC8C2EB0
SHA1:	E166D8E6544D137AE62FE204C59E53C962342703
SHA-256:	9661D8306B9BF658642A01718AC746113E19741A560A48A5583BACD52998AF22
SHA-512:	DB420ECBD8CFB63766D84BCFED8CD61147F5E6F99FC3EF95548A99CB615893CE47E554E1E94A6FDBCEEDC529973DC716CDB54BEE071D4FAC4FFAFFD056C22897
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 24%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L....\Wg.........."..........$......w.............@..........................0......<.....@...@.......@.....................d...\|....@...h.......................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc....h...@...j..................@..@.reloc...u.......v...^..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2895872
Entropy (8bit):	6.4258400887207126
Encrypted:	false
SSDEEP:	49152:zB4Yi9Rp4WR0viJeLgv+WRLr97P9XZiSdHSy1IJ:z2YyRp4WCaAkGahPVZRIJ
MD5:	6CFAA4B02B026AA1631EDA2E570A1298
SHA1:	28724AB39CD0F9F86C80C1F1FCEDCA8DDE14E77F
SHA-256:	2A68C5304DEEBB741759B134BE32D6C0F8E64DFBB8C06D9765E3035D3AF6CBFD
SHA-512:	06EEE70A62C5819CDE765C683382F0C53A3C4757D7387656D2E80B4FB36A3611E9B86E425FE6E0248B0F91860440FD1D77598C011C82CDCDEC0911EE4DB59BAE
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 45%
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$............,.. ...`....@.. ........................,.......,...`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...cdtvwakf..+.......+..:..............@...qjmihuav. ....,.......,.............@....taggant.@....,.."....,.............@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\Documents\BAKFCBFHJD.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3210240
Entropy (8bit):	6.6609161202022875
Encrypted:	false
SSDEEP:	49152:xiF3GbjN188C7PW+r5iGNWF79gUeKBlI3uv/zQKsE6d94/Ubd:xiF3UH8D7W+9iGNWhgBmi+vbpsjd94U
MD5:	F5DB9DCEA4098275CB46B5D6FE73CEF8
SHA1:	9B623E4CFFF93BFFBAF7034EBBF893773700BA94
SHA-256:	34959918550EF8A11FE8E0EF9DDE5F85F0DAC541E62A2CAD53998D4A0EB07D9D
SHA-512:	C68DDB34D1268D47F28F7B8E4ED7AC807B39424D09097AABC3274690D1F37BFC3615BDFB69ACEC1E8C08EEE0A3EBBAC6FCC99192441CF94AB4D7E14CB917B9C4
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................1...........@..........................01.....s.1...@.................................W...k...........................P.0...............................0..................................................... . ............................@....rsrc...............................@....idata ............................@...nnwaoodm.@......@.................@...ocwkoyql......0.......0.............@....taggant.0....1.."....0.............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\mozilla-temp-files\mozilla-temp-41

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ISO Media, MP4 Base Media v1 [ISO 14496-12:2003]
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.4593089050301797
Encrypted:	false
SSDEEP:	48:9SP0nUgwyZXYI65yFRX2D3GNTTfyn0Mk1iA:9SDKaIjo3UzyE1L
MD5:	D910AD167F0217587501FDCDB33CC544
SHA1:	2F57441CEFDC781011B53C1C5D29AC54835AFC1D
SHA-256:	E3699D9404A3FFC1AFF0CA8A3972DC0EF38BDAB927741E9F627C7C55CEA42E81
SHA-512:	F1871BF28FF25EE52BDB99C7A80AB715C7CAC164DCD2FD87E681168EE927FD2C5E80E03C91BB638D955A4627213BF575FF4D9EECAEDA7718C128CF2CE8F7CB3D
Malicious:	false
Preview:	... ftypisom....isomiso2avc1mp41....free....mdat..........E...H..,. .#..x264 - core 152 r2851 ba24899 - H.264/MPEG-4 AVC codec - Copyleft 2003-2017 - http://www.videolan.org/x264.html - options: cabac=1 ref=3 deblock=1:0:0 analyse=0x3:0x113 me=hex subme=7 psy=1 psy_rd=1.00:0.00 mixed_ref=1 me_range=16 chroma_me=1 trellis=1 8x8dct=1 cqm=0 deadzone=21,11 fast_pskip=1 chroma_qp_offset=-2 threads=4 lookahead_threads=1 sliced_threads=0 nr=0 decimate=1 interlaced=0 bluray_compat=0 constrained_intra=0 bframes=3 b_pyramid=2 b_adapt=1 b_bias=0 direct=1 weightb=1 open_gop=0 weightp=2 keyint=250 keyint_min=25 scenecut=40 intra_refresh=0 rc_lookahead=40 rc=crf mbtree=1 crf=23.0 qcomp=0.60 qpmin=0 qpmax=69 qpstep=4 ip_ratio=1.40 aq=1:1.00......e...+...s\|.kG3...'.u.."...,J.w.~.d\..(K....!.+..;....h....(.T.*...M......0..~L..8..B..A.y..R..,.zBP.';j.@.].w..........c......C=.'f....gI.$^.......m5V.L...{U..%V[....8......B..i..^,....:...,..5.m.%dA....moov...lmvhd...................(...........

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\compatibility.ini

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Windows WIN.INI
Category:	dropped
Size (bytes):	200
Entropy (8bit):	5.391255133360986
Encrypted:	false
SSDEEP:	3:tZAQUsjcmktYWwktUp/UNE2aT/P4WX1rDZjrEFwHQ3ZjrEFwslyy:JWtYWXtUp8babN1rDVEFycVEFL
MD5:	3FB561547A46AF02D6B00F86DC370634
SHA1:	914867E4C763611B441835A3FC0082359FBF7277
SHA-256:	5393F0E8D90EE6A26EAC13B81B83EDC0637487B3E427175021D7EC4CDE8E34A7
SHA-512:	0E05486A6B6AD65D3A95FCFE46BE6687DD47E311374F11DE89F9CFB8C301951D6BFE43FA24851A3E759B6F8AF69A5F593568FB61F576AB52941F6B2B6EE54BC8
Malicious:	false
Preview:	[Compatibility]..LastVersion=118.0.1_20230927232528/20230927232528..LastOSABI=WINNT_x86_64-msvc..LastPlatformDir=C:\Program Files\Mozilla Firefox..LastAppDir=C:\Program Files\Mozilla Firefox\browser..

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs-1.js

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	9865
Entropy (8bit):	5.530001022920119
Encrypted:	false
SSDEEP:	192:qnaRtZYbBp6ihj4qyaaX86KcfGNBw8rISl:degquDcwj0
MD5:	89E48DC70301B6046DB08C965BE017EA
SHA1:	3E2FB04E222CEDCBEDC0942B86DE5413218DF07D
SHA-256:	C83FFD272EC8696F9597F89456B728B9A5DFF6590A6AAAF167CEB94E6E467E40
SHA-512:	2FE0ADBAA36EB462194AABC82629453EC8A8C8069119F0154529A049C4ACD73D40358F0DC70CDF126EBDD2D0F02518C825DFA3D813796870106A7765A0CAD99A
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696333856);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	9865
Entropy (8bit):	5.530001022920119
Encrypted:	false
SSDEEP:	192:qnaRtZYbBp6ihj4qyaaX86KcfGNBw8rISl:degquDcwj0
MD5:	89E48DC70301B6046DB08C965BE017EA
SHA1:	3E2FB04E222CEDCBEDC0942B86DE5413218DF07D
SHA-256:	C83FFD272EC8696F9597F89456B728B9A5DFF6590A6AAAF167CEB94E6E467E40
SHA-512:	2FE0ADBAA36EB462194AABC82629453EC8A8C8069119F0154529A049C4ACD73D40358F0DC70CDF126EBDD2D0F02518C825DFA3D813796870106A7765A0CAD99A
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696333856);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionCheckpoints.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	53
Entropy (8bit):	4.136624295551173
Encrypted:	false
SSDEEP:	3:YVXKQJAyiVLQwJtJDBA+AY:Y9KQOy6Lb1BA+9
MD5:	EA8B62857DFDBD3D0BE7D7E4A954EC9A
SHA1:	B43BC4B3EA206A02EF8F63D5BFAD0C96BF2A3B2A
SHA-256:	792955295AE9C382986222C6731C5870BD0E921E7F7E34CC4615F5CD67F225DA
SHA-512:	076EE83534F42563046D25086166F82E1A3EC61840C113AEC67ABE2D8195DAA247D827D0C54E7E8F8A1BBF2D082A3763577587E84342EC160FF97905243E6D19
Malicious:	false
Preview:	{"profile-after-change":true,"final-ui-startup":true}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionCheckpoints.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	53
Entropy (8bit):	4.136624295551173
Encrypted:	false
SSDEEP:	3:YVXKQJAyiVLQwJtJDBA+AY:Y9KQOy6Lb1BA+9
MD5:	EA8B62857DFDBD3D0BE7D7E4A954EC9A
SHA1:	B43BC4B3EA206A02EF8F63D5BFAD0C96BF2A3B2A
SHA-256:	792955295AE9C382986222C6731C5870BD0E921E7F7E34CC4615F5CD67F225DA
SHA-512:	076EE83534F42563046D25086166F82E1A3EC61840C113AEC67ABE2D8195DAA247D827D0C54E7E8F8A1BBF2D082A3763577587E84342EC160FF97905243E6D19
Malicious:	false
Preview:	{"profile-after-change":true,"final-ui-startup":true}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage.sqlite

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite 3.x database, user version 131075, last written using SQLite version 3042000, page size 512, file counter 6, database pages 8, cookie 0x4, schema 4, UTF-8, version-valid-for 6
Category:	modified
Size (bytes):	4096
Entropy (8bit):	2.0836444556178684
Encrypted:	false
SSDEEP:	24:JBwdh/cEUcR9PzNFPFHx/GJRBdkOrDcRB1trwDeAq2gRMyxr3:jnEUo9LXtR+JdkOnohYsl
MD5:	8B40B1534FF0F4B533AF767EB5639A05
SHA1:	63EDB539EA39AD09D701A36B535C4C087AE08CC9
SHA-256:	AF275A19A5C2C682139266065D90C237282274D11C5619A121B7BDBDB252861B
SHA-512:	54AF707698CED33C206B1B193DA414D630901762E88E37E99885A50D4D5F8DDC28367C9B401DFE251CF0552B4FA446EE28F78A97C9096AFB0F2898BFBB673B53
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\BAKFCBFHJD.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3210240
Entropy (8bit):	6.6609161202022875
Encrypted:	false
SSDEEP:	49152:xiF3GbjN188C7PW+r5iGNWF79gUeKBlI3uv/zQKsE6d94/Ubd:xiF3UH8D7W+9iGNWhgBmi+vbpsjd94U
MD5:	F5DB9DCEA4098275CB46B5D6FE73CEF8
SHA1:	9B623E4CFFF93BFFBAF7034EBBF893773700BA94
SHA-256:	34959918550EF8A11FE8E0EF9DDE5F85F0DAC541E62A2CAD53998D4A0EB07D9D
SHA-512:	C68DDB34D1268D47F28F7B8E4ED7AC807B39424D09097AABC3274690D1F37BFC3615BDFB69ACEC1E8C08EEE0A3EBBAC6FCC99192441CF94AB4D7E14CB917B9C4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................1...........@..........................01.....s.1...@.................................W...k...........................P.0...............................0..................................................... . ............................@....rsrc...............................@....idata ............................@...nnwaoodm.@......@.................@...ocwkoyql......0.......0.............@....taggant.0....1.."....0.............@...........................................................................................................................................................................................................................................................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\Documents\BAKFCBFHJD.exe
File Type:	data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	3.434743904205613
Encrypted:	false
SSDEEP:	6:jJStXflNeRKUEZ+lX1CGdKUe6tPjgsW2YRZuy0lHQct0:af2RKQ1CGAFAjzvYRQVHQct0
MD5:	8D0CDF5AE530669BAEEEFF296E1D77C7
SHA1:	F8F2D66A827109E14CC95FAEEB5DB8BD054554B8
SHA-256:	68C23AEE6472B775A6BAFD8E45618FC4F542A7AEEE132DDA40D3AA9A738E8B78
SHA-512:	DC09B5B3BDD7908AA15774CBD771AECA35B774A9DF92FA6BC744682E78436EEF93F7B0587D58944BD098E3A3095B29FAE5E986A04173D5B92B66B46E252C9F48
Malicious:	false
Preview:	........7.)G.V.J..F.......<... .....s.......... ....................8.C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........J.O.N.E.S.-.P.C.\.j.o.n.e.s...................0.................$.@3P.........................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.945638239226882
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'799'168 bytes
MD5:	cbf2b84f9b993a77c0e2170cccbacb7c
SHA1:	33fdf37b3a3f1394edc5d64c0952064b7f4177ea
SHA256:	9c9687e8c61b784d08f6d80853666faa0884043ce7b99f4fb3676f3bc563c2f5
SHA512:	33fc97ad5723e42c856e8797877e2cfb8a6afb48718834dbc4efc3407cf96499844910eff60d60270f72ed288ca7c05552287283ff412f0901739ec9c19ef2d1
SSDEEP:	49152:JHwIuVNz7KeE3qh5Mr1OeRw2iKZHZPQs23/kOWNY:NuT+ednCwI1ZH5Qs23x
TLSH:	D58533F93AEBEE7AF70818F2F9EC03402647EFA63B5DBE042D44036E445692F6105852
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... ...d...d...d.....s.\|.....F.i.....r.^...m.[.g...m.K.b.......g...d.........w.w.....E.e...Richd...........PE..L....dTg...........

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0xa94000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x67546419 [Sat Dec 7 15:04:57 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F06B8DC7D8Ah
rsqrtps xmm3, dqword ptr [ebx]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [esi], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, 0Ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, 0Ah
add byte ptr [eax], al
add ecx, dword ptr [edx]
add byte ptr [eax], al
add eax, 0100000Ah
or al, byte ptr [eax]
add byte ptr [edx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x24b04d	0x61	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x24a000	0x1ac	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x24b1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x249000	0x16800	90b21ed94ba4b61afdfe81bea9ecabbc	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x24a000	0x1ac	0x200	c363f93b31dd6fccd7ba0e162f3188ba	False	0.583984375	data	4.552211881022042	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x24b000	0x1000	0x200	0d0399d83a742d5d86c5718841e8e842	False	0.134765625	data	0.8646718654202081	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x24c000	0x2aa000	0x200	f5aa4fc608c3537f26da83d99bb1a67b	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
ipnqzgkg	0x4f6000	0x19d000	0x19d000	a8e6674506ca63c152ed756fbe187f15	False	0.9949173823395884	data	7.954190185075461	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
equqovlh	0x693000	0x1000	0x400	7f35c7b63ef9f697270e1315e7fd97d5	False	0.7578125	data	6.0207563167447	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x694000	0x3000	0x2200	9e4db1812aa38e6d3f58a1e6c353badf	False	0.06341911764705882	DOS executable (COM)	0.7868469898185461	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x692ce8	0x152	ASCII text, with CRLF line terminators			0.6479289940828402

Imports

DLL	Import
kernel32.dll	lstrcpy

Target ID:	0
Start time:	16:34:54
Start date:	09/12/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xfb0000
File size:	1'799'168 bytes
MD5 hash:	CBF2B84F9B993A77C0E2170CCCBACB7C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.1658639876.0000000005220000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2107422140.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2107233640.0000000000DFE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	16:35:05
Start date:	09/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	16:35:06
Start date:	09/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2588 --field-trial-handle=2076,i,11101187424602966218,1363370709843346949,262144 /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	16:35:38
Start date:	09/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\BAKFCBFHJD.exe"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	16:35:38
Start date:	09/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	16:35:38
Start date:	09/12/2024
Path:	C:\Users\user\Documents\BAKFCBFHJD.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Documents\BAKFCBFHJD.exe"
Imagebase:	0x480000
File size:	3'210'240 bytes
MD5 hash:	F5DB9DCEA4098275CB46B5D6FE73CEF8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000009.00000002.2153108799.0000000000481000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	16:35:42
Start date:	09/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0xf40000
File size:	3'210'240 bytes
MD5 hash:	F5DB9DCEA4098275CB46B5D6FE73CEF8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000A.00000002.2198230771.0000000000F41000.00000040.00000001.01000000.0000000D.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	16:35:43
Start date:	09/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xf40000
File size:	3'210'240 bytes
MD5 hash:	F5DB9DCEA4098275CB46B5D6FE73CEF8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000B.00000002.2199343337.0000000000F41000.00000040.00000001.01000000.0000000D.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	16:36:00
Start date:	09/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xf40000
File size:	3'210'240 bytes
MD5 hash:	F5DB9DCEA4098275CB46B5D6FE73CEF8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	16:36:13
Start date:	09/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1013530001\a17088d8c7.exe"
Imagebase:	0x400000
File size:	1'982'464 bytes
MD5 hash:	08EFA0BF248584557641DC5DB156248E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 34%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	16:36:22
Start date:	09/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe"
Imagebase:	0x460000
File size:	1'895'424 bytes
MD5 hash:	52F0F216DFBB86683B1E318A0796DD81
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000F.00000003.2681081649.0000000001018000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000F.00000003.2680221886.0000000001018000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000F.00000003.2673800698.0000000001018000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000F.00000003.2646499229.0000000001011000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000F.00000003.2678578144.0000000001018000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000F.00000003.2673028661.0000000001017000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000F.00000003.2675427284.0000000001018000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000F.00000003.2682030732.000000000101F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000F.00000003.2678009352.0000000001018000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000F.00000003.2680574921.0000000001018000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000F.00000003.2678906552.0000000001018000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000F.00000003.2681445195.0000000001018000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000F.00000003.2679263353.0000000001018000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000F.00000003.2675179858.0000000001018000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000F.00000003.2679554542.0000000001018000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000F.00000003.2678083034.0000000001018000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000F.00000003.2678456559.0000000001018000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000F.00000003.2678381424.0000000001018000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000F.00000003.2680795575.0000000001018000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000F.00000003.2680339133.0000000001018000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000F.00000003.2679363395.0000000001018000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000F.00000003.2646636082.0000000001017000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000F.00000003.2679980400.0000000001018000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000F.00000003.2673739066.0000000001018000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000F.00000003.2680696251.0000000001018000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000F.00000003.2680117370.0000000001018000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000F.00000003.2674348099.0000000001018000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000F.00000003.2672861730.0000000001011000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000F.00000003.2678514734.0000000001018000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000F.00000003.2679869482.0000000001018000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000F.00000003.2677615654.0000000001018000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000F.00000003.2622538163.0000000001019000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000F.00000003.2678714450.0000000001018000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000F.00000003.2679680520.0000000001018000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000F.00000003.2677513754.0000000001018000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000F.00000003.2678158093.0000000001018000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000F.00000003.2646669500.0000000001019000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000F.00000003.2674962634.0000000001018000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000F.00000003.2673677963.0000000001018000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000F.00000003.2589686211.000000000100F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000F.00000003.2673586366.0000000001018000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000F.00000003.2675285735.0000000001018000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000F.00000003.2679462403.0000000001018000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000F.00000003.2679006727.0000000001018000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000F.00000003.2679087482.0000000001018000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000F.00000003.2678304397.0000000001018000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000F.00000003.2680932860.0000000001018000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000F.00000003.2673513530.0000000001018000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000F.00000003.2678818521.0000000001018000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000F.00000003.2616118705.0000000001012000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 39%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	16:36:30
Start date:	09/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe"
Imagebase:	0xdb0000
File size:	1'799'168 bytes
MD5 hash:	CBF2B84F9B993A77C0E2170CCCBACB7C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000010.00000003.2629217512.00000000050B0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000010.00000002.2681962698.000000000155E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000010.00000002.2679338417.0000000000DB1000.00000040.00000001.01000000.00000010.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 45%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	16:36:35
Start date:	09/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe"
Imagebase:	0x460000
File size:	1'895'424 bytes
MD5 hash:	52F0F216DFBB86683B1E318A0796DD81
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000011.00000003.2809295731.00000000011E3000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000011.00000003.2713156874.00000000011D8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000011.00000003.2803779137.00000000011DC000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000011.00000003.2809371493.00000000011F2000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000011.00000003.2803011829.00000000011D8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000011.00000003.2771485025.00000000011DD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000011.00000003.2742195555.00000000011D8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000011.00000003.2742444167.00000000011DB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000011.00000003.2809334415.00000000011EA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000011.00000003.2770447800.00000000011D8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000011.00000003.2713492473.00000000011D9000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000011.00000003.2814773574.00000000011F3000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000011.00000003.2776788243.00000000011DD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000011.00000003.2771976922.00000000011DD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000011.00000003.2775962014.00000000011DD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	16:36:38
Start date:	09/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe"
Imagebase:	0x820000
File size:	971'776 bytes
MD5 hash:	5DD5F67D25C20DFF1AC926ABDC8C2EB0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 24%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	16:36:40
Start date:	09/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM firefox.exe /T
Imagebase:	0xc40000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	16:36:40
Start date:	09/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	16:36:43
Start date:	09/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM chrome.exe /T
Imagebase:	0xc40000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	16:36:43
Start date:	09/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	16:36:43
Start date:	09/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM msedge.exe /T
Imagebase:	0xc40000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	16:36:43
Start date:	09/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	16:36:43
Start date:	09/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe"
Imagebase:	0xdb0000
File size:	1'799'168 bytes
MD5 hash:	CBF2B84F9B993A77C0E2170CCCBACB7C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000019.00000002.2848099754.0000000000DB1000.00000040.00000001.01000000.00000010.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000019.00000002.2861247425.0000000001A6B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000019.00000003.2757599430.00000000056A0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	16:36:44
Start date:	09/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM opera.exe /T
Imagebase:	0xc40000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	16:36:44
Start date:	09/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	16:36:44
Start date:	09/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM brave.exe /T
Imagebase:	0xc40000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	16:36:44
Start date:	09/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	16:36:46
Start date:	09/12/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	16:36:46
Start date:	09/12/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	16:36:47
Start date:	09/12/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	16:36:49
Start date:	09/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1013534001\9f6ad733e2.exe"
Imagebase:	0xef0000
File size:	2'895'872 bytes
MD5 hash:	6CFAA4B02B026AA1631EDA2E570A1298
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 45%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	16:36:49
Start date:	09/12/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2272 -parentBuildID 20230927232528 -prefsHandle 2196 -prefMapHandle 2176 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0e2b88bc-fb1b-4ee6-b399-2d0b61fdaa7d} 7196 "\\.\pipe\gecko-crash-server-pipe.7196" 17cc9869f10 socket
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	16:36:52
Start date:	09/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1013533001\18d00389b3.exe"
Imagebase:	0x820000
File size:	971'776 bytes
MD5 hash:	5DD5F67D25C20DFF1AC926ABDC8C2EB0
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	36
Start time:	16:36:57
Start date:	09/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM firefox.exe /T
Imagebase:	0xc40000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	16:36:57
Start date:	09/12/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4500 -parentBuildID 20230927232528 -prefsHandle 4492 -prefMapHandle 4488 -prefsLen 26374 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {91de2f66-b71a-414e-a97d-01546071d5ac} 7196 "\\.\pipe\gecko-crash-server-pipe.7196" 17cc987e310 rdd
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	16:36:57
Start date:	09/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	16:37:00
Start date:	09/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe"
Imagebase:	0x460000
File size:	1'895'424 bytes
MD5 hash:	52F0F216DFBB86683B1E318A0796DD81
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	40
Start time:	16:37:06
Start date:	09/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM chrome.exe /T
Imagebase:	0xc40000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	16:37:06
Start date:	09/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	16:37:07
Start date:	09/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM msedge.exe /T
Imagebase:	0xc40000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	16:37:07
Start date:	09/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	16:37:07
Start date:	09/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM opera.exe /T
Imagebase:	0xc40000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	16:37:07
Start date:	09/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	16:37:08
Start date:	09/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM brave.exe /T
Imagebase:	0xc40000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	16:37:08
Start date:	09/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	16:37:09
Start date:	09/12/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	16:37:09
Start date:	09/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1013532001\f377015f96.exe"
Imagebase:	0xdb0000
File size:	1'799'168 bytes
MD5 hash:	CBF2B84F9B993A77C0E2170CCCBACB7C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000031.00000002.3117979567.0000000000DB1000.00000040.00000001.01000000.00000010.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000031.00000003.3020544677.0000000004B00000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000031.00000002.3112834532.000000000068B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	16:37:09
Start date:	09/12/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	51
Start time:	16:37:12
Start date:	09/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=f039f524ee.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	52
Start time:	16:37:13
Start date:	09/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2448 --field-trial-handle=2280,i,510515106440553161,2480043565169282240,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	53
Start time:	16:37:14
Start date:	09/12/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2320 -parentBuildID 20230927232528 -prefsHandle 2264 -prefMapHandle 2260 -prefsLen 25359 -prefMapSize 238769 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2b17f485-0e86-472e-88cf-afe23e104bea} 280 "\\.\pipe\gecko-crash-server-pipe.280" 234f4b6a910 socket
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	54
Start time:	16:37:16
Start date:	09/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=f039f524ee.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	55
Start time:	16:37:16
Start date:	09/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM firefox.exe /T
Imagebase:	0xc40000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	56
Start time:	16:37:16
Start date:	09/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2084 --field-trial-handle=1932,i,2083666299261817870,13908559142850350553,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	57
Start time:	16:37:16
Start date:	09/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	58
Start time:	16:37:18
Start date:	09/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1013531001\f039f524ee.exe"
Imagebase:	0x460000
File size:	1'895'424 bytes
MD5 hash:	52F0F216DFBB86683B1E318A0796DD81
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	59
Start time:	16:37:20
Start date:	09/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=f039f524ee.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	60
Start time:	16:37:21
Start date:	09/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1956 --field-trial-handle=1860,i,10040747374664479283,16727769951129841397,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	61
Start time:	16:37:25
Start date:	09/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM chrome.exe /T
Imagebase:	0xc40000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	62
Start time:	16:37:25
Start date:	09/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	63
Start time:	16:37:26
Start date:	09/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=f039f524ee.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	0.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	29.2%
Total number of Nodes:	113
Total number of Limit Nodes:	13

Executed Functions

Function 6C4535A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6C4DF688,00001000), ref: 6C4535D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C4535E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6C4535FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C45363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C45369F
__aulldiv.LIBCMT ref: 6C4536E4
QueryPerformanceCounter.KERNEL32(?), ref: 6C453773
EnterCriticalSection.KERNEL32(6C4DF688), ref: 6C45377E
LeaveCriticalSection.KERNEL32(6C4DF688), ref: 6C4537BD
QueryPerformanceCounter.KERNEL32(?), ref: 6C4537C4
EnterCriticalSection.KERNEL32(6C4DF688), ref: 6C4537CB
LeaveCriticalSection.KERNEL32(6C4DF688), ref: 6C453801
__aulldiv.LIBCMT ref: 6C453883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6C453902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6C453918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6C45394C

Strings

GTC, xrefs: 6C453912
AuthcAMDenti, xrefs: 6C453946
GenuntelineI, xrefs: 6C453639
QPC, xrefs: 6C4538FC
MOZ_TIMESTAMP_MODE, xrefs: 6C4535DB

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: 2943a2f0a32fe47d86419aaa762f4d7c961f764a44fb1fd46916d5ede9124b05
Instruction ID: df6a2d4568c3332d8bbb7da6f740b2a876b5b7b5ab1f7bf90f2f7e34adec924a
Opcode Fuzzy Hash: 2943a2f0a32fe47d86419aaa762f4d7c961f764a44fb1fd46916d5ede9124b05
Instruction Fuzzy Hash: 14B180B1B053109FDB18FF28C854F1ABBF5AB8A704F45892EF899D7790D770A9018B91

Function 6C46C930 Relevance: 7.6, APIs: 5, Instructions: 83
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?), ref: 6C46C947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6C46C969
GetSystemInfo.KERNEL32(?), ref: 6C46C9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6C46C9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6C46C9E2

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: 696d6c0763dfa147f2ffb5b66998b4de2897699f6f55e33ebc377f07a6f895e3
Instruction ID: a020fc41bf4c04f465dbb56e9f46afa55e57ffe28e7400a0bb5f07d91e09ed1f
Opcode Fuzzy Hash: 696d6c0763dfa147f2ffb5b66998b4de2897699f6f55e33ebc377f07a6f895e3
Instruction Fuzzy Hash: 3921C231742614ABDF15FA65DC84FAE72BAAB46744F50051EF903E7B84DB60A80887A1

Function 6C453060 Relevance: 4.5, APIs: 3, Instructions: 36
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6C453095

Part of subcall function 6C4535A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6C4DF688,00001000), ref: 6C4535D5
Part of subcall function 6C4535A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C4535E0
Part of subcall function 6C4535A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6C4535FD
Part of subcall function 6C4535A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C45363F
Part of subcall function 6C4535A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C45369F
Part of subcall function 6C4535A0: __aulldiv.LIBCMT ref: 6C4536E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C45309F

Part of subcall function 6C475B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C4756EE,?,00000001), ref: 6C475B85
Part of subcall function 6C475B50: EnterCriticalSection.KERNEL32(6C4DF688,?,?,?,6C4756EE,?,00000001), ref: 6C475B90
Part of subcall function 6C475B50: LeaveCriticalSection.KERNEL32(6C4DF688,?,?,?,6C4756EE,?,00000001), ref: 6C475BD8
Part of subcall function 6C475B50: GetTickCount64.KERNEL32 ref: 6C475BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6C4530BE

Part of subcall function 6C4530F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6C453127
Part of subcall function 6C4530F0: __aulldiv.LIBCMT ref: 6C453140

Part of subcall function 6C48AB2A: __onexit.LIBCMT ref: 6C48AB30

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: 45ac4b3f0566ebb045ede21f0ab2e1fc26bc5761dbe4e5b231a54ea7e154afb0
Instruction ID: 4f74803f7fc0278b914009d0aca87902931083eb99ccd2f5c3dc0beb46b6f262
Opcode Fuzzy Hash: 45ac4b3f0566ebb045ede21f0ab2e1fc26bc5761dbe4e5b231a54ea7e154afb0
Instruction Fuzzy Hash: 72F0D612E2674896DA20FF748841AE6B770AF6B118B54931DF84467A61FB2071D9C3D1

Non-executed Functions

Function 6C465440 Relevance: 138.8, APIs: 54, Strings: 25, Instructions: 587
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C465492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C4654A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C4654BE
__Init_thread_footer.LIBCMT ref: 6C4654DB

Part of subcall function 6C48AB3F: EnterCriticalSection.KERNEL32(6C4DE370,?,?,6C453527,6C4DF6CC,?,?,?,?,?,?,?,?,6C453284), ref: 6C48AB49
Part of subcall function 6C48AB3F: LeaveCriticalSection.KERNEL32(6C4DE370,?,6C453527,6C4DF6CC,?,?,?,?,?,?,?,?,6C453284,?,?,6C4756F6), ref: 6C48AB7C

Part of subcall function 6C48CBE8: GetCurrentProcess.KERNEL32(?,6C4531A7), ref: 6C48CBF1
Part of subcall function 6C48CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C4531A7), ref: 6C48CBFA

GetCurrentThreadId.KERNEL32 ref: 6C4654F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6C465516
GetCurrentThreadId.KERNEL32 ref: 6C46556A
AcquireSRWLockExclusive.KERNEL32(6C4DF4B8), ref: 6C465577
moz_xmalloc.MOZGLUE(00000070), ref: 6C465585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6C465590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6C4655E6
ReleaseSRWLockExclusive.KERNEL32(6C4DF4B8), ref: 6C465606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C465616

Part of subcall function 6C48AB89: EnterCriticalSection.KERNEL32(6C4DE370,?,?,?,6C4534DE,6C4DF6CC,?,?,?,?,?,?,?,6C453284), ref: 6C48AB94
Part of subcall function 6C48AB89: LeaveCriticalSection.KERNEL32(6C4DE370,?,6C4534DE,6C4DF6CC,?,?,?,?,?,?,?,6C453284,?,?,6C4756F6), ref: 6C48ABD1

GetCurrentThreadId.KERNEL32 ref: 6C46563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C465646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6C46567C
free.MOZGLUE(?), ref: 6C4656AE

Part of subcall function 6C475E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C475EDB
Part of subcall function 6C475E90: memset.VCRUNTIME140(ewKl,000000E5,?), ref: 6C475F27
Part of subcall function 6C475E90: LeaveCriticalSection.KERNEL32(?), ref: 6C475FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6C4656E8
GetCurrentThreadId.KERNEL32 ref: 6C465707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6C46570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6C465729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6C46574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6C46576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6C465796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6C4657B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6C4657CA

Strings

MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C465766
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C465791
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C465724
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6C465C56
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C4654A3
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6C4657AE
[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6C465BBE
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6C465717
[I %d/%d] profiler_init, xrefs: 6C46564E
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6C465B38
MOZ_BASE_PROFILER_HELP, xrefs: 6C465511
- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6C465D2B
GeckoMain, xrefs: 6C465554, 6C4655D5
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6C465CF9
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C4654B9
- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6C465D1C
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6C46584E
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C4657C5
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6C465AC9
- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6C465D24
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6C465749
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C46548D
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6C4656E3
MOZ_PROFILER_STARTUP, xrefs: 6C4655E1
- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6C465D01

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init
API String ID: 3686969729-1266492768
Opcode ID: 472872d830e22d1345be7f7614ac6370351fed8b242baf28758b50a940630914
Instruction ID: 4d36e9bfb2a0299a18bff601612a0e6a816fa27a8499ccf4ca7294128d34e4b3
Opcode Fuzzy Hash: 472872d830e22d1345be7f7614ac6370351fed8b242baf28758b50a940630914
Instruction Fuzzy Hash: 22220270A043409FEB01FF668858F5ABBB5AF4634DF04462DE84A87F46EB31E444CA93

Function 6C49B820 Relevance: 102.6, APIs: 56, Strings: 2, Instructions: 1128
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 6C49B845
AcquireSRWLockExclusive.KERNEL32(6C4DF4B8,?,?,00000000), ref: 6C49B852
ReleaseSRWLockExclusive.KERNEL32(6C4DF4B8), ref: 6C49B884
InitializeConditionVariable.KERNEL32(?), ref: 6C49B8D2
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?), ref: 6C49B9FD
GetCurrentThreadId.KERNEL32 ref: 6C49BA05
AcquireSRWLockExclusive.KERNEL32(6C4DF4B8,?,?,00000000), ref: 6C49BA12
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,00000000), ref: 6C49BA27
ReleaseSRWLockExclusive.KERNEL32(6C4DF4B8), ref: 6C49BA4B
free.MOZGLUE(?), ref: 6C49C9C7
free.MOZGLUE(?), ref: 6C49C9DC

Strings

[I %d/%d] Stack sample too big for profiler storage, needed %u bytes, xrefs: 6C49C878
[I %d/%d] Stack sample too big for local storage, needed %u bytes, xrefs: 6C49C7DA

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentNow@ReleaseStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID: [I %d/%d] Stack sample too big for local storage, needed %u bytes$[I %d/%d] Stack sample too big for profiler storage, needed %u bytes
API String ID: 656605770-2789026554
Opcode ID: 2c3c82222fc2a0f9dcbe17c42983aea569c3e31cef3b97f1aae6497f3db6aeda
Instruction ID: 555a7c44d766f5468f058679df575e479636efcaa592b41af74661247d6916f3
Opcode Fuzzy Hash: 2c3c82222fc2a0f9dcbe17c42983aea569c3e31cef3b97f1aae6497f3db6aeda
Instruction Fuzzy Hash: 17A28D71A083908FD725DF28C490F9BBBE5BFC9314F154A2DE89997350DB70A905CB92

Function 6C466C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727
encryptionfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C466CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C466D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6C466D26

Part of subcall function 6C46CA10: malloc.MOZGLUE(?), ref: 6C46CA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6C466D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C466D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6C466D73
free.MOZGLUE(00000000), ref: 6C466D80
CertGetNameStringW.CRYPT32 ref: 6C466DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6C466DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C466DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6C466DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6C466E10
CryptMsgClose.CRYPT32(00000000), ref: 6C466E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6C466E34
CreateFileW.KERNEL32 ref: 6C466EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6C466F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C466F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6C46709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C467103
free.MOZGLUE(00000000), ref: 6C467153
CloseHandle.KERNEL32(?), ref: 6C467176
__Init_thread_footer.LIBCMT ref: 6C467209
__Init_thread_footer.LIBCMT ref: 6C46723A
__Init_thread_footer.LIBCMT ref: 6C46726B
__Init_thread_footer.LIBCMT ref: 6C46729C
__Init_thread_footer.LIBCMT ref: 6C4672DC
__Init_thread_footer.LIBCMT ref: 6C46730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C4673C2
VerSetConditionMask.NTDLL ref: 6C4673F3
VerSetConditionMask.NTDLL ref: 6C4673FF
VerSetConditionMask.NTDLL ref: 6C467406
VerSetConditionMask.NTDLL ref: 6C46740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C46741A
moz_xmalloc.MOZGLUE(?), ref: 6C46755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C467568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6C467585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C467598
free.MOZGLUE(00000000), ref: 6C4675AC

Part of subcall function 6C48AB89: EnterCriticalSection.KERNEL32(6C4DE370,?,?,?,6C4534DE,6C4DF6CC,?,?,?,?,?,?,?,6C453284), ref: 6C48AB94
Part of subcall function 6C48AB89: LeaveCriticalSection.KERNEL32(6C4DE370,?,6C4534DE,6C4DF6CC,?,?,?,?,?,?,?,6C453284,?,?,6C4756F6), ref: 6C48ABD1

Strings

(, xrefs: 6C46768A
SHA256, xrefs: 6C466EC0
wintrust.dll, xrefs: 6C4672CD
CryptCATAdminReleaseCatalogContext, xrefs: 6C4672C8

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: 99c9d6e9a0b30ea1fd567da44d0df2b989b745c9ca5adb726bee966f378b7773
Instruction ID: b799e4398ba7ec1795907a789c29a5cbf181074f78e24ba04db964826edabf1b
Opcode Fuzzy Hash: 99c9d6e9a0b30ea1fd567da44d0df2b989b745c9ca5adb726bee966f378b7773
Instruction Fuzzy Hash: C852C3B1A052149BEB21EF25CC84FAA77B8EF45708F104199E909A7B40DB70BF85CF91

Function 6C486FF0 Relevance: 89.1, APIs: 39, Strings: 10, Instructions: 3347COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C4DE7DC), ref: 6C487019
LeaveCriticalSection.KERNEL32(6C4DE7DC), ref: 6C487061
EnterCriticalSection.KERNEL32(?), ref: 6C4871A4
LeaveCriticalSection.KERNEL32(?), ref: 6C48721D
memcpy.VCRUNTIME140(?,?,?), ref: 6C48723E
EnterCriticalSection.KERNEL32(?), ref: 6C48726C
memset.VCRUNTIME140(?,000000E5,000000FF), ref: 6C4872B2
LeaveCriticalSection.KERNEL32(?), ref: 6C48733F
EnterCriticalSection.KERNEL32(0000000C), ref: 6C4873E8
LeaveCriticalSection.KERNEL32(?), ref: 6C48961C
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C489622
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C489642
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C48964F
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C4896CE
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C4896DB
AcquireSRWLockExclusive.KERNEL32(6C4DE804), ref: 6C489747
GetSystemInfo.KERNEL32(?), ref: 6C489792
__Init_thread_footer.LIBCMT ref: 6C4897A5
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C4DE810,00000040), ref: 6C4897CF
InitializeCriticalSectionAndSpinCount.KERNEL32(6C4DE7B8,00001388), ref: 6C489838
InitializeCriticalSectionAndSpinCount.KERNEL32(6C4DE744,00001388), ref: 6C48984E
InitializeCriticalSectionAndSpinCount.KERNEL32(6C4DE784,00001388), ref: 6C489874
InitializeCriticalSectionAndSpinCount.KERNEL32(6C4DE7DC,00001388), ref: 6C489895

Strings

MALLOC_OPTIONS, xrefs: 6C4897CA
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C4899D2
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C4899BD
<jemalloc>, xrefs: 6C489B33, 6C489BE3
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C489933, 6C489A33, 6C489A4E
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C4899A8
MOZ_CRASH(), xrefs: 6C489B42
Compile-time page size does not divide the runtime one., xrefs: 6C489B38
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C489993
: (malloc) Unsupported character in malloc options: ', xrefs: 6C489BF4

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: CriticalSection$CountEnterInitializeK@1@LeaveMaybe@_RandomSpinUint64@mozilla@@$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable_errnomemcpymemset
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 4047164644-4173974723
Opcode ID: 6e77ba53348d65b4c4404bbf5b23681b285f0cadb83ebc4e7c13c3ebac17225c
Instruction ID: ad42e1ec5d03e0d42b91e1de87c31443c08842ecf710eae668d5d8ab4e3d7f1b
Opcode Fuzzy Hash: 6e77ba53348d65b4c4404bbf5b23681b285f0cadb83ebc4e7c13c3ebac17225c
Instruction Fuzzy Hash: 2B537E71A0A7018FD704CF28C590E15FBE1BF8A328F29C66DE9699B791D771E841CB81

Function 6C490DD0 Relevance: 83.9, APIs: 36, Strings: 10, Instructions: 3368COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C490F1F
LeaveCriticalSection.KERNEL32(?), ref: 6C490F99
memcpy.VCRUNTIME140(?,?,?), ref: 6C490FB7
EnterCriticalSection.KERNEL32(?), ref: 6C490FE9
memset.VCRUNTIME140(?,000000E5,00000000), ref: 6C491031
LeaveCriticalSection.KERNEL32(?), ref: 6C4910D0
EnterCriticalSection.KERNEL32(?), ref: 6C49117D
memset.VCRUNTIME140(?,000000E5,?), ref: 6C491C39
EnterCriticalSection.KERNEL32(6C4DE744), ref: 6C493391
LeaveCriticalSection.KERNEL32(6C4DE744), ref: 6C4933CD
LeaveCriticalSection.KERNEL32(?), ref: 6C493431
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C493437

Strings

MALLOC_OPTIONS, xrefs: 6C4935FE
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C4937D2
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C4937BD
<jemalloc>, xrefs: 6C493941, 6C4939F1
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C493559, 6C49382D, 6C493848
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C4937A8
MOZ_CRASH(), xrefs: 6C493950
Compile-time page size does not divide the runtime one., xrefs: 6C493946
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C493793
: (malloc) Unsupported character in malloc options: ', xrefs: 6C493A02

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset$_errnomemcpy
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3040639385-4173974723
Opcode ID: a1823dbdd26944a334b6905c8fce5ff7b00c08b6570d30cc4d09df9e0b124e99
Instruction ID: bd1397d09428a8b6115358af4e5c3a47540cba8e99aede689a76e3a84d7c51d8
Opcode Fuzzy Hash: a1823dbdd26944a334b6905c8fce5ff7b00c08b6570d30cc4d09df9e0b124e99
Instruction Fuzzy Hash: E5537A71A056218FD714CF28C580F15FBE1BF8A328F29C66DE8699B791D771E842CB81

Function 6C4B55F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(user32,?,6C48E1A5), ref: 6C4B5606
LoadLibraryW.KERNEL32(gdi32,?,6C48E1A5), ref: 6C4B560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6C4B5633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6C4B563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6C4B566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6C4B567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6C4B5696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6C4B56B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6C4B56CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6C4B56E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6C4B56FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6C4B5716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6C4B572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6C4B5748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6C4B5761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6C4B577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6C4B5793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6C4B57A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6C4B57BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6C4B57D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6C4B57EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6C4B57FF

Strings

GetThreadDpiAwarenessContext, xrefs: 6C4B562D
CreateWindowExW, xrefs: 6C4B56C5
user32, xrefs: 6C4B5601
GetDpiForWindow, xrefs: 6C4B5690
DeleteObject, xrefs: 6C4B57F9
gdi32, xrefs: 6C4B560A
EnableNonClientDpiScaling, xrefs: 6C4B5666
ReleaseDC, xrefs: 6C4B5742
LoadCursorW, xrefs: 6C4B5774
StretchDIBits, xrefs: 6C4B57CC
GetMonitorInfoW, xrefs: 6C4B57A2
CreateSolidBrush, xrefs: 6C4B57E4
SetWindowPos, xrefs: 6C4B56F7
RegisterClassW, xrefs: 6C4B56AC
SetWindowLongPtrW, xrefs: 6C4B57B7
AreDpiAwarenessContextsEqual, xrefs: 6C4B5637
FillRect, xrefs: 6C4B5729
ShowWindow, xrefs: 6C4B56DE
GetWindowDC, xrefs: 6C4B5710
MonitorFromWindow, xrefs: 6C4B578D
LoadIconW, xrefs: 6C4B575B
GetSystemMetricsForDpi, xrefs: 6C4B5677

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: 2785b88ac334fb17843ebb4b01b0f0a07d38d623a0999fd9e888dd0c3efbe0af
Instruction ID: 9505718fa0315274826047b46cc520baf90d3076eb97c595318e0a7266bf6069
Opcode Fuzzy Hash: 2785b88ac334fb17843ebb4b01b0f0a07d38d623a0999fd9e888dd0c3efbe0af
Instruction Fuzzy Hash: 7C5142747127439BEB00FF358D64E2A7AB8AB0A6567114925A911E3B52EFB4E810CF70

Function 6C4B34A0 Relevance: 61.0, APIs: 33, Strings: 1, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C4B3527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C4B355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C4B35BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C4B35E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C4B363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C4B3693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C4B36CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C4B3703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C4B373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C4B3775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C4B378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C4B3892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C4B38BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C4B3902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C4B3939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C4B3970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C4B39EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C4B3A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C4B3AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C4B3E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C4B3EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C4B3EE2

Part of subcall function 6C4B6180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6C4B61DD
Part of subcall function 6C4B6180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6C4B622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C4B40F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C4B412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C4B4157

Part of subcall function 6C4B6180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C4B6250
Part of subcall function 6C4B6180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C4B6292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C4B441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C4B4448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C4B484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C4B4863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C4B4878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C4B4896
free.MOZGLUE ref: 6C4B489F

Strings

, xrefs: 6C4B4CD2

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID:
API String ID: 3842999660-3916222277
Opcode ID: 94557201c3e191c1e5d184677d5e8f5fbcfde9ac1af61159e52bc07338ecae07
Instruction ID: 47403c9b11c08fca5ca84cc85e3ca98794ec24c94ddd65c38c12e6d84500284d
Opcode Fuzzy Hash: 94557201c3e191c1e5d184677d5e8f5fbcfde9ac1af61159e52bc07338ecae07
Instruction Fuzzy Hash: 63F24D74908B808FC735DF28C084A9AFBF1FF89354F158A5ED99997721DB319886CB42

Function 6C49F070 Relevance: 59.9, APIs: 30, Strings: 4, Instructions: 412threadtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C49F09B

Part of subcall function 6C475B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C4756EE,?,00000001), ref: 6C475B85
Part of subcall function 6C475B50: EnterCriticalSection.KERNEL32(6C4DF688,?,?,?,6C4756EE,?,00000001), ref: 6C475B90
Part of subcall function 6C475B50: LeaveCriticalSection.KERNEL32(6C4DF688,?,?,?,6C4756EE,?,00000001), ref: 6C475BD8
Part of subcall function 6C475B50: GetTickCount64.KERNEL32 ref: 6C475BE4

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C49F0AC

Part of subcall function 6C475C50: GetTickCount64.KERNEL32 ref: 6C475D40
Part of subcall function 6C475C50: EnterCriticalSection.KERNEL32(6C4DF688), ref: 6C475D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C49F0BE

Part of subcall function 6C475C50: __aulldiv.LIBCMT ref: 6C475DB4
Part of subcall function 6C475C50: LeaveCriticalSection.KERNEL32(6C4DF688), ref: 6C475DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,?), ref: 6C49F155
GetCurrentThreadId.KERNEL32 ref: 6C49F1E0
AcquireSRWLockExclusive.KERNEL32(6C4DF4B8), ref: 6C49F1ED
ReleaseSRWLockExclusive.KERNEL32(6C4DF4B8), ref: 6C49F212
GetCurrentThreadId.KERNEL32 ref: 6C49F229
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C49F231
?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C49F248
GetCurrentThreadId.KERNEL32 ref: 6C49F2AE
AcquireSRWLockExclusive.KERNEL32(6C4DF4B8), ref: 6C49F2BB
ReleaseSRWLockExclusive.KERNEL32(6C4DF4B8), ref: 6C49F2F8

Part of subcall function 6C48CBE8: GetCurrentProcess.KERNEL32(?,6C4531A7), ref: 6C48CBF1
Part of subcall function 6C48CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C4531A7), ref: 6C48CBFA

Part of subcall function 6C499420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C464A68), ref: 6C49945E
Part of subcall function 6C499420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C499470
Part of subcall function 6C499420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C499482
Part of subcall function 6C499420: __Init_thread_footer.LIBCMT ref: 6C49949F

GetCurrentThreadId.KERNEL32 ref: 6C49F350
AcquireSRWLockExclusive.KERNEL32(6C4DF4B8), ref: 6C49F35D
ReleaseSRWLockExclusive.KERNEL32(6C4DF4B8), ref: 6C49F381
GetCurrentThreadId.KERNEL32 ref: 6C49F398
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C49F3A0
GetCurrentThreadId.KERNEL32 ref: 6C49F489
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C49F491

Part of subcall function 6C4994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C4994EE
Part of subcall function 6C4994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C499508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C49F3CF

Part of subcall function 6C49F070: GetCurrentThreadId.KERNEL32 ref: 6C49F440
Part of subcall function 6C49F070: AcquireSRWLockExclusive.KERNEL32(6C4DF4B8), ref: 6C49F44D
Part of subcall function 6C49F070: ReleaseSRWLockExclusive.KERNEL32(6C4DF4B8), ref: 6C49F472

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C49F4A8
GetCurrentThreadId.KERNEL32 ref: 6C49F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C49F561
GetCurrentThreadId.KERNEL32 ref: 6C49F577
AcquireSRWLockExclusive.KERNEL32(6C4DF4B8), ref: 6C49F585
ReleaseSRWLockExclusive.KERNEL32(6C4DF4B8), ref: 6C49F5A3

Strings

[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C49F56A
[I %d/%d] profiler_pause_sampling, xrefs: 6C49F3A8
[I %d/%d] profiler_resume, xrefs: 6C49F239
[I %d/%d] profiler_resume_sampling, xrefs: 6C49F499

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: CurrentExclusiveLock$Thread$AcquireRelease$CriticalSectionTime_getpid$?profiler_time@baseprofiler@mozilla@@getenv$Count64EnterLeaveProcessStampTickV01@@Value@mozilla@@$BaseCounterDurationInit_thread_footerNow@PerformancePlatformQuerySeconds@Stamp@mozilla@@TerminateUtils@mozilla@@V12@___acrt_iob_func__aulldiv__stdio_common_vfprintf
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 565197838-2840072211
Opcode ID: 32419bd5bf188f594f626e0a472db5abf0a2e332ce3084d53d1975031a33151c
Instruction ID: d2e1d24353983b8f5790fb633ae4459b420a39c539cebfb67bad13f36ed50bce
Opcode Fuzzy Hash: 32419bd5bf188f594f626e0a472db5abf0a2e332ce3084d53d1975031a33151c
Instruction Fuzzy Hash: 2BD118316062149FEB10FF64D814FA97BB8EB56329F14461EF95583B80DB71B904C7A2

Function 6C4664C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6C4664DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6C4664F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6C466505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6C466518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C46652B
memcpy.VCRUNTIME140(?,?,?), ref: 6C46671C
GetCurrentProcess.KERNEL32 ref: 6C466724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C46672F
GetCurrentProcess.KERNEL32 ref: 6C466759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C466764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6C466A80
GetSystemInfo.KERNEL32(?), ref: 6C466ABE
__Init_thread_footer.LIBCMT ref: 6C466AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C466AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C466AF7

Strings

nvdxgiwrap.dll, xrefs: 6C466513
_etoured.dll, xrefs: 6C4664ED
nvd3d9wrap.dll, xrefs: 6C466500
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6C466798
detoured.dll, xrefs: 6C4664DA
user32.dll, xrefs: 6C466526

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: af68a0ac1d74acbe40c0ac1e17dfc0b55583ba069dd674388c8b3cbb9371efe4
Instruction ID: e45ace4b47de005ada4f2f017cc69cc01e1d2fddb42b8b594cd45f6d4cf8c0e8
Opcode Fuzzy Hash: af68a0ac1d74acbe40c0ac1e17dfc0b55583ba069dd674388c8b3cbb9371efe4
Instruction Fuzzy Hash: 6CF1F3709052198FDB20EF66CC88FDAB7B5AF06319F144299D809E3B45D731AE85CF91

Function 6C47D850 Relevance: 48.4, APIs: 21, Strings: 6, Instructions: 1109COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C47D904
LeaveCriticalSection.KERNEL32(?), ref: 6C47D971
memset.VCRUNTIME140(?,00000000,?), ref: 6C47D97B
LeaveCriticalSection.KERNEL32(?), ref: 6C47E2E3
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C47E2E9
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C47E308
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C47E315
AcquireSRWLockExclusive.KERNEL32(6C4DE804), ref: 6C47E37C
GetSystemInfo.KERNEL32(?), ref: 6C47E3C7
__Init_thread_footer.LIBCMT ref: 6C47E3DA
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C4DE810,00000040), ref: 6C47E404
InitializeCriticalSectionAndSpinCount.KERNEL32(6C4DE7B8,00001388), ref: 6C47E46D
InitializeCriticalSectionAndSpinCount.KERNEL32(6C4DE744,00001388), ref: 6C47E483
InitializeCriticalSectionAndSpinCount.KERNEL32(6C4DE784,00001388), ref: 6C47E4A9
InitializeCriticalSectionAndSpinCount.KERNEL32(6C4DE7DC,00001388), ref: 6C47E4CA
InitializeCriticalSectionAndSpinCount.KERNEL32(6C4DE768,00001388), ref: 6C47E50C
memset.VCRUNTIME140(00000000,00000000,00004000), ref: 6C47E52E
ReleaseSRWLockExclusive.KERNEL32(6C4DE804), ref: 6C47E54F

Part of subcall function 6C46D960: EnterCriticalSection.KERNEL32(?), ref: 6C46D999
Part of subcall function 6C46D960: EnterCriticalSection.KERNEL32(6C4DE7B8), ref: 6C46DA13

Strings

MALLOC_OPTIONS, xrefs: 6C47E3FF
<jemalloc>, xrefs: 6C47E61C, 6C47E6CC
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C47E560, 6C47E58A, 6C47E5A5
MOZ_CRASH(), xrefs: 6C47E62B
Compile-time page size does not divide the runtime one., xrefs: 6C47E621
: (malloc) Unsupported character in malloc options: ', xrefs: 6C47E6DD

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: CriticalSection$CountInitializeSpin$Enter$ExclusiveK@1@LeaveLockMaybe@_RandomUint64@mozilla@@memset$AcquireEnvironmentInfoInit_thread_footerReleaseSystemVariable_errno
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 919329573-429003945
Opcode ID: e630c153772b2b22366e2e98cda75bf194c34552e96f1173728de01553ee894f
Instruction ID: ac9fa87e20e7c2c49db1eecb656a5e072408a3210fba0e6245f4baf3d2740894
Opcode Fuzzy Hash: e630c153772b2b22366e2e98cda75bf194c34552e96f1173728de01553ee894f
Instruction Fuzzy Hash: DD92AA71A156018FD724CF28C980F95FBE1BF86728F29866DE8698B791D331E841CBD1

Function 6C4BC4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C4BC5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C4BC6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C4BC74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C4BC7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6C4BC9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C4BCC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C4BCD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C4BDB40
memcpy.VCRUNTIME140(?,?,?), ref: 6C4BDB62
memcpy.VCRUNTIME140(?,?,?), ref: 6C4BDB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C4BDD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C4BDE95
memcpy.VCRUNTIME140(?,?,?), ref: 6C4BE360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C4BE432
memcpy.VCRUNTIME140(?,?,?), ref: 6C4BE472

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: c66d98954b273ee30f0c89066e89259adda4b6123d476792da08754bbcf7add4
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: 86338E71E0421A8FCB04CF98C8C0EADBBB2FF89314F194269D955BB755D731A946CBA0

Function 6C47ED10 Relevance: 32.4, APIs: 16, Strings: 2, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6C47EE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C47EFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C481695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C4816B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6C481770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C481A3E

Strings

~qEl, xrefs: 6C47ED10
~qEl, xrefs: 6C47ED13

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID: ~qEl$~qEl
API String ID: 3693777188-4094673447
Opcode ID: e7bdb6c9770e35d413c76d100c5fc2a25f119aae91c52f0aad43cf011aca2427
Instruction ID: 7f728abba8a33f1ec94a55c07f8398682899d77af341059a4419658eb2e81552
Opcode Fuzzy Hash: e7bdb6c9770e35d413c76d100c5fc2a25f119aae91c52f0aad43cf011aca2427
Instruction Fuzzy Hash: A0B31971E012198FDB25CFA8C890EDDB7B2BF49304F2581A9D859AB745D730AD86CF90

Function 6C46FD00 Relevance: 31.4, APIs: 17, Strings: 3, Instructions: 1360memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C4DE7B8), ref: 6C46FF81
LeaveCriticalSection.KERNEL32(6C4DE7B8), ref: 6C47022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C470240
EnterCriticalSection.KERNEL32(6C4DE768), ref: 6C47025B
LeaveCriticalSection.KERNEL32(6C4DE768), ref: 6C47027B

Strings

<jemalloc>, xrefs: 6C470D62, 6C470D76, 6C470DA7
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C46FE99, 6C46FEB7, 6C46FED3, 6C470DB8, 6C470DD3, 6C4719B4
: (malloc) Error in VirtualFree(), xrefs: 6C470D67, 6C470D7B, 6C470DAC

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3577267516
Opcode ID: 0580a17bffd8fa849de3ea450f72fe58561dfa4e2e812477508ba5f05a36c45d
Instruction ID: 893e052c3bd986cf69de1dc88964f4a86ca43001d09a012629e3bfe44ba97c1f
Opcode Fuzzy Hash: 0580a17bffd8fa849de3ea450f72fe58561dfa4e2e812477508ba5f05a36c45d
Instruction Fuzzy Hash: D5C2D271A067418FD724CF28C590F56BBE1BF85328F28C66DE4A98B795D732E801CB91

Function 6C4BE680 Relevance: 31.1, APIs: 22, Instructions: 3648COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00004014), ref: 6C4BE811
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C4BEAA8
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C4BEBD5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C4BEEF6
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C4BF223
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C4BF322
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C4C0E03
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C4C0E54
memcpy.VCRUNTIME140(?,?,?), ref: 6C4C0EAE
memcpy.VCRUNTIME140(?,?,?), ref: 6C4C0ED4

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: 329365ffe4cfd752165652737f5719d6872dccf349ffb032af701846afdb886f
Instruction ID: a9140f6d1168d457a5eba8f9c49e570f05473cf8af45ff06531dec40067622e7
Opcode Fuzzy Hash: 329365ffe4cfd752165652737f5719d6872dccf349ffb032af701846afdb886f
Instruction Fuzzy Hash: 14636F75E0025A8FCB14CFA8C890E9DF7B2FF89310F298269D855BB755D730A946CB90

Function 6C493E50 Relevance: 28.8, APIs: 13, Strings: 3, Instructions: 765COMMON

Download Yara Rule

APIs

Part of subcall function 6C4B7770: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(}>Il,?,?,?,6C493E7D,?,?), ref: 6C4B777C

tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000), ref: 6C493F17
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C493F5C
VerSetConditionMask.NTDLL ref: 6C493F8D
VerSetConditionMask.NTDLL ref: 6C493F99
VerSetConditionMask.NTDLL ref: 6C493FA0
VerSetConditionMask.NTDLL ref: 6C493FA7
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C493FB4

Strings

nvinit.dll, xrefs: 6C494479
nvd3d9wrap.dll, xrefs: 6C494466
C>Il, xrefs: 6C493E93

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemsettolowerwcslen
String ID: C>Il$nvd3d9wrap.dll$nvinit.dll
API String ID: 1189858803-779104094
Opcode ID: 117f687e1b60f9557d4f175f72ea373fc5c3419ab3c8b1a0d110d6737e320279
Instruction ID: 0714b4c4f6449d7c1edcd25d26a6a15e73bb09269c09b10d0eb1b1cf2507b808
Opcode Fuzzy Hash: 117f687e1b60f9557d4f175f72ea373fc5c3419ab3c8b1a0d110d6737e320279
Instruction Fuzzy Hash: 4552D371610B489FD715DF34C890EABBBE9AF45208F44092DE4A78BB52DB34F919C7A0

Function 6C46FEF0 Relevance: 23.8, APIs: 13, Strings: 2, Instructions: 1294memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C4DE7B8), ref: 6C46FF81
LeaveCriticalSection.KERNEL32(6C4DE7B8), ref: 6C47022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C470240
EnterCriticalSection.KERNEL32(6C4DE768), ref: 6C47025B
LeaveCriticalSection.KERNEL32(6C4DE768), ref: 6C47027B

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C46FE99, 6C46FEB7, 6C46FED3, 6C470DB8, 6C470DD3, 6C4719B4, 6C471A10
MOZ_CRASH(), xrefs: 6C470CA7

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3566792288
Opcode ID: 6aba7d77469bd015d9b98c56c06988a9d6161652768d881736e85ddd357f341f
Instruction ID: 342c87ec9998593eed5388d6ffd7e8cd481829fc40b10924a6e64c0dc51ebf68
Opcode Fuzzy Hash: 6aba7d77469bd015d9b98c56c06988a9d6161652768d881736e85ddd357f341f
Instruction Fuzzy Hash: 16B2E1716067418FD724CF28C590F96BBE1BF85328F28C66CE86A8BB95C771E841CB51

Function 6C4A5600 Relevance: 22.0, APIs: 6, Strings: 6, Instructions: 950COMMON

Download Yara Rule

Strings

expected a Count entry, xrefs: 6C4A5AC3
ProfileBuffer parse error: %s, xrefs: 6C4A5AC8, 6C4A5CBB
expected a Time entry, xrefs: 6C4A5CB6
name, xrefs: 6C4A5E79, 6C4A5E8F
data, xrefs: 6C4A6131
schema, xrefs: 6C4A606D

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID:
String ID: ProfileBuffer parse error: %s$data$expected a Count entry$expected a Time entry$name$schema
API String ID: 0-2712937348
Opcode ID: 1d8c25d0ff8877aa969142834b1cfcc92a53a5d7cbe82cebac233adeb6d13c4c
Instruction ID: 0cb2d353261a6c69575cc35de3cf74377a9bde2059cb6dee486ed1d3e2625946
Opcode Fuzzy Hash: 1d8c25d0ff8877aa969142834b1cfcc92a53a5d7cbe82cebac233adeb6d13c4c
Instruction Fuzzy Hash: F3928D71A087418FD724CF58C590F9ABBE1BFD8308F14891DE9999B755DB30E80ACB92

Function 6C467810 Relevance: 21.4, APIs: 12, Strings: 2, Instructions: 372COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C4DE744), ref: 6C467885
LeaveCriticalSection.KERNEL32(6C4DE744), ref: 6C4678A5
EnterCriticalSection.KERNEL32(6C4DE784), ref: 6C4678AD
LeaveCriticalSection.KERNEL32(6C4DE784), ref: 6C4678CD
EnterCriticalSection.KERNEL32(6C4DE7DC), ref: 6C4678D4
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C4678E9
EnterCriticalSection.KERNEL32(00000000), ref: 6C46795D
memset.VCRUNTIME140(?,00000000,00000160), ref: 6C4679BB
LeaveCriticalSection.KERNEL32(?), ref: 6C467BBC
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C467C82
LeaveCriticalSection.KERNEL32(6C4DE7DC), ref: 6C467CD2
memset.VCRUNTIME140(00000000,00000000,00000450), ref: 6C467DAF

Strings

DMl, xrefs: 6C46787F
DMl, xrefs: 6C46789F

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavememset
String ID: DMl$DMl
API String ID: 759993129-3680030721
Opcode ID: 1320536b2a833d3994e290e4044e349ef06ba1a865801d7583836c1ac9cc41df
Instruction ID: 3639a77ef16587dba93941c555b2e8892d3e5b94c428013beaaf1c0818210e0d
Opcode Fuzzy Hash: 1320536b2a833d3994e290e4044e349ef06ba1a865801d7583836c1ac9cc41df
Instruction Fuzzy Hash: 04026171A0521A8FDB54CF19C984F99B7B5FF48318F2582AAD809A7B15D730BE91CF80

Function 6C4A2E4E Relevance: 19.8, APIs: 8, Strings: 3, Instructions: 579stringCOMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C4A2ED3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C4A2EE7
MozFormatCodeAddressDetails.MOZGLUE(?,000000FF,00000000,?,?), ref: 6C4A2F0D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C4A3214
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C4A3242
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C4A36BF

Strings

get , xrefs: 6C4A3205
set , xrefs: 6C4A36EC
MOZ_PROFILER_SYMBOLICATE, xrefs: 6C4A378D

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: strlen$AddressCode$DescribeDetailsFormat
String ID: MOZ_PROFILER_SYMBOLICATE$get $set
API String ID: 2257098003-3318126862
Opcode ID: 644ee04db13f390305f84116e9a9e861a19d82c1ac921662fc5fc80518654755
Instruction ID: 24657373f6d4a6fd604218f9576cbd38064bd898dfc52ed130d958203fbea57e
Opcode Fuzzy Hash: 644ee04db13f390305f84116e9a9e861a19d82c1ac921662fc5fc80518654755
Instruction Fuzzy Hash: 79326D746083818FD324CF64C490F9EBBE2AFD9318F54881DE59987755EB30E94ACB92

Function 6C497E10 Relevance: 19.7, APIs: 6, Strings: 5, Instructions: 403COMMON

Download Yara Rule

Strings

name, xrefs: 6C497ECF, 6C498335
data, xrefs: 6C498280, 6C4983E1
schema, xrefs: 6C4981E3, 6C498311
(pre-xul), xrefs: 6C497E88
vMl, xrefs: 6C498207

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: memcpystrlen
String ID: (pre-xul)$data$name$schema$vMl
API String ID: 3412268980-3601864216
Opcode ID: 2a8fee06bf60f4a80d9660306061bc56682f650d3081ae6838ef68cf4d8d7836
Instruction ID: 7a18601576094ac98b1b2e2475f0468a6679e90fcfe0d06121a33b495d3fb4e4
Opcode Fuzzy Hash: 2a8fee06bf60f4a80d9660306061bc56682f650d3081ae6838ef68cf4d8d7836
Instruction Fuzzy Hash: EFE17FB1B043508BD714CF698840E5BFBE9BBC5318F15492DE899E7B90DB70ED098B92

Function 6C4B5FF0 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 6C4B6009
??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6C4B6024
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(QEl,?), ref: 6C4B6046
OutputDebugStringA.KERNEL32(?,QEl,?), ref: 6C4B6061
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C4B6069
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C4B6073
_dup.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C4B6082
_fdopen.API-MS-WIN-CRT-MATH-L1-1-0(00000000,6C4D148E), ref: 6C4B6091
__stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,QEl,00000000,?), ref: 6C4B60BA
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C4B60C4

Strings

QEl, xrefs: 6C4B5FFC, 6C4B6042, 6C4B6045, 6C4B60B3

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: PrintfTarget@mozilla@@$?vprint@DebugDebuggerOutputPresentString__acrt_iob_func__stdio_common_vfprintf_dup_fdopen_filenofclose
String ID: QEl
API String ID: 3835517998-2634649411
Opcode ID: 975de7461083e49fea02c89da971bc0883f451bc121777bb310fb64510b94890
Instruction ID: ced40780cd87692e99247bf57b8e58418780e625923428b91363541548856cc5
Opcode Fuzzy Hash: 975de7461083e49fea02c89da971bc0883f451bc121777bb310fb64510b94890
Instruction Fuzzy Hash: 4E219171A002089BDB10FF259C49FAA7BB8FF45619F00842CE85AE7240CB74A559CFE2

Function 6C475E90 Relevance: 19.2, APIs: 5, Strings: 6, Instructions: 2651COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(-0000000C), ref: 6C475EDB
memset.VCRUNTIME140(ewKl,000000E5,?), ref: 6C475F27
LeaveCriticalSection.KERNEL32(?), ref: 6C475FB2
memset.VCRUNTIME140(ewKl,000000E5,?), ref: 6C4761F0
VirtualFree.KERNEL32(-00000001,00100000,00004000), ref: 6C477652

Strings

MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C47730D
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C4772F8
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C477BCD, 6C477C1F, 6C477C34, 6C4780FD
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C4772E3
MOZ_CRASH(), xrefs: 6C477BA4
ewKl, xrefs: 6C475E9C, 6C475F22, 6C4761ED

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: CriticalSectionmemset$EnterFreeLeaveVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)$ewKl
API String ID: 2613674957-3048668682
Opcode ID: 4f1fd38661bc8cf2cda4b065c5a1d4ecb114ecbccedc27653c2ae1ddec5255f5
Instruction ID: 4e50895704addaf117753950464e5a3601331bd8b709f678029562a3bd5cec99
Opcode Fuzzy Hash: 4f1fd38661bc8cf2cda4b065c5a1d4ecb114ecbccedc27653c2ae1ddec5255f5
Instruction Fuzzy Hash: 0B33AD716097018FC325CF28C590E95BBE2FF85328F29C6ADE9698B7A5C731E841CB51

Function 6C4A4820 Relevance: 18.2, APIs: 1, Strings: 9, Instructions: 744COMMON

Download Yara Rule

Strings

ProfileBuffer parse error: %s, xrefs: 6C4A4DD9
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration, xrefs: 6C4A4D0A
Ml, xrefs: 6C4A4F88
data, xrefs: 6C4A49B4
schema, xrefs: 6C4A48C1
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*2, xrefs: 6C4A4D65
-%llu, xrefs: 6C4A4825
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*3, xrefs: 6C4A4DB8, 6C4A4DD8
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime, xrefs: 6C4A4CAF

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: free
String ID: Ml$-%llu$ProfileBuffer parse error: %s$data$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*2$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*3$schema
API String ID: 1294909896-498563427
Opcode ID: 67772bbbf3d52475ed8fc3f839856f185572aa3f69280efe187a604d978d68ff
Instruction ID: 45133b17045ce6a1fa527dab6b06b302fbc421b6b157c90d4cb5fb23945d6670
Opcode Fuzzy Hash: 67772bbbf3d52475ed8fc3f839856f185572aa3f69280efe187a604d978d68ff
Instruction Fuzzy Hash: 96722E75918B858BD322CF34C451B9BF7E5BFDA344F108B1DE48A6B610EB70A486DB42

Function 6C47D4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C4DE784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C48D1C5), ref: 6C47D4F2
LeaveCriticalSection.KERNEL32(6C4DE784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C48D1C5), ref: 6C47D50B

Part of subcall function 6C45CFE0: EnterCriticalSection.KERNEL32(6C4DE784), ref: 6C45CFF6
Part of subcall function 6C45CFE0: LeaveCriticalSection.KERNEL32(6C4DE784), ref: 6C45D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C48D1C5), ref: 6C47D52E
EnterCriticalSection.KERNEL32(6C4DE7DC), ref: 6C47D690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C47D6A6
LeaveCriticalSection.KERNEL32(6C4DE7DC), ref: 6C47D712
LeaveCriticalSection.KERNEL32(6C4DE784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C48D1C5), ref: 6C47D751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C47D7EA

Strings

: (malloc) Error initializing arena, xrefs: 6C47D82C
<jemalloc>, xrefs: 6C47D827

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: bd8f67fd9a8957d8ac64991ad58d6b40187d31f4307cfd39fd8cd025bbfa8f72
Instruction ID: bd915c3b225a49bf054266449e20a0b9f00f07d4369f08f40bd8fac827c078db
Opcode Fuzzy Hash: bd8f67fd9a8957d8ac64991ad58d6b40187d31f4307cfd39fd8cd025bbfa8f72
Instruction Fuzzy Hash: D391E371A147018FD764DF28C490FAAB7E1EB89314F15892EE59AC7B80D730F845CBA2

Function 6C4B4EA0 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 408sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 6C4B4EFF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C4B4F2E
moz_xmalloc.MOZGLUE ref: 6C4B4F52
memset.VCRUNTIME140(00000000,00000000), ref: 6C4B4F62
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C4B52B2
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C4B52E6
Sleep.KERNEL32(00000010), ref: 6C4B5481
free.MOZGLUE(?), ref: 6C4B5498

Strings

(, xrefs: 6C4B5250

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: floor$Sleep$freememsetmoz_xmalloc
String ID: (
API String ID: 4104871533-3887548279
Opcode ID: dc776c98c2626b9dba69589ee58cc97c8918579e5322d48f2f95668114f4e448
Instruction ID: 1064b9db60e2daba2bdcff5f25073dbbdce2b6b3a93dfa67153373ddaa7ea4b4
Opcode Fuzzy Hash: dc776c98c2626b9dba69589ee58cc97c8918579e5322d48f2f95668114f4e448
Instruction Fuzzy Hash: 17F1F371A19B008FD716EF38C850A2BB7F5AFD6294F058B2EF846A7651DB31D442CB81

Function 6C479E50 Relevance: 13.1, APIs: 6, Strings: 1, Instructions: 878COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C479EB8
LeaveCriticalSection.KERNEL32(?), ref: 6C479F24
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C479F34
LeaveCriticalSection.KERNEL32(?), ref: 6C47A823
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C47A83C
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C47A849

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C47A8B1, 6C47A8D4, 6C47A8EF

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: CriticalSection$K@1@LeaveMaybe@_RandomUint64@mozilla@@$Entermemset
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 2950001534-1351931279
Opcode ID: c281192c190091905a32dd1b61210a810290865af602524ade5465acc73b9287
Instruction ID: eb52d03509b7c77f05021fd1525f88d030e28c7b18c1a1315dc966b79a503752
Opcode Fuzzy Hash: c281192c190091905a32dd1b61210a810290865af602524ade5465acc73b9287
Instruction Fuzzy Hash: EC726B72A056118FD324CF28C540E55FBE1BF89328F2AC66DE8699B791D335E842CB91

Function 6C4A2C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C4A2C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C4A2C61

Part of subcall function 6C454DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C454E5A
Part of subcall function 6C454DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C454E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C4A2C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C4A2E2D

Part of subcall function 6C4681B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C4681DE

Strings

ProfileBuffer parse error: %s, xrefs: 6C4A2E3B
expected a Time entry, xrefs: 6C4A2E36
(root), xrefs: 6C4A354F

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: 73c10a0e2eade4ef558c0cd4a54cc661af99e7af632d86fdf3b88d3a631d268a
Instruction ID: acd51027c69749f1e6c8b972efabb5d8eee1575fb9acc106c58eed694059ff8b
Opcode Fuzzy Hash: 73c10a0e2eade4ef558c0cd4a54cc661af99e7af632d86fdf3b88d3a631d268a
Instruction Fuzzy Hash: 4F91DF706087408FC724DF65C490E9FFBE1AF99358F10491DE99A8B755EB30D94ACB82

Function 6C4B9E30 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 347COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6C4B9F3D
__aulldiv.LIBCMT ref: 6C4B9F77
__aullrem.LIBCMT ref: 6C4B9F8C
__aulldiv.LIBCMT ref: 6C4BA023

Strings

NaN, xrefs: 6C4B9EAB
-Infinity, xrefs: 6C4B9E60, 6C4B9E7B

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: -Infinity$NaN
API String ID: 3839614884-2141177498
Opcode ID: 3696870dcd726cb3ee84ab6c8db9c0d8d445f0592c1933ebea1fa386af59f6d1
Instruction ID: fe58b15dd19130b2fa7753472cfb7a3debb29d612ec613f76a5171850f1e19b8
Opcode Fuzzy Hash: 3696870dcd726cb3ee84ab6c8db9c0d8d445f0592c1933ebea1fa386af59f6d1
Instruction Fuzzy Hash: DCC19E31E003198BDB14CFA9C890F9EB7B6AF94714F54452DD409BBB80DB71A94ACBE1

Function 6C45D4E0 Relevance: 10.8, Strings: 8, Instructions: 805COMMON

Download Yara Rule

Strings

9, xrefs: 6C45DE7F
0, xrefs: 6C45D852
@, xrefs: 6C45DAF6
8, xrefs: 6C45DC08
1, xrefs: 6C45DBDD
, xrefs: 6C45DA88
0, xrefs: 6C45DC7F
-, xrefs: 6C45D7DD

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID:
String ID: $-$0$0$1$8$9$@
API String ID: 0-3654031807
Opcode ID: e594c1af9d2a73a3239c580c2b2a0937a17c75e28a14c6d040ee1f17d7587fbc
Instruction ID: 74e40ef74902a4ee12fac6e05e4cc5054249cdfb92af93742f329ca7c1e5542d
Opcode Fuzzy Hash: e594c1af9d2a73a3239c580c2b2a0937a17c75e28a14c6d040ee1f17d7587fbc
Instruction Fuzzy Hash: A062DE7160C3458FD705CE18C290F5EBBF2AF86359F984A1DE4E54BB91C33598A6CB82

Function 6C4C545C Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C4C8A4B

Strings

~qEl, xrefs: 6C4C5703, 6C4C5740, 6C4C56C7, 6C4C9269, 6C4C9459, 6C4C921F, 6C4C948F

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: memset
String ID: ~qEl
API String ID: 2221118986-916298983
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: 8591e4a8be1a49ca0f3ccc7619b1b86ad49acb37e3f406f6a4800044f62a5245
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: B3B1C576F0121A8FDB14CF68CC90FA9B7B2EF95314F1802A9C549DB7A1D7309985CB91

Function 6C4C542B Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C4C88F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C4C925C

Strings

~qEl, xrefs: 6C4C5703, 6C4C5740, 6C4C56C7, 6C4C9269, 6C4C9459, 6C4C921F, 6C4C948F

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: memset
String ID: ~qEl
API String ID: 2221118986-916298983
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: ca4e55aaa31a8f4241bf3a637755065f04e166162455e0c29b7b831e3d0935b8
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: 2CB1D576F0420A8FCB14CF58CC81EADB7B2AF94314F180269C549EB795D731A98ACB91

Function 6C4BC410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C4BC0E9), ref: 6C4BC418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6C4BC437
FreeLibrary.KERNEL32(?,6C4BC0E9), ref: 6C4BC44C

Strings

NtQueryVirtualMemory, xrefs: 6C4BC431
ntdll.dll, xrefs: 6C4BC413

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: 45da00938b01a6886bb349a687aab76545839a9f0c05a78582925db5381703d8
Instruction ID: 46dd24fab108254706dd81b3a0158a35885d736a56ad2570ab74a5bc4e6b5a0a
Opcode Fuzzy Hash: 45da00938b01a6886bb349a687aab76545839a9f0c05a78582925db5381703d8
Instruction Fuzzy Hash: 2AE0B674602742ABFF10FF72C918F127BF8A706646F044516BA0892710EBB4F140CB52

Function 6C469F00 Relevance: 8.5, Strings: 6, Instructions: 1039COMMON

Download Yara Rule

Strings

9, xrefs: 6C46A5D6
' , xrefs: 6C46A3D8
@, xrefs: 6C46A625
0, xrefs: 6C46AB22
0, xrefs: 6C46A100
1, xrefs: 6C46A824

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID:
String ID: ' $0$0$1$9$@
API String ID: 0-2946122015
Opcode ID: 80f0359be735b0ec908cd4cc6d11315964d06daddd2f6ecef0893c205dd184db
Instruction ID: 342bbfe7f7e160e664377214e45be12e3e90c0d5678b951660f42c32b69655a6
Opcode Fuzzy Hash: 80f0359be735b0ec908cd4cc6d11315964d06daddd2f6ecef0893c205dd184db
Instruction Fuzzy Hash: 3E82C131509B318BD711CF0AC440E6AB7F1EF8175AF55892AE8D547F98D335E886CB82

Function 6C45BEF0 Relevance: 8.2, APIs: 5, Instructions: 652COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C45C1CB
__aulldiv.LIBCMT ref: 6C45C24C
__aulldiv.LIBCMT ref: 6C45C348
__aullrem.LIBCMT ref: 6C45C365
__aulldiv.LIBCMT ref: 6C45C37D

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: __aulldiv$__aullrem
String ID:
API String ID: 2022606265-0
Opcode ID: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction ID: 6b9ae9836778e0201e5e74b67d0e8e9b26fd91e2a4f41205fa75371f1c9ddc02
Opcode Fuzzy Hash: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction Fuzzy Hash: 05321232B046158FC718DE2CC890E6ABBE6AFC9310F49866DE895CB395D730ED05CB91

Function 6C4A77A0 Relevance: 6.3, APIs: 4, Instructions: 291timeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C4A7A81
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C4A7A93

Part of subcall function 6C475C50: GetTickCount64.KERNEL32 ref: 6C475D40
Part of subcall function 6C475C50: EnterCriticalSection.KERNEL32(6C4DF688), ref: 6C475D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C4A7AA1

Part of subcall function 6C475C50: __aulldiv.LIBCMT ref: 6C475DB4
Part of subcall function 6C475C50: LeaveCriticalSection.KERNEL32(6C4DF688), ref: 6C475DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(FFFFFFFE,?,?,?), ref: 6C4A7B31

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampV01@@Value@mozilla@@$BaseCount64DurationEnterLeaveNow@PlatformSeconds@Stamp@mozilla@@TickUtils@mozilla@@V12@___aulldiv
String ID:
API String ID: 4054851604-0
Opcode ID: 025c2c76c4232cab5a9afc1c7a782e8c286e052448cac334f157550c7cdd939f
Instruction ID: 7266bb63fc725c9fd2c61957a075b48fe50f0b4b3bb40e78fc3684bd2de31bb8
Opcode Fuzzy Hash: 025c2c76c4232cab5a9afc1c7a782e8c286e052448cac334f157550c7cdd939f
Instruction Fuzzy Hash: B7B19D356083808BDB24CFA4C050F9FB7E2ABD5318F154A1CE99567799DB70E90BCB82

Function 6C478850 Relevance: 6.1, APIs: 1, Strings: 2, Instructions: 1567COMMON

Download Yara Rule

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C479813, 6C47985D, 6C479878, 6C479CEB
MOZ_CRASH(), xrefs: 6C4797EA

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID:
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 0-3566792288
Opcode ID: 537ab5ab192b7c2cc3ff623f241bb3c7b9487e2c3a79f99faf139acaf648f84d
Instruction ID: 0a2f2c8998761116e086d49b23dbedd59f40cbaded72772b49c273074edfe201
Opcode Fuzzy Hash: 537ab5ab192b7c2cc3ff623f241bb3c7b9487e2c3a79f99faf139acaf648f84d
Instruction Fuzzy Hash: 9AD2BE71A156018FC728CF28C590F55BBE1BF95324F29C76DE86A8B7A5C732E841CB90

Function 6C496CF0 Relevance: 4.7, APIs: 3, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6C496D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C496E1E

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID:
API String ID: 4169067295-0
Opcode ID: 7eb68117e8447b98953ab3cb6488d4e70e337f78deacc06ef7529ec8c37eea72
Instruction ID: 8b29abe26e38648ddf3d59b30194481d1b3df7e5877dffadf205518923609c8a
Opcode Fuzzy Hash: 7eb68117e8447b98953ab3cb6488d4e70e337f78deacc06ef7529ec8c37eea72
Instruction Fuzzy Hash: A9A169746183918FDB15DF24C490FAEBBE2BF88308F44495DE88A87751DB70A949CBD2

Function 6C4BB700 Relevance: 4.5, APIs: 3, Instructions: 41nativeCOMMON

Download Yara Rule

APIs

NtQueryVirtualMemory.NTDLL ref: 6C4BB720
RtlNtStatusToDosError.NTDLL ref: 6C4BB75A
RtlSetLastWin32Error.NTDLL(00000000,00000000,000000FF,00000000,00000000,?,0000001C,6C48FE3F,00000000,00000000,?,?,00000000,?,6C48FE3F), ref: 6C4BB760

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: Error$LastMemoryQueryStatusVirtualWin32
String ID:
API String ID: 304294125-0
Opcode ID: ee3d246db4fad94876a969f7a676cb9a7f47d77d699291382afc0b4e1f7bc302
Instruction ID: 314d9e181e84603cc1c731b20dc594ddf9647bbe1221ee760fa402edbd02604d
Opcode Fuzzy Hash: ee3d246db4fad94876a969f7a676cb9a7f47d77d699291382afc0b4e1f7bc302
Instruction Fuzzy Hash: 99F04FB0E4420DAEEF01EAA58CC5FEEB7BD9B0431AF105229E511756C0DB74A5C8CAA1

Function 6C474640 Relevance: 4.3, APIs: 1, Strings: 1, Instructions: 1251memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00001000,00000004), ref: 6C474777

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C475585, 6C4755A8, 6C4755C3, 6C475624

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 4275171209-1351931279
Opcode ID: cbdb2324699418f371de8b32c2470b3c5ae87285f9c2cdbc93e124021f09e913
Instruction ID: 0e6d984086050f718213c1ff5e885cdea7ab046f00b9821ce6fcee9bac1919ea
Opcode Fuzzy Hash: cbdb2324699418f371de8b32c2470b3c5ae87285f9c2cdbc93e124021f09e913
Instruction Fuzzy Hash: 8CB27C71A056018FD328CF28C590F65BBE2AFC5325B29C66DE4698F7A5D731E841CB90

Function 6C4B85F0 Relevance: 3.6, APIs: 2, Instructions: 619COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C4B8C7C
__aulldiv.LIBCMT ref: 6C4B8DD7

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction ID: 9c05245080f629324107e77ed8dc9f1cf8addd9f9177240d052d21ed74167146
Opcode Fuzzy Hash: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction Fuzzy Hash: F4327271F0111A8BDF18CE9CC8A1FAEB7B2FB88340F15853AD506BB794D6349D458BA1

Function 6C4C76E3 Relevance: 1.8, Strings: 1, Instructions: 540COMMON

Download Yara Rule

Strings

~qEl, xrefs: 6C4C79C0, 6C4C7E0B, 6C4C7B0B, 6C4C7796, 6C4C79FB, 6C4C793C

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID:
String ID: ~qEl
API String ID: 0-916298983
Opcode ID: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction ID: 2be6d66425b94612db46dea73c8c110863d2c06d7f9a80c9cf1397e66bf6f30e
Opcode Fuzzy Hash: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction Fuzzy Hash: 29321775E0421A8FCB14CF98C8C0AADFBB2FF88314F648169C949A7755D731A986CF91

Function 6C4C6E63 Relevance: 1.7, Strings: 1, Instructions: 498COMMON

Download Yara Rule

Strings

~qEl, xrefs: 6C4C79C0, 6C4C7E0B, 6C4C7C03, 6C4C7B0B, 6C4C79FB, 6C4C793C, 6C4C7C72

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID:
String ID: ~qEl
API String ID: 0-916298983
Opcode ID: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction ID: 0c00763fe89ad2fd485fc6852acaad4b4b256cbae7d4ca9ffe2565f68ad1c828
Opcode Fuzzy Hash: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction Fuzzy Hash: 8A22F975E042198FDB14CF98C880AADFBF2FF88304F6481A9C949A7755D731A986CF91

Function 6C495C10 Relevance: 1.6, APIs: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6C464A63,?,?), ref: 6C495F06

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: d664c55c1e15e848e89e6b81bef707ea9222275cf3b58c2ab228f8297a1da0c4
Instruction ID: 1b604b1d4eb129b0ddfa88030dc4aacc30bea992e5166eb7d835d072b1bdb803
Opcode Fuzzy Hash: d664c55c1e15e848e89e6b81bef707ea9222275cf3b58c2ab228f8297a1da0c4
Instruction Fuzzy Hash: 41C1A075D012298BCB04CF55D590EEEBFB2BF8931AF38825DD8556BB44D732A806CB90

Function 6C45DFE0 Relevance: .7, Instructions: 683COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54536f2928f0c3b5ad810ab7b4c3609a67fdb5a1626a0860e5b09dc5ebe827f3
Instruction ID: bce2d333b315a4932882bf3b027d94584f25de6ac1f741e9bd8b6d0382707c9a
Opcode Fuzzy Hash: 54536f2928f0c3b5ad810ab7b4c3609a67fdb5a1626a0860e5b09dc5ebe827f3
Instruction Fuzzy Hash: 3C42B472A087508BD304CE3CC490B5AF7E2BFC9364F494B2DE999A7794D738D9528B81

Function 6C480512 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction ID: 0cbec862653fe2997bb0b2e5e27131cadd91d1895a7c6f34499f08fd0884c013
Opcode Fuzzy Hash: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction Fuzzy Hash: 0E222671E016198FDB24CF98C890EADF7B2FF89304F548299C54AA7705D771A986CF90

Function 6C4CAC00 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ed184ffb35bfd076ba9fb5b14bb070ebd80e3184128e20a36e970e1bab46110
Instruction ID: 533bfef569f73c9216d9ae2394cb235a0fac6b65b65f0762816607bd442dd9bb
Opcode Fuzzy Hash: 0ed184ffb35bfd076ba9fb5b14bb070ebd80e3184128e20a36e970e1bab46110
Instruction Fuzzy Hash: 5BF16A75B087454FD700CE28C881FAAB7E2AFC5319F148A2DE5D4877A1E774D8898793

Function 6C45C670 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction ID: 7bec1ba7d992ed355ed5731f23fb719f430fe79edfd930fe55c02b14268bf213
Opcode Fuzzy Hash: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction Fuzzy Hash: 6FA1AE71F0021A8FDB08CE69C891BAEB7F2AFC8355F588129D915E7781DB349D168BD0

Function 6C497710 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: Process$CurrentTerminate
String ID:
API String ID: 2429186680-0
Opcode ID: b1d2ba63ec33f60b9011a711e15919c09cacc2570cb6230d60bfdbd65cccfe7f
Instruction ID: d8dc00da43907ba318cb2b3d03424da72843577c0ddb8a7063bd872ea59c2ef7
Opcode Fuzzy Hash: b1d2ba63ec33f60b9011a711e15919c09cacc2570cb6230d60bfdbd65cccfe7f
Instruction Fuzzy Hash: 1D715B75E052298FCB18CF99D890EEDBBB2FF89314F24816ED515AB740D731A905CB90

Function 6C49CC00 Relevance: 73.7, APIs: 25, Strings: 24, Instructions: 233
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6C46582D), ref: 6C49CC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6C46582D), ref: 6C49CC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6C4CFE98,?,?,?,?,?,6C46582D), ref: 6C49CC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6C46582D), ref: 6C49CC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6C46582D), ref: 6C49CC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6C46582D), ref: 6C49CC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6C46582D), ref: 6C49CCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6C49CCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6C49CCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6C49CCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6C49CCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6C49CD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6C49CD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6C49CD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6C49CDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6C49CDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6C49CDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6C49CDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6C49CE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6C49CE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6C49CE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6C49CE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6C49CE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6C49CE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6C49CE8A

Strings

cpuallthreads, xrefs: 6C49CE16
processcpu, xrefs: 6C49CE6E
fileio, xrefs: 6C49CC92
mainthreadio, xrefs: 6C49CC7C
seqstyle, xrefs: 6C49CCE6
notimerresolutionchange, xrefs: 6C49CE00
audiocallbacktracing, xrefs: 6C49CDD4
screenshots, xrefs: 6C49CCD4
default, xrefs: 6C49CC21
jsallocations, xrefs: 6C49CD0E
nativeallocations, xrefs: 6C49CDA8
markersallthreads, xrefs: 6C49CE42
nostacksampling, xrefs: 6C49CD7C
leaf, xrefs: 6C49CC66
noiostacks, xrefs: 6C49CCBE
stackwalk, xrefs: 6C49CCF8
Unrecognized feature "%s"., xrefs: 6C49CEA0
preferencereads, xrefs: 6C49CD92
samplingallthreads, xrefs: 6C49CE2C
power, xrefs: 6C49CE84
java, xrefs: 6C49CC37
ipcmessages, xrefs: 6C49CDBE
fileioall, xrefs: 6C49CCA8
unregisteredthreads, xrefs: 6C49CE58

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-2809817890
Opcode ID: dbb3b69a04d745d5bcd3bfb39f8cc692a81ab5d7a35fdd44501bb3f22f39e6c7
Instruction ID: 47890215c5e25beab432c86cab3da43863b3461c2277e595da10cbcfa892607c
Opcode Fuzzy Hash: dbb3b69a04d745d5bcd3bfb39f8cc692a81ab5d7a35fdd44501bb3f22f39e6c7
Instruction Fuzzy Hash: D45161C5B4627512FA04F1156D20FAA1E09EB5324BF14453AED1AA1FB0FB09E70B86F7

Function 6C4647C0 Relevance: 49.2, APIs: 23, Strings: 5, Instructions: 232threadCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C464801
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C464817
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C46482D
__Init_thread_footer.LIBCMT ref: 6C46484A

Part of subcall function 6C48AB3F: EnterCriticalSection.KERNEL32(6C4DE370,?,?,6C453527,6C4DF6CC,?,?,?,?,?,?,?,?,6C453284), ref: 6C48AB49
Part of subcall function 6C48AB3F: LeaveCriticalSection.KERNEL32(6C4DE370,?,6C453527,6C4DF6CC,?,?,?,?,?,?,?,?,6C453284,?,?,6C4756F6), ref: 6C48AB7C

GetCurrentThreadId.KERNEL32 ref: 6C46485F
GetCurrentThreadId.KERNEL32 ref: 6C46487E
AcquireSRWLockExclusive.KERNEL32(6C4DF4B8), ref: 6C46488B
free.MOZGLUE(?), ref: 6C46493A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C464956
free.MOZGLUE(00000000), ref: 6C464960
ReleaseSRWLockExclusive.KERNEL32(6C4DF4B8), ref: 6C46499A

Part of subcall function 6C48AB89: EnterCriticalSection.KERNEL32(6C4DE370,?,?,?,6C4534DE,6C4DF6CC,?,?,?,?,?,?,?,6C453284), ref: 6C48AB94
Part of subcall function 6C48AB89: LeaveCriticalSection.KERNEL32(6C4DE370,?,6C4534DE,6C4DF6CC,?,?,?,?,?,?,?,6C453284,?,?,6C4756F6), ref: 6C48ABD1

free.MOZGLUE(?), ref: 6C4649C6
free.MOZGLUE(?), ref: 6C4649E9

Part of subcall function 6C475E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C475EDB
Part of subcall function 6C475E90: memset.VCRUNTIME140(ewKl,000000E5,?), ref: 6C475F27
Part of subcall function 6C475E90: LeaveCriticalSection.KERNEL32(?), ref: 6C475FB2

Strings

[I %d/%d] profiler_shutdown, xrefs: 6C464A06
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C464812
MOZ_PROFILER_SHUTDOWN, xrefs: 6C464A42
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C464828
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C4647FC

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: CriticalSection$free$EnterLeavegetenv$CurrentExclusiveLockThread$AcquireInit_thread_footerReleasememset
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_SHUTDOWN$[I %d/%d] profiler_shutdown
API String ID: 1340022502-4194431170
Opcode ID: 8c94b3ed6a8d4370704401dccd48ae13df177dcbe9459a60bc4dcb99055e3fe4
Instruction ID: d1a6f17753c55c06b187a7809146c0d0268bb43867a04fd790e8cfb44ac8b54e
Opcode Fuzzy Hash: 8c94b3ed6a8d4370704401dccd48ae13df177dcbe9459a60bc4dcb99055e3fe4
Instruction Fuzzy Hash: 7C812470A001009BEF10FF6AC8A4F5A37B1AF42369F140229D9169BF89D731F849CB96

Function 6C464470 Relevance: 45.7, APIs: 20, Strings: 6, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C464730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C4644B2,6C4DE21C,6C4DF7F8), ref: 6C46473E
Part of subcall function 6C464730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C46474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6C4644BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6C4644D2
InitOnceExecuteOnce.KERNEL32(6C4DF80C,6C45F240,?,?), ref: 6C46451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C46455C
LoadLibraryW.KERNEL32(?), ref: 6C464592
InitializeCriticalSection.KERNEL32(6C4DF770), ref: 6C4645A2
moz_xmalloc.MOZGLUE(00000008), ref: 6C4645AA
moz_xmalloc.MOZGLUE(00000018), ref: 6C4645BB
InitOnceExecuteOnce.KERNEL32(6C4DF818,6C45F240,?,?), ref: 6C464612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6C464636
LoadLibraryW.KERNEL32(user32.dll), ref: 6C464644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6C46466D
VerSetConditionMask.NTDLL ref: 6C46469F
VerSetConditionMask.NTDLL ref: 6C4646AB
VerSetConditionMask.NTDLL ref: 6C4646B2
VerSetConditionMask.NTDLL ref: 6C4646B9
VerSetConditionMask.NTDLL ref: 6C4646C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C4646CD
GetModuleHandleW.KERNEL32(00000000), ref: 6C4646F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6C4646FD

Strings

NativeNtBlockSet_Write, xrefs: 6C4646F7
kernel32.dll, xrefs: 6C4644CD
GMl, xrefs: 6C4644FC
l, xrefs: 6C464578
user32.dll, xrefs: 6C464557, 6C46463F
WRusr.dll, xrefs: 6C4644B5

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: GMl$NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-2381000077
Opcode ID: 544dc8fed64871669112ce88b27a0b38c82f48ab076222727f1c91288146361d
Instruction ID: 61e59f80f81f8a223958c4497f784b29367333f04f3977ec516e7a5e63f9e68d
Opcode Fuzzy Hash: 544dc8fed64871669112ce88b27a0b38c82f48ab076222727f1c91288146361d
Instruction Fuzzy Hash: 226104B0A01344AFFF20FF61C859F95BBB8EB42349F04C459E9049BA51D771AA84CFA1

Function 6C49F6E0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C499420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C464A68), ref: 6C49945E
Part of subcall function 6C499420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C499470
Part of subcall function 6C499420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C499482
Part of subcall function 6C499420: __Init_thread_footer.LIBCMT ref: 6C49949F

GetCurrentThreadId.KERNEL32 ref: 6C49F70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6C49F8F9

Part of subcall function 6C466390: GetCurrentThreadId.KERNEL32 ref: 6C4663D0
Part of subcall function 6C466390: AcquireSRWLockExclusive.KERNEL32 ref: 6C4663DF
Part of subcall function 6C466390: ReleaseSRWLockExclusive.KERNEL32 ref: 6C46640E

ReleaseSRWLockExclusive.KERNEL32(6C4DF4B8), ref: 6C49F93A
GetCurrentThreadId.KERNEL32 ref: 6C49F98A
GetCurrentThreadId.KERNEL32 ref: 6C49F990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C49F994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C49F716

Part of subcall function 6C4994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C4994EE
Part of subcall function 6C4994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C499508

Part of subcall function 6C45B5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6C45B5E0

GetCurrentThreadId.KERNEL32 ref: 6C49F739
AcquireSRWLockExclusive.KERNEL32(6C4DF4B8), ref: 6C49F746
GetCurrentThreadId.KERNEL32 ref: 6C49F793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6C4D385B,00000002,?,?,?,?,?), ref: 6C49F829
free.MOZGLUE(?,?,00000000,?), ref: 6C49F84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6C49F866
free.MOZGLUE(?), ref: 6C49FA0C

Part of subcall function 6C465E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C4655E1), ref: 6C465E8C
Part of subcall function 6C465E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C465E9D
Part of subcall function 6C465E60: GetCurrentThreadId.KERNEL32 ref: 6C465EAB
Part of subcall function 6C465E60: GetCurrentThreadId.KERNEL32 ref: 6C465EB8
Part of subcall function 6C465E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C465ECF
Part of subcall function 6C465E60: moz_xmalloc.MOZGLUE(00000024), ref: 6C465F27
Part of subcall function 6C465E60: moz_xmalloc.MOZGLUE(00000004), ref: 6C465F47
Part of subcall function 6C465E60: GetCurrentProcess.KERNEL32 ref: 6C465F53
Part of subcall function 6C465E60: GetCurrentThread.KERNEL32 ref: 6C465F5C
Part of subcall function 6C465E60: GetCurrentProcess.KERNEL32 ref: 6C465F66
Part of subcall function 6C465E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C465F7E

free.MOZGLUE(?), ref: 6C49F9C5
free.MOZGLUE(?), ref: 6C49F9DA

Strings

" attempted to re-register as ", xrefs: 6C49F858
[D %d/%d] profiler_register_thread(%s), xrefs: 6C49F71F
Thread , xrefs: 6C49F789
[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6C49F9A6

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s
API String ID: 882766088-1834255612
Opcode ID: 70c6136170f316ab4975b2010f98d8f63ae3f3ceed92208f4b185baa2994dc00
Instruction ID: 65f5c136e41d07d0a3a685a036b4e708b9f84963fbdf222e3d1ca488a112c8ce
Opcode Fuzzy Hash: 70c6136170f316ab4975b2010f98d8f63ae3f3ceed92208f4b185baa2994dc00
Instruction Fuzzy Hash: 4E811571A052149FEB10EF24C840FAABBB5EF85308F55455DE8499BB51EB30E849CBD2

Function 6C49EE40 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 166threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C499420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C464A68), ref: 6C49945E
Part of subcall function 6C499420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C499470
Part of subcall function 6C499420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C499482
Part of subcall function 6C499420: __Init_thread_footer.LIBCMT ref: 6C49949F

GetCurrentThreadId.KERNEL32 ref: 6C49EE60
AcquireSRWLockExclusive.KERNEL32(6C4DF4B8), ref: 6C49EE6D
ReleaseSRWLockExclusive.KERNEL32(6C4DF4B8), ref: 6C49EE92
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C49EEA5
CloseHandle.KERNEL32(?), ref: 6C49EEB4
free.MOZGLUE(00000000), ref: 6C49EEBB
GetCurrentThreadId.KERNEL32 ref: 6C49EEC7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C49EECF

Part of subcall function 6C49DE60: GetCurrentThreadId.KERNEL32 ref: 6C49DE73
Part of subcall function 6C49DE60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C464A68), ref: 6C49DE7B
Part of subcall function 6C49DE60: ?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C464A68), ref: 6C49DEB8
Part of subcall function 6C49DE60: free.MOZGLUE(00000000,?,6C464A68), ref: 6C49DEFE
Part of subcall function 6C49DE60: ?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C49DF38

Part of subcall function 6C48CBE8: GetCurrentProcess.KERNEL32(?,6C4531A7), ref: 6C48CBF1
Part of subcall function 6C48CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C4531A7), ref: 6C48CBFA

GetCurrentThreadId.KERNEL32 ref: 6C49EF1E
AcquireSRWLockExclusive.KERNEL32(6C4DF4B8), ref: 6C49EF2B
ReleaseSRWLockExclusive.KERNEL32(6C4DF4B8), ref: 6C49EF59
GetCurrentThreadId.KERNEL32 ref: 6C49EFB0
AcquireSRWLockExclusive.KERNEL32(6C4DF4B8), ref: 6C49EFBD
ReleaseSRWLockExclusive.KERNEL32(6C4DF4B8), ref: 6C49EFE1
GetCurrentThreadId.KERNEL32 ref: 6C49EFF8
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C49F000

Part of subcall function 6C4994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C4994EE
Part of subcall function 6C4994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C499508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C49F02F

Part of subcall function 6C49F070: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C49F09B
Part of subcall function 6C49F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C49F0AC
Part of subcall function 6C49F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C49F0BE

Strings

[I %d/%d] profiler_stop, xrefs: 6C49EED7
[I %d/%d] profiler_pause, xrefs: 6C49F008

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: CurrentThread$ExclusiveLock$Release$AcquireTime_getpidgetenv$ProcessStampV01@@Value@mozilla@@free$?profiler_time@baseprofiler@mozilla@@BufferCloseEnterExit@mozilla@@HandleInit_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@Now@ObjectProfilerRegisterSingleStamp@mozilla@@TerminateV12@_Wait__acrt_iob_func__stdio_common_vfprintf
String ID: [I %d/%d] profiler_pause$[I %d/%d] profiler_stop
API String ID: 16519850-1833026159
Opcode ID: 0f96445bfbaa473a8a7b2b1d3c8f1fbc8d36580ad193d8b257bbecbf7cb5e33c
Instruction ID: e7af11c331620efb6375aa37684dd8c4e4820329b3f5eaab6e8b7f2c3f680c74
Opcode Fuzzy Hash: 0f96445bfbaa473a8a7b2b1d3c8f1fbc8d36580ad193d8b257bbecbf7cb5e33c
Instruction Fuzzy Hash: 9A51D231606221AFEF20FB64D858FA57FB4FB5632AF14451AE91583B41DB71B804C7E2

Function 6C48D010 Relevance: 31.7, APIs: 13, Strings: 5, Instructions: 215COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C4DE804), ref: 6C48D047
GetSystemInfo.KERNEL32(?), ref: 6C48D093
__Init_thread_footer.LIBCMT ref: 6C48D0A6
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C4DE810,00000040), ref: 6C48D0D0
InitializeCriticalSectionAndSpinCount.KERNEL32(6C4DE7B8,00001388), ref: 6C48D147
InitializeCriticalSectionAndSpinCount.KERNEL32(6C4DE744,00001388), ref: 6C48D162
InitializeCriticalSectionAndSpinCount.KERNEL32(6C4DE784,00001388), ref: 6C48D18D
InitializeCriticalSectionAndSpinCount.KERNEL32(6C4DE7DC,00001388), ref: 6C48D1B1

Strings

MALLOC_OPTIONS, xrefs: 6C48D0CB
<jemalloc>, xrefs: 6C48D268, 6C48D311
MOZ_CRASH(), xrefs: 6C48D277
Compile-time page size does not divide the runtime one., xrefs: 6C48D26D
: (malloc) Unsupported character in malloc options: ', xrefs: 6C48D322

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()
API String ID: 2957312145-326518326
Opcode ID: 7f10685fe16fe00949f94d5a61aa04be90cca2d51c292fe21da1696b7d2fef8b
Instruction ID: b956ff32d7712f70f4b1627cf9330d164a246748c21d9eb9bfbc9175bb5c85f8
Opcode Fuzzy Hash: 7f10685fe16fe00949f94d5a61aa04be90cca2d51c292fe21da1696b7d2fef8b
Instruction Fuzzy Hash: E281CE70F022529BEB04FF68C894FA9B7B5EB4A719F10052BE90197B80D771E845CBD2

Function 6C467FD0 Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 166COMMON

Download Yara Rule

APIs

K32EnumProcessModules.KERNEL32(000000FF,00000000,00000000,?), ref: 6C468007
moz_xmalloc.MOZGLUE(?,000000FF,00000000,00000000,?), ref: 6C46801D

Part of subcall function 6C46CA10: malloc.MOZGLUE(?), ref: 6C46CA26

memset.VCRUNTIME140(00000000,00000000,?,?), ref: 6C46802B
K32EnumProcessModules.KERNEL32(000000FF,00000000,?,?,?,?,?,?), ref: 6C46803D
moz_xmalloc.MOZGLUE(00000104,000000FF,00000000,?,?,?,?,?,?), ref: 6C46808D

Part of subcall function 6C46CA10: mozalloc_abort.MOZGLUE(?), ref: 6C46CAA2

memset.VCRUNTIME140(00000000,00000000,00000104,?,?,?,?,?), ref: 6C46809B
GetModuleFileNameW.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6C4680B9
moz_xmalloc.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C4680DF
memset.VCRUNTIME140(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6C4680ED
wcscpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C4680FB
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C46810D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C468133
free.MOZGLUE(00000000,000000FF,00000000,?,?,?,?,?,?), ref: 6C468149
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?), ref: 6C468167
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 6C46817C
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C468199

Strings

0>Il, xrefs: 6C46811E

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc$EnumModulesProcess$ErrorFileLastModuleNamemallocmozalloc_abortwcscpy_s
String ID: 0>Il
API String ID: 2721933968-2586129944
Opcode ID: 50a04689e41c7baeb1c84eb7b19580049e14645f5addc38eae575c75a583f017
Instruction ID: 562743b4ea70890c19695ec050af6595067d164859b1a098df77f842cda88b44
Opcode Fuzzy Hash: 50a04689e41c7baeb1c84eb7b19580049e14645f5addc38eae575c75a583f017
Instruction Fuzzy Hash: 315163B2E002149BDF10DFAADC84EEFB7B9AF49264F140529E815E7745E730AD05CBA1

Function 6C465E60 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 182threadstringtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C465E9D

Part of subcall function 6C475B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C4756EE,?,00000001), ref: 6C475B85
Part of subcall function 6C475B50: EnterCriticalSection.KERNEL32(6C4DF688,?,?,?,6C4756EE,?,00000001), ref: 6C475B90
Part of subcall function 6C475B50: LeaveCriticalSection.KERNEL32(6C4DF688,?,?,?,6C4756EE,?,00000001), ref: 6C475BD8
Part of subcall function 6C475B50: GetTickCount64.KERNEL32 ref: 6C475BE4

GetCurrentThreadId.KERNEL32 ref: 6C465EAB
GetCurrentThreadId.KERNEL32 ref: 6C465EB8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C465ECF
memcpy.VCRUNTIME140(00000000,GeckoMain,00000000), ref: 6C466017

Part of subcall function 6C454310: moz_xmalloc.MOZGLUE(00000010,?,6C4542D2), ref: 6C45436A
Part of subcall function 6C454310: memcpy.VCRUNTIME140(00000023,?,?,?,?,6C4542D2), ref: 6C454387

moz_xmalloc.MOZGLUE(00000004), ref: 6C465F47
GetCurrentProcess.KERNEL32 ref: 6C465F53
GetCurrentThread.KERNEL32 ref: 6C465F5C
GetCurrentProcess.KERNEL32 ref: 6C465F66
DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C465F7E
moz_xmalloc.MOZGLUE(00000024), ref: 6C465F27

Part of subcall function 6C46CA10: mozalloc_abort.MOZGLUE(?), ref: 6C46CAA2

moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C4655E1), ref: 6C465E8C

Part of subcall function 6C46CA10: malloc.MOZGLUE(?), ref: 6C46CA26

moz_xmalloc.MOZGLUE(00000050,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C4655E1), ref: 6C46605D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C4655E1), ref: 6C4660CC

Strings

GeckoMain, xrefs: 6C465ECE, 6C466015

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: Currentmoz_xmalloc$Thread$CriticalProcessSectionmemcpy$Count64CounterDuplicateEnterHandleLeaveNow@PerformanceQueryStamp@mozilla@@TickTimeV12@_freemallocmozalloc_abortstrlen
String ID: GeckoMain
API String ID: 3711609982-966795396
Opcode ID: 74209f567f5df5e2a8da45842e05564f42f895c086b9502a15c0caeacf316730
Instruction ID: b754c82b4f0eec265528107f467987b9a3e97a07bb798ad0992a0be31a50a776
Opcode Fuzzy Hash: 74209f567f5df5e2a8da45842e05564f42f895c086b9502a15c0caeacf316730
Instruction Fuzzy Hash: 1971AEB0A057409FD710EF29D480EAABBF0BF59304F54496DE8868BF52D731E958CB92

Function 6C469590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C4531C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6C453217
Part of subcall function 6C4531C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6C453236
Part of subcall function 6C4531C0: FreeLibrary.KERNEL32 ref: 6C45324B
Part of subcall function 6C4531C0: __Init_thread_footer.LIBCMT ref: 6C453260
Part of subcall function 6C4531C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6C45327F
Part of subcall function 6C4531C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C45328E
Part of subcall function 6C4531C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C4532AB
Part of subcall function 6C4531C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C4532D1
Part of subcall function 6C4531C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C4532E5
Part of subcall function 6C4531C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C4532F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C469675
__Init_thread_footer.LIBCMT ref: 6C469697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C4696E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C469707
__Init_thread_footer.LIBCMT ref: 6C46971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C469773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C4697B7
FreeLibrary.KERNEL32 ref: 6C4697D0
FreeLibrary.KERNEL32 ref: 6C4697EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C469824

Strings

ntdll.dll, xrefs: 6C4696E3
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C469670
MapViewOfFileNuma2, xrefs: 6C4697B1
NtMapViewOfSection, xrefs: 6C469701

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: 3ac359178766b36e170509a8fe3f625ba5a917dfdf2ee55335feac4e89fc05f8
Instruction ID: 2dde13dc307f8051a99a34a6a83b536cde64973097cdf4a16a30e2af30632f5e
Opcode Fuzzy Hash: 3ac359178766b36e170509a8fe3f625ba5a917dfdf2ee55335feac4e89fc05f8
Instruction Fuzzy Hash: E461C171B01206DBEF10FFA9D884F9A7BB1EB4A316F008529ED1587B84D771B844CB91

Function 6C4B6660 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 162threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6C4DF618), ref: 6C4B6694
GetThreadId.KERNEL32(?), ref: 6C4B66B1
GetCurrentThreadId.KERNEL32 ref: 6C4B66B9
memset.VCRUNTIME140(?,00000000,00000100), ref: 6C4B66E1
EnterCriticalSection.KERNEL32(6C4DF618), ref: 6C4B6734
GetCurrentProcess.KERNEL32 ref: 6C4B673A
LeaveCriticalSection.KERNEL32(6C4DF618), ref: 6C4B676C
GetCurrentThread.KERNEL32 ref: 6C4B67FC
memset.VCRUNTIME140(?,00000000,000002C8), ref: 6C4B6868
RtlCaptureContext.NTDLL ref: 6C4B687F

Strings

WalkStack64, xrefs: 6C4B6890

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: CriticalCurrentSectionThread$memset$CaptureContextEnterInitializeLeaveProcess
String ID: WalkStack64
API String ID: 2357170935-3499369396
Opcode ID: 307f284a6e04357b31b1b73686fff8e393c9154d2dcfd6b26e93de29fbcd6ca1
Instruction ID: 22895a64192276a0775694bc744148a84eef047e5cfc797a45e5e40b28244647
Opcode Fuzzy Hash: 307f284a6e04357b31b1b73686fff8e393c9154d2dcfd6b26e93de29fbcd6ca1
Instruction Fuzzy Hash: 75516A71A09301AFDB15EF24C844E9ABBF4BF89714F04492DF999A7740D770E909CBA2

Function 6C49DE60 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 135threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C499420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C464A68), ref: 6C49945E
Part of subcall function 6C499420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C499470
Part of subcall function 6C499420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C499482
Part of subcall function 6C499420: __Init_thread_footer.LIBCMT ref: 6C49949F

GetCurrentThreadId.KERNEL32 ref: 6C49DE73
GetCurrentThreadId.KERNEL32 ref: 6C49DF7D
AcquireSRWLockExclusive.KERNEL32(6C4DF4B8), ref: 6C49DF8A
ReleaseSRWLockExclusive.KERNEL32(6C4DF4B8), ref: 6C49DFC9
GetCurrentThreadId.KERNEL32 ref: 6C49DFF7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C49E000
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C464A68), ref: 6C49DE7B

Part of subcall function 6C4994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C4994EE
Part of subcall function 6C4994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C499508

Part of subcall function 6C48CBE8: GetCurrentProcess.KERNEL32(?,6C4531A7), ref: 6C48CBF1
Part of subcall function 6C48CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C4531A7), ref: 6C48CBFA

?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C464A68), ref: 6C49DEB8
free.MOZGLUE(00000000,?,6C464A68), ref: 6C49DEFE
?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C49DF38

Strings

<none>, xrefs: 6C49DFD7
[I %d/%d] locked_profiler_stop, xrefs: 6C49DE83
[I %d/%d] profiler_set_process_name("%s", "%s"), xrefs: 6C49E00E

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: CurrentThread$getenv$ExclusiveLockProcessRelease_getpid$AcquireBufferEnterExit@mozilla@@Init_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@ProfilerRegisterTerminate__acrt_iob_func__stdio_common_vfprintffree
String ID: <none>$[I %d/%d] locked_profiler_stop$[I %d/%d] profiler_set_process_name("%s", "%s")
API String ID: 1281939033-809102171
Opcode ID: 4940ff87a66e371463ccb9a17462d52c14ab5288d0dd032fcd2dfa8d00913885
Instruction ID: 5dfea2972adb865803b9bae7cb1dca0e8e41fa8b90e693a1be33ea9f6c07ede4
Opcode Fuzzy Hash: 4940ff87a66e371463ccb9a17462d52c14ab5288d0dd032fcd2dfa8d00913885
Instruction Fuzzy Hash: 8841D635B025219BEB20FF64DC08FAABB75EB5531EF144019E90A97B05CB31B805C7E2

Function 6C4AD840 Relevance: 21.2, APIs: 14, Instructions: 206threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C4AD85F
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C4AD86C
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C4AD918
GetCurrentThreadId.KERNEL32 ref: 6C4AD93C
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C4AD948
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C4AD970
GetCurrentThreadId.KERNEL32 ref: 6C4AD976
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C4AD982
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C4AD9CF
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C4ADA2E
GetCurrentThreadId.KERNEL32 ref: 6C4ADA6F
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C4ADA78
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE ref: 6C4ADA91

Part of subcall function 6C475C50: GetTickCount64.KERNEL32 ref: 6C475D40
Part of subcall function 6C475C50: EnterCriticalSection.KERNEL32(6C4DF688), ref: 6C475D67

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C4ADAB7

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Count64CriticalEnterSectionStampTickTimeV01@@Value@mozilla@@Xbad_function_call@std@@
String ID:
API String ID: 1195625958-0
Opcode ID: b3545b5eca4c8e6ee5195cbea0df8bf371314017d377604b180d5ef1e72ec145
Instruction ID: 9236f36354ea9f88652eb5046ca5a2e3a4818c3ab0133fd25a6bff9f2a59aff6
Opcode Fuzzy Hash: b3545b5eca4c8e6ee5195cbea0df8bf371314017d377604b180d5ef1e72ec145
Instruction Fuzzy Hash: C871B9756003049FCB00EF69C888F9ABBB6FF89314F15856EEC5A9B315DB30A945CB91

Function 6C4AD4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C4AD4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C4AD4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C4AD52A
GetCurrentThreadId.KERNEL32 ref: 6C4AD530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C4AD53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C4AD55F
free.MOZGLUE(00000000), ref: 6C4AD585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C4AD5D3
GetCurrentThreadId.KERNEL32 ref: 6C4AD5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C4AD605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C4AD652
GetCurrentThreadId.KERNEL32 ref: 6C4AD658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C4AD667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C4AD6A2

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: 52a58a66c9bf4d0294ea9dc700faaa5af7be3c05970922cb916a5fa71e6c4654
Instruction ID: 5c5da4fd267d458c58a0c4b768c3f8d25194e0567713e4e4ebfe7f8d58b14ee2
Opcode Fuzzy Hash: 52a58a66c9bf4d0294ea9dc700faaa5af7be3c05970922cb916a5fa71e6c4654
Instruction Fuzzy Hash: 53514AB1604705DFC704EF65C888A9ABBB5FF89318F108A2EE95A87711DB30E945CB91

Function 6C451E90 Relevance: 19.6, APIs: 9, Strings: 4, Instructions: 120COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C4DE784), ref: 6C451EC1
LeaveCriticalSection.KERNEL32(6C4DE784), ref: 6C451EE1
EnterCriticalSection.KERNEL32(6C4DE744), ref: 6C451F38
LeaveCriticalSection.KERNEL32(6C4DE744), ref: 6C451F5C
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6C451F83
LeaveCriticalSection.KERNEL32(6C4DE784), ref: 6C451FC0
EnterCriticalSection.KERNEL32(6C4DE784), ref: 6C451FE2
LeaveCriticalSection.KERNEL32(6C4DE784), ref: 6C451FF6
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C452019

Strings

MOZ_CRASH(), xrefs: 6C452000
DMl, xrefs: 6C451F32
\Ml, xrefs: 6C451F3E
DMl, xrefs: 6C451F56

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$FreeVirtualmemset
String ID: DMl$DMl$MOZ_CRASH()$\Ml
API String ID: 2055633661-2176146894
Opcode ID: d31ed7013f1b6e5a1967d4463a6da2fe0932be212fd803b6d05436b79a6fbd7f
Instruction ID: a91c11454add168c8f4f7731f3411bc0c8cc9fc68944d84a42fab4e0335a88ae
Opcode Fuzzy Hash: d31ed7013f1b6e5a1967d4463a6da2fe0932be212fd803b6d05436b79a6fbd7f
Instruction Fuzzy Hash: 8741BE72F0131A8BDF40FF68C8C8FAABAB5EB4A349F050129E90597745DB71E8048BD5

Function 6C475670 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 272timeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_APP_RESTART), ref: 6C4756D1
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C4756E9
?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ.MOZGLUE ref: 6C4756F1
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6C475744
??0TimeStampValue@mozilla@@AAE@_K0_N@Z.MOZGLUE(?,?,?,?,?), ref: 6C4757BC
GetTickCount64.KERNEL32 ref: 6C4758CB
EnterCriticalSection.KERNEL32(6C4DF688), ref: 6C4758F3
__aulldiv.LIBCMT ref: 6C475945
LeaveCriticalSection.KERNEL32(6C4DF688), ref: 6C4759B2
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(6C4DF638,?,?,?,?), ref: 6C4759E9

Strings

MOZ_APP_RESTART, xrefs: 6C4756CC

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampStamp@mozilla@@Value@mozilla@@$BaseComputeCount64DurationEnterFromLeaveMilliseconds@Now@PlatformProcessTickTicksUptime@Utils@mozilla@@V01@@V12@___aulldivgetenv
String ID: MOZ_APP_RESTART
API String ID: 2752551254-2657566371
Opcode ID: a566963fe5a6a25f4eeacacce49d70bcaee9696410eb68452060d5c9ea4a6c89
Instruction ID: 633c8166c7390a48f21cf1ed82cd2ef5a82dcde592861359b527f736d064c1af
Opcode Fuzzy Hash: a566963fe5a6a25f4eeacacce49d70bcaee9696410eb68452060d5c9ea4a6c89
Instruction Fuzzy Hash: 2EC17C71A097409FDB15EF28C440AAAF7F1BFDA714F058A1DE8C497760D730A986CB92

Function 6C49EC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C499420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C464A68), ref: 6C49945E
Part of subcall function 6C499420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C499470
Part of subcall function 6C499420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C499482
Part of subcall function 6C499420: __Init_thread_footer.LIBCMT ref: 6C49949F

GetCurrentThreadId.KERNEL32 ref: 6C49EC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C49EC8C

Part of subcall function 6C4994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C4994EE
Part of subcall function 6C4994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C499508

GetCurrentThreadId.KERNEL32 ref: 6C49ECA1
AcquireSRWLockExclusive.KERNEL32(6C4DF4B8), ref: 6C49ECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6C49ECC5
ReleaseSRWLockExclusive.KERNEL32(6C4DF4B8), ref: 6C49ED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C49ED19
CloseHandle.KERNEL32(?), ref: 6C49ED28
free.MOZGLUE(00000000), ref: 6C49ED2F
ReleaseSRWLockExclusive.KERNEL32(6C4DF4B8), ref: 6C49ED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6C49EC94

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: 6df723ee2a113c64ec1c0f66b56970cf77c0df65295368df4b102dc29af3da47
Instruction ID: 444115c19cea190029eb5dd641840e4b772fb9db54c4082f25d3d843272a7c33
Opcode Fuzzy Hash: 6df723ee2a113c64ec1c0f66b56970cf77c0df65295368df4b102dc29af3da47
Instruction Fuzzy Hash: C321BF75600125ABEB00FF24DC48F9A3B7AFB5626EF144218F91897741DB31A806CBE1

Function 6C498ED0 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 6C45EB30: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C45EB83

?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z.MOZGLUE(?,?,00000004,?,?,?,?,?,?,6C49B392,?,?,00000001), ref: 6C4991F4

Part of subcall function 6C48CBE8: GetCurrentProcess.KERNEL32(?,6C4531A7), ref: 6C48CBF1
Part of subcall function 6C48CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C4531A7), ref: 6C48CBFA

Strings

timeline-ipc, xrefs: 6C499096
timeline-overview, xrefs: 6C49907A
name, xrefs: 6C498F16
timeline-fileio, xrefs: 6C4990A4
data, xrefs: 6C4990E8
timeline-memory, xrefs: 6C499088
marker-chart, xrefs: 6C49905E
stack-chart, xrefs: 6C4990B2
marker-table, xrefs: 6C49906C

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: Process$CurrentFormatFormat@12@@MarkerP@@2@Schema@mozilla@@Span@Span@$$StringTerminatefree
String ID: data$marker-chart$marker-table$name$stack-chart$timeline-fileio$timeline-ipc$timeline-memory$timeline-overview
API String ID: 3790164461-3347204862
Opcode ID: f69045cefd4e651267b3c7d8348501a0a44551632b926107e61db433e00048bc
Instruction ID: 30b271861c3d9aa32f0646b1ab273d2ddcb9d79e08d390087cbd646e111c3e8f
Opcode Fuzzy Hash: f69045cefd4e651267b3c7d8348501a0a44551632b926107e61db433e00048bc
Instruction Fuzzy Hash: 50B1B0B0B012199FDB04DF99C492FAEBFB5AB84318F104429D506ABF94C732A955CBD1

Function 6C47C570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C47C5A3
WideCharToMultiByte.KERNEL32 ref: 6C47C9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C47C9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6C47CA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C47CA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C47CAA5

Strings

(null), xrefs: 6C47C596
0, xrefs: 6C47D30A

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: 8a83a32dc44d0f4068422d9ede4bbbcad783a3291dae7cb633fa91c1d0ddf94d
Instruction ID: 023e4248876c9de895765a330557cb7dc0925a1c9d79441ab0392aee5d30fdc3
Opcode Fuzzy Hash: 8a83a32dc44d0f4068422d9ede4bbbcad783a3291dae7cb633fa91c1d0ddf94d
Instruction Fuzzy Hash: 46A17F306083419FDB20EF28C584F9ABBF5AF89759F04892DE899D7751D731E805CBA2

Function 6C47C769 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 159COMMON

Download Yara Rule

APIs

islower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C47C784
_dsign.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C47C801
_dtest.API-MS-WIN-CRT-MATH-L1-1-0(?), ref: 6C47C83D
?ToPrecision@DoubleToStringConverter@double_conversion@@QBE_NNHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C47C891

Strings

nan, xrefs: 6C47C7A8
INF, xrefs: 6C47C794
NAN, xrefs: 6C47C7AD
inf, xrefs: 6C47C78F

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@DoublePrecision@_dsign_dtestislower
String ID: INF$NAN$inf$nan
API String ID: 1991403756-4166689840
Opcode ID: 4bc0b84da1cf7f5f08b0467f3588d42b1455fece5a31ddae046bd975cd1ca2e8
Instruction ID: 00f972358a95544b506ac061117854844ad6737af7a73a20aa0b1c6e758036c3
Opcode Fuzzy Hash: 4bc0b84da1cf7f5f08b0467f3588d42b1455fece5a31ddae046bd975cd1ca2e8
Instruction Fuzzy Hash: 9E5171709087408BD710EF6CC581E9AFBF0BF8A319F018A2DE9D5A7651E770D9898B52

Function 6C453480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6C453284,?,?,6C4756F6), ref: 6C453492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6C453284,?,?,6C4756F6), ref: 6C4534A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6C453284,?,?,6C4756F6), ref: 6C4534EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6C45350E
__Init_thread_footer.LIBCMT ref: 6C453522
__aulldiv.LIBCMT ref: 6C453552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6C453284,?,?,6C4756F6), ref: 6C45357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6C453284,?,?,6C4756F6), ref: 6C453592

Part of subcall function 6C48AB89: EnterCriticalSection.KERNEL32(6C4DE370,?,?,?,6C4534DE,6C4DF6CC,?,?,?,?,?,?,?,6C453284), ref: 6C48AB94
Part of subcall function 6C48AB89: LeaveCriticalSection.KERNEL32(6C4DE370,?,6C4534DE,6C4DF6CC,?,?,?,?,?,?,?,6C453284,?,?,6C4756F6), ref: 6C48ABD1

Strings

kernel32.dll, xrefs: 6C4534EA
GetSystemTimePreciseAsFileTime, xrefs: 6C453508

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: 403d24ae5a9db7d7c1afd6c55ed0e8b0d3d47ae539887eed24f0c3b523e8301f
Instruction ID: 160f7b39dcb085eddc03c19d4cf1d065d2c96e00667a2f80e4218319c1f23d14
Opcode Fuzzy Hash: 403d24ae5a9db7d7c1afd6c55ed0e8b0d3d47ae539887eed24f0c3b523e8301f
Instruction Fuzzy Hash: E5318F71B0120A9BEF10FFB9C848EAA7BB5FB46315F104419E50193B50EA70B905CB60

Function 6C454480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6C494843,?), ref: 6C4545F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6C494843,?), ref: 6C45468A
free.MOZGLUE(?,?,?,?,?,?,6C494843,?), ref: 6C4546C9
free.MOZGLUE(?), ref: 6C4546EF
free.MOZGLUE(?), ref: 6C454712
free.MOZGLUE(?), ref: 6C454735
free.MOZGLUE(?), ref: 6C454758
free.MOZGLUE(?), ref: 6C45477B
free.MOZGLUE(?), ref: 6C45479E

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: 2141246b4a9a9d30454759b69687fedb9b2af5cd347aafb1ab122e7c1cef1b9e
Instruction ID: ee25caa01a9d71f0fdcf1ba746703ce33a0e6da15a5ad3a0337082c9e3495d27
Opcode Fuzzy Hash: 2141246b4a9a9d30454759b69687fedb9b2af5cd347aafb1ab122e7c1cef1b9e
Instruction Fuzzy Hash: A2B1F175A001508FDB18DF3CD890F6D76A2AF423A8F98162CE816DFBC6D73099748B91

Function 6C4BAC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6C4BAC52
CreateFileMappingW.KERNEL32 ref: 6C4BAC7D
GetSystemInfo.KERNEL32 ref: 6C4BAC98
MapViewOfFile.KERNEL32 ref: 6C4BACB0
GetSystemInfo.KERNEL32 ref: 6C4BACCD
MapViewOfFile.KERNEL32 ref: 6C4BAD05
UnmapViewOfFile.KERNEL32 ref: 6C4BAD1C
CloseHandle.KERNEL32 ref: 6C4BAD28
UnmapViewOfFile.KERNEL32 ref: 6C4BAD37
CloseHandle.KERNEL32 ref: 6C4BAD43
CloseHandle.KERNEL32 ref: 6C4BAD67

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: 89d2f5d653dbab0c71776490656a902afe0dd62971ea945ae167c160286675fa
Instruction ID: 3bcf7069ed2c51d286f9f62f624b93ffa187902f5a242620ee8e8dc99018c120
Opcode Fuzzy Hash: 89d2f5d653dbab0c71776490656a902afe0dd62971ea945ae167c160286675fa
Instruction Fuzzy Hash: 28314CB1A047058FDB00FF7CD648A6EBBF1BF85705F014A2DE98597251EB70A548CB92

Function 6C469620 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C469675
__Init_thread_footer.LIBCMT ref: 6C469697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C4696E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C469707
__Init_thread_footer.LIBCMT ref: 6C46971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C469773

Part of subcall function 6C48AB89: EnterCriticalSection.KERNEL32(6C4DE370,?,?,?,6C4534DE,6C4DF6CC,?,?,?,?,?,?,?,6C453284), ref: 6C48AB94
Part of subcall function 6C48AB89: LeaveCriticalSection.KERNEL32(6C4DE370,?,6C4534DE,6C4DF6CC,?,?,?,?,?,?,?,6C453284,?,?,6C4756F6), ref: 6C48ABD1

GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C4697B7
FreeLibrary.KERNEL32 ref: 6C4697D0
FreeLibrary.KERNEL32 ref: 6C4697EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C469824

Strings

ntdll.dll, xrefs: 6C4696E3
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C469670
MapViewOfFileNuma2, xrefs: 6C4697B1
NtMapViewOfSection, xrefs: 6C469701

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: Library$AddressCriticalErrorFreeInit_thread_footerLastLoadProcSection$EnterLeave
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 409848716-3880535382
Opcode ID: 4072cc59d9aa95f32602ef838d011af5bfed35e3f645ae357659d1cb5cc451de
Instruction ID: 7130fb472cd690a9866359ee9970095d8ab88e0e3d16464ee83966a5610d40bf
Opcode Fuzzy Hash: 4072cc59d9aa95f32602ef838d011af5bfed35e3f645ae357659d1cb5cc451de
Instruction Fuzzy Hash: E2419F70B012069BEF10FFA5D894ED67BB4EB49756F014528ED1587B84D771F804CBA1

Function 6C4A0000 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 127threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C499420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C464A68), ref: 6C49945E
Part of subcall function 6C499420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C499470
Part of subcall function 6C499420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C499482
Part of subcall function 6C499420: __Init_thread_footer.LIBCMT ref: 6C49949F

GetCurrentThreadId.KERNEL32 ref: 6C4A0039
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C4A0041
GetCurrentThreadId.KERNEL32 ref: 6C4A0075
AcquireSRWLockExclusive.KERNEL32(6C4DF4B8), ref: 6C4A0082
moz_xmalloc.MOZGLUE(00000048), ref: 6C4A0090
free.MOZGLUE(?), ref: 6C4A0104
ReleaseSRWLockExclusive.KERNEL32(6C4DF4B8), ref: 6C4A011B

Strings

[D %d/%d] profiler_register_page(%llu, %llu, %s, %llu), xrefs: 6C4A005B

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease_getpidfreemoz_xmalloc
String ID: [D %d/%d] profiler_register_page(%llu, %llu, %s, %llu)
API String ID: 3012294017-637075127
Opcode ID: dfd761f53c47cbebce5fe62cf69ff6a0e88366c9562cad91a0fd9235b9a20d75
Instruction ID: 21139f17d1e18c84ce4ecca9d3ac2d64aa6e13d0bee0a84ca9eb9eb92d14af4c
Opcode Fuzzy Hash: dfd761f53c47cbebce5fe62cf69ff6a0e88366c9562cad91a0fd9235b9a20d75
Instruction Fuzzy Hash: 7D419D716012549FDB20EF65C840E9ABBF1FF59318F44451EE95A83B40DB31F815CBA2

Function 6C467E90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 116stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C467EA7
malloc.MOZGLUE(00000001), ref: 6C467EB3

Part of subcall function 6C46CAB0: EnterCriticalSection.KERNEL32(?), ref: 6C46CB49
Part of subcall function 6C46CAB0: LeaveCriticalSection.KERNEL32(?), ref: 6C46CBB6

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6C467EC4
mozalloc_abort.MOZGLUE(?), ref: 6C467F19
malloc.MOZGLUE(?), ref: 6C467F36
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C467F4D

Strings

d, xrefs: 6C467F89

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: CriticalSectionmalloc$EnterLeavememcpymozalloc_abortstrlenstrncpy
String ID: d
API String ID: 204725295-2564639436
Opcode ID: 68f145bd83ca5795a38093415b43b4865af079824171d2628625fdfe3e868f63
Instruction ID: c3bb26ed1358d0d167101ac8804ba444db414387fda3d6829015ad69577ffad9
Opcode Fuzzy Hash: 68f145bd83ca5795a38093415b43b4865af079824171d2628625fdfe3e868f63
Instruction Fuzzy Hash: 5831E761E0438897DB01EB69DC44EFEB778EF96208F055628ED4957622FB30A6C8C390

Function 6C463E80 Relevance: 13.7, APIs: 9, Instructions: 246memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?), ref: 6C463EEE
RtlFreeHeap.NTDLL ref: 6C463FDC
RtlAllocateHeap.NTDLL(?,00000000,00000040), ref: 6C464006
RtlFreeHeap.NTDLL ref: 6C4640A1
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C463CCC), ref: 6C4640AF
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C463CCC), ref: 6C4640C2
RtlFreeHeap.NTDLL ref: 6C464134
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,?,?,?,?,6C463CCC), ref: 6C464143
RtlFreeUnicodeString.NTDLL(?,?,?,00000000,?,?,?,?,?,?,6C463CCC), ref: 6C464157

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: Free$Heap$StringUnicode$Allocate
String ID:
API String ID: 3680524765-0
Opcode ID: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction ID: b9f1a9ab5642bfb992198355537e182e00c201d195b18bf4ff9f27d81aea81a7
Opcode Fuzzy Hash: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction Fuzzy Hash: BAA19FB1A00215CFDB44CF2AC880F59B7B5BF48348F2541A9D909AFB56D731E886CFA0

Function 6C452030 Relevance: 13.7, APIs: 7, Strings: 2, Instructions: 204memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,6C473F47,?,?,?,6C473F47,6C471A70,?), ref: 6C45207F
memset.VCRUNTIME140(?,000000E5,6C473F47,?,6C473F47,6C471A70,?), ref: 6C4520DD
VirtualFree.KERNEL32(00100000,00100000,00004000,?,6C473F47,6C471A70,?), ref: 6C45211A
EnterCriticalSection.KERNEL32(6C4DE744,?,6C473F47,6C471A70,?), ref: 6C452145
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004,?,6C473F47,6C471A70,?), ref: 6C4521BA
EnterCriticalSection.KERNEL32(6C4DE744,?,6C473F47,6C471A70,?), ref: 6C4521E0
LeaveCriticalSection.KERNEL32(6C4DE744,?,6C473F47,6C471A70,?), ref: 6C452232

Strings

MOZ_CRASH(), xrefs: 6C45227D
MOZ_RELEASE_ASSERT(node->mArena == this), xrefs: 6C452253, 6C452268

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: CriticalSection$EnterVirtual$AllocFreeLeavememcpymemset
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(node->mArena == this)
API String ID: 889484744-884734703
Opcode ID: ad016427884e61e4f47a06985befe7dbcda9a47ed27e67d4ccae7e38853b0a58
Instruction ID: ae4843891cbdfa1856cb05284e5fedba4b22866468343888d5af7b4bb18abb12
Opcode Fuzzy Hash: ad016427884e61e4f47a06985befe7dbcda9a47ed27e67d4ccae7e38853b0a58
Instruction Fuzzy Hash: 6361D831F012168FCB14DE68C989F6E77B1AF85315F59413AF624A7B94DB70AD10CB81

Function 6C4A9D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C4A8273), ref: 6C4A9D65
free.MOZGLUE(6C4A8273,?), ref: 6C4A9D7C
free.MOZGLUE(?,?), ref: 6C4A9D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C4A9E0F
free.MOZGLUE(6C4A946B,?,?), ref: 6C4A9E24
free.MOZGLUE(?,?,?), ref: 6C4A9E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C4A9EC8
free.MOZGLUE(6C4A946B,?,?,?), ref: 6C4A9EDF
free.MOZGLUE(?,?,?,?), ref: 6C4A9EF5

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 2b012af433d8a62e59196f5abf0db1225cc556eead2ae7a1713c1c06aadad8ca
Instruction ID: f26d2f4306497da9a9e16ea6169ea6ab951de051670a55dade36b55294e995a6
Opcode Fuzzy Hash: 2b012af433d8a62e59196f5abf0db1225cc556eead2ae7a1713c1c06aadad8ca
Instruction Fuzzy Hash: 40716A70909B418BD712CF58C480D9BF3F4BFA9315B44861DE85A5BB06EB32E886CBD1

Function 6C4ADDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6C4ADDCF

Part of subcall function 6C48FA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C48FA4B

Part of subcall function 6C4A90E0: free.MOZGLUE(?,00000000,?,?,6C4ADEDB), ref: 6C4A90FF
Part of subcall function 6C4A90E0: free.MOZGLUE(?,00000000,?,?,6C4ADEDB), ref: 6C4A9108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C4ADE0D
free.MOZGLUE(00000000), ref: 6C4ADE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C4ADE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C4ADEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C4ADEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C49DEFD,?,6C464A68), ref: 6C4ADF32

Part of subcall function 6C4ADAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C4ADB86
Part of subcall function 6C4ADAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C4ADC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C49DEFD,?,6C464A68), ref: 6C4ADF65
free.MOZGLUE(?), ref: 6C4ADF80

Part of subcall function 6C475E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C475EDB
Part of subcall function 6C475E90: memset.VCRUNTIME140(ewKl,000000E5,?), ref: 6C475F27
Part of subcall function 6C475E90: LeaveCriticalSection.KERNEL32(?), ref: 6C475FB2

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: afa130643346d167d9bd79d80d1b169759e4ab86fbaf487182767b26bf27b7d6
Instruction ID: 45dfeb5774b0fceb8bb0937260da71ab2a0ae2f539c28fb49502f3abc3cb6a79
Opcode Fuzzy Hash: afa130643346d167d9bd79d80d1b169759e4ab86fbaf487182767b26bf27b7d6
Instruction Fuzzy Hash: 0C519272601A019BD721DB98C880EAFB3B2AFA5359F95011CDC1A57B04D731B81BCBD2

Function 6C4B5D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6C4B5C8C,?,6C48E829), ref: 6C4B5D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6C4B5C8C,?,6C48E829), ref: 6C4B5D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6C4B5C8C,?,6C48E829), ref: 6C4B5D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6C4B5C8C,?,6C48E829), ref: 6C4B5D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6C4B5C8C,?,6C48E829), ref: 6C4B5DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6C4B5C8C,?,6C48E829), ref: 6C4B5DC9
std::_Facet_Register.LIBCPMT ref: 6C4B5DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6C4B5C8C,?,6C48E829), ref: 6C4B5E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6C4B5C8C,?,6C48E829), ref: 6C4B5E45

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: 03c21acd11d518a406f0c0355a58f91404a592bcbc67c33b331363129237bb72
Instruction ID: d7016ea65d1da698dcd5b32f1950de35943f3e3971cd366116bfbdb03dc0d5c1
Opcode Fuzzy Hash: 03c21acd11d518a406f0c0355a58f91404a592bcbc67c33b331363129237bb72
Instruction Fuzzy Hash: 9D4184347003058FDB10EFA5C898EADB7BAEF49315F14416CE506A7791DB34E905CBA1

Function 6C48CC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6C4531A7), ref: 6C48CDDD

Strings

<jemalloc>, xrefs: 6C48CF9F, 6C48CFB3
: (malloc) Error in VirtualFree(), xrefs: 6C48CFA4, 6C48CFB8

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: e365c648f2c940849b07029c4251ce7748cdc321d7e83b6920ad2aae21bd89e8
Instruction ID: cfab52aef12ad8461e42ab2825c7651474b36079123b97920b6f3aecfa16afc8
Opcode Fuzzy Hash: e365c648f2c940849b07029c4251ce7748cdc321d7e83b6920ad2aae21bd89e8
Instruction Fuzzy Hash: 7F316F30B422159BFB10FFA58855FAE7A76AB41759F204219F614EBBC0DB70E5018BA1

Function 6C45ECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6C45F100: LoadLibraryW.KERNEL32(shell32,?,6C4CD020), ref: 6C45F122
Part of subcall function 6C45F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C45F132

moz_xmalloc.MOZGLUE(00000012), ref: 6C45ED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C45EDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6C45EDCC
CreateFileW.KERNEL32 ref: 6C45EE08
free.MOZGLUE(00000000), ref: 6C45EE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6C45EE32

Part of subcall function 6C45EB90: moz_xmalloc.MOZGLUE(00000104), ref: 6C45EBB5
Part of subcall function 6C45EB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6C48D7F3), ref: 6C45EBC3
Part of subcall function 6C45EB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6C48D7F3), ref: 6C45EBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6C45EDC1

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: aade4b130d6865b050fd8ae3d1f1fd9f454708d16a956bb827a695585ac2f2d2
Instruction ID: 15730473de8258f6833f3cc725fb80f90f60a1c7de9a5ee7ac96a14d2f48e250
Opcode Fuzzy Hash: aade4b130d6865b050fd8ae3d1f1fd9f454708d16a956bb827a695585ac2f2d2
Instruction Fuzzy Hash: 2D51F471E053058BDB00EF68C880FEEB7B0AF59318F84842DE8556B740E738A959C7E2

Function 6C4CA520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C4CA565

Part of subcall function 6C4CA470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C4CA4BE
Part of subcall function 6C4CA470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C4CA4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C4CA65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C4CA6B6

Strings

z, xrefs: 6C4CA6AE
0, xrefs: 6C4CA5FB

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: 161b08eecad56009d70b8b574e8ab2d2ad881f260641808011e85d6f05ea1531
Instruction ID: 3be5bf77fcb32e16209618501679afeae95de88f07b09774e6d488001d841b3e
Opcode Fuzzy Hash: 161b08eecad56009d70b8b574e8ab2d2ad881f260641808011e85d6f05ea1531
Instruction Fuzzy Hash: D0411775A097459FC341DF28C480E9ABBE5BF89354F408A2EF49987760EB30D549CB83

Function 6C499420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6C48AB89: EnterCriticalSection.KERNEL32(6C4DE370,?,?,?,6C4534DE,6C4DF6CC,?,?,?,?,?,?,?,6C453284), ref: 6C48AB94
Part of subcall function 6C48AB89: LeaveCriticalSection.KERNEL32(6C4DE370,?,6C4534DE,6C4DF6CC,?,?,?,?,?,?,?,6C453284,?,?,6C4756F6), ref: 6C48ABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C464A68), ref: 6C49945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C499470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C499482
__Init_thread_footer.LIBCMT ref: 6C49949F

Strings

MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C49946B
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C49947D
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C499459

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: 3915fab92df5c955be73346d44076694c849c2fec4e0bc7e90ee30e61aa544f4
Instruction ID: b7f0841684ef9baf7f4d61fa0fec0d67e9a084fcac0979008227e37aeab27521
Opcode Fuzzy Hash: 3915fab92df5c955be73346d44076694c849c2fec4e0bc7e90ee30e61aa544f4
Instruction Fuzzy Hash: 35014C30A051008FE710FB9CD810E4937B99B1632AF05453BDD0E86B51D732F4658957

Function 6C4A0F40 Relevance: 12.2, APIs: 8, Instructions: 171threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C4A0F6B
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C4A0F88
GetCurrentThreadId.KERNEL32 ref: 6C4A0FF7
InitializeConditionVariable.KERNEL32(?), ref: 6C4A1067
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(?,?,?), ref: 6C4A10A7
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(00000000,?), ref: 6C4A114B

Part of subcall function 6C498AC0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,6C4B1563), ref: 6C498BD5

free.MOZGLUE(?), ref: 6C4A1174
free.MOZGLUE(?), ref: 6C4A1186

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: ?profiler_capture_backtrace_into@baseprofiler@mozilla@@Buffer@2@CaptureChunkedCurrentNow@Options@2@@ProfileStackStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID:
API String ID: 2803333873-0
Opcode ID: 6facbb0a21fd0bd2db1538c8eb6a80bdb1642850c52fb2c5f6c53dc1598d491a
Instruction ID: 8762c4d75cf4ad1e13c2ad7dcf04b0e0192899f0729c7222ee61231930ad1304
Opcode Fuzzy Hash: 6facbb0a21fd0bd2db1538c8eb6a80bdb1642850c52fb2c5f6c53dc1598d491a
Instruction Fuzzy Hash: B761AC75A043409BDB10DF65C880F9AB7F5BFE9308F04891DE89A57715EB71E84ACB82

Function 6C45B630 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,?,6C45B61E,?,?,?,?,?,00000000), ref: 6C45B6AC

Part of subcall function 6C46CA10: malloc.MOZGLUE(?), ref: 6C46CA26

memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C45B61E,?,?,?,?,?,00000000), ref: 6C45B6D1
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?,?,?,6C45B61E,?,?,?,?,?,00000000), ref: 6C45B6E3
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C45B61E,?,?,?,?,?,00000000), ref: 6C45B70B
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,6C45B61E,?,?,?,?,?,00000000), ref: 6C45B71D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,6C45B61E), ref: 6C45B73F
moz_xmalloc.MOZGLUE(80000023,?,?,?,6C45B61E,?,?,?,?,?,00000000), ref: 6C45B760
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,6C45B61E,?,?,?,?,?,00000000), ref: 6C45B79A

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfreemalloc
String ID:
API String ID: 1394714614-0
Opcode ID: c63de032e3092dc333d364759612dbe7c0554cd3d7d6acf8e74579782501792d
Instruction ID: b109a96fa82084794d71de910a885f7ee213e5840cc3cd531ad1acfa73f579d3
Opcode Fuzzy Hash: c63de032e3092dc333d364759612dbe7c0554cd3d7d6acf8e74579782501792d
Instruction Fuzzy Hash: 0F41B3B2D001159FCB04DF68DC80EAEB7B5BB44324F650629E825E7790E731A9158BE2

Function 6C45EF30 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(6C4D5104), ref: 6C45EFAC
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C45EFD7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C45EFEC
free.MOZGLUE(?), ref: 6C45F00C
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C45F02E
memcpy.VCRUNTIME140(00000000,?), ref: 6C45F041
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C45F065
moz_xmalloc.MOZGLUE ref: 6C45F072

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 1148890222-0
Opcode ID: 76f144ff9ba8e69d1602376d6a55644a1f50479114a061b893a67dcca03e1f24
Instruction ID: dcc7e844037fb7c7e584b096199b7ceee4c5831d7e0232cc2cd19dfd9ada43f8
Opcode Fuzzy Hash: 76f144ff9ba8e69d1602376d6a55644a1f50479114a061b893a67dcca03e1f24
Instruction Fuzzy Hash: AC41E9B2A001159FDB08DF68DC80DAE7769FF84314B24022CE825DB7A4EB31E915C7E2

Function 6C4CB540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6C4CB5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C4CB5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C4CB5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C4CB5F4
__Init_thread_footer.LIBCMT ref: 6C4CB605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6C4CB61F
std::_Facet_Register.LIBCPMT ref: 6C4CB631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C4CB655

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: d66804d9dc96082710e632bc36236e07d27352db5b6bceff339ff858280b64d6
Instruction ID: 83f1289427fc80dcfe537ad46c29268360a12e4be399bce96fbb5070dd9c2cfd
Opcode Fuzzy Hash: d66804d9dc96082710e632bc36236e07d27352db5b6bceff339ff858280b64d6
Instruction Fuzzy Hash: 1A31AF75B012048BDF10FFA9C898DAEB7B5EF8A325B150519D90297790DB34B806CBD2

Function 6C496590 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6C48FA80: GetCurrentThreadId.KERNEL32 ref: 6C48FA8D
Part of subcall function 6C48FA80: AcquireSRWLockExclusive.KERNEL32(6C4DF448), ref: 6C48FA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C496727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6C4967C8

Part of subcall function 6C4A4290: memcpy.VCRUNTIME140(?,?,6C4B2003,6C4B0AD9,?,6C4B0AD9,00000000,?,6C4B0AD9,?,00000004,?,6C4B1A62,?,6C4B2003,?), ref: 6C4A42C4

Strings

data, xrefs: 6C496593
vMl, xrefs: 6C49696C

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data$vMl
API String ID: 511789754-1398191368
Opcode ID: 11195e06454b15cc26145d3b9e2c627b2c6197423aa693b3227971ea54f02c45
Instruction ID: 5c00e6ad8af9b551a6ba6a16ffaad738320d1fa7bda01a4dceff7c14564b70e4
Opcode Fuzzy Hash: 11195e06454b15cc26145d3b9e2c627b2c6197423aa693b3227971ea54f02c45
Instruction Fuzzy Hash: 52D1BC75A093408FD764DF64C850FDEBBE5AFC5308F10492EE58987B91EB30A949CB92

Function 6C48D5D0 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6C45EB57,?,?,?,?,?,?,?,?,?), ref: 6C48D652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6C45EB57,?), ref: 6C48D660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C45EB57,?), ref: 6C48D673
free.MOZGLUE(?), ref: 6C48D888

Strings

WEl, xrefs: 6C48D5D9, 6C48D63F
|Enabled, xrefs: 6C48D81E

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: WEl$|Enabled
API String ID: 4142949111-3143443120
Opcode ID: 717f376b96c032d7d33503319600f1e4cf421d2f67af8c5db5b6ef2e0677aa27
Instruction ID: 1c3383fc6da8febeec1567f1d9fd0d2de8ae0690f225a052d63140e1847f81bf
Opcode Fuzzy Hash: 717f376b96c032d7d33503319600f1e4cf421d2f67af8c5db5b6ef2e0677aa27
Instruction Fuzzy Hash: 6EA10370A022099FDB11DF69C490FAEBBF1AF49318F58805ED895AB741C734E845CBA1

Function 6C46B790 Relevance: 10.6, APIs: 7, Instructions: 147COMMON

Download Yara Rule

APIs

?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C4ACC83,?,?,?,?,?,?,?,?,?,6C4ABCAE,?,?,6C49DC2C), ref: 6C46B7E6
?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C4ACC83,?,?,?,?,?,?,?,?,?,6C4ABCAE,?,?,6C49DC2C), ref: 6C46B80C
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,6C4ACC83,?,?,?,?,?,?,?,?,?,6C4ABCAE), ref: 6C46B88E
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ.MSVCP140(?,6C4ACC83,?,?,?,?,?,?,?,?,?,6C4ABCAE,?,?,6C49DC2C), ref: 6C46B896

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: ?good@ios_base@std@@D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@Osfx@?$basic_ostream@
String ID:
API String ID: 922945588-0
Opcode ID: ceb938aa9ac641ba9b69d6332e022c5acb66117c51c76d9b85f9520aab3284f1
Instruction ID: cfec88c01700933a7eaa8869aa4eb2a96857506ce40cc29b30c280e65505ca49
Opcode Fuzzy Hash: ceb938aa9ac641ba9b69d6332e022c5acb66117c51c76d9b85f9520aab3284f1
Instruction Fuzzy Hash: CA519F357006008FCB25DF5AC484E2AB7F5FF89319B69855DE99A87B55C731EC02DB80

Function 6C4A1D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C4A1D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6C4A1BE3,?,?,6C4A1D96,00000000), ref: 6C4A1D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6C4A1BE3,?,?,6C4A1D96,00000000), ref: 6C4A1D4C
GetCurrentThreadId.KERNEL32 ref: 6C4A1DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C4A1DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C4A1DDA

Part of subcall function 6C4A1EF0: GetCurrentThreadId.KERNEL32 ref: 6C4A1F03
Part of subcall function 6C4A1EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6C4A1DF2,00000000,00000000), ref: 6C4A1F0C
Part of subcall function 6C4A1EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6C4A1F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6C4A1DF4

Part of subcall function 6C46CA10: malloc.MOZGLUE(?), ref: 6C46CA26

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: f5c96aea7011486828464316ae145bc8e8a53c357d36a9791434d519b7e92f7a
Instruction ID: 482b4cb95df4de8cf99c7ad380d43401add128d518932f172dad41d843f94665
Opcode Fuzzy Hash: f5c96aea7011486828464316ae145bc8e8a53c357d36a9791434d519b7e92f7a
Instruction Fuzzy Hash: C54144B56017019FCB10EF69C888E56BBF9FB89318F10442EE99A87B41CB71F854CB91

Function 6C4984E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C4984F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C49850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C49851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C49855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C49856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C4985AC

Part of subcall function 6C497670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C4985B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C49767F
Part of subcall function 6C497670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C4985B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C497693
Part of subcall function 6C497670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C4985B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C4976A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C4985B2

Part of subcall function 6C475E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C475EDB
Part of subcall function 6C475E90: memset.VCRUNTIME140(ewKl,000000E5,?), ref: 6C475F27
Part of subcall function 6C475E90: LeaveCriticalSection.KERNEL32(?), ref: 6C475FB2

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: e3d29d8f4ac0c23802867387063a10e3de6e3afbc108e5df8f68a9489bd8fd03
Instruction ID: 0b269c0bd27e453c9d4dc841c415aed084d29e66d852a6444017a34353dace6f
Opcode Fuzzy Hash: e3d29d8f4ac0c23802867387063a10e3de6e3afbc108e5df8f68a9489bd8fd03
Instruction Fuzzy Hash: 6221AE742006019FDB14EB68C888E5ABBF5AF8432DF24092DE55BC3B41DB31F948CB91

Function 6C461640 Relevance: 10.6, APIs: 7, Instructions: 77COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000114), ref: 6C461699
VerSetConditionMask.NTDLL ref: 6C4616CB
VerSetConditionMask.NTDLL ref: 6C4616D7
VerSetConditionMask.NTDLL ref: 6C4616DE
VerSetConditionMask.NTDLL ref: 6C4616E5
VerSetConditionMask.NTDLL ref: 6C4616EC
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C4616F9

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemset
String ID:
API String ID: 375572348-0
Opcode ID: fdfe79f73992879bef0f6e6e8a6cc0e89f017495c8cca8a9d9cc85b3ce6f76fd
Instruction ID: f48986b03b2a71cc1d038508f6d04afcb5d9ff9894a44069371e0eb90fa763ab
Opcode Fuzzy Hash: fdfe79f73992879bef0f6e6e8a6cc0e89f017495c8cca8a9d9cc85b3ce6f76fd
Instruction Fuzzy Hash: B721A2B0B402086BFB11FA69CC85FBBB3BCEF86704F054528F6459B6C0C674AE54C6A1

Function 6C49F5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C48CBE8: GetCurrentProcess.KERNEL32(?,6C4531A7), ref: 6C48CBF1
Part of subcall function 6C48CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C4531A7), ref: 6C48CBFA

Part of subcall function 6C499420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C464A68), ref: 6C49945E
Part of subcall function 6C499420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C499470
Part of subcall function 6C499420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C499482
Part of subcall function 6C499420: __Init_thread_footer.LIBCMT ref: 6C49949F

GetCurrentThreadId.KERNEL32 ref: 6C49F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C49F598), ref: 6C49F621

Part of subcall function 6C4994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C4994EE
Part of subcall function 6C4994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C499508

GetCurrentThreadId.KERNEL32 ref: 6C49F637
AcquireSRWLockExclusive.KERNEL32(6C4DF4B8,?,?,00000000,?,6C49F598), ref: 6C49F645
ReleaseSRWLockExclusive.KERNEL32(6C4DF4B8,?,?,00000000,?,6C49F598), ref: 6C49F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C49F62A

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: 1724ddf0033c2042beed73282b47876c6fa26e28fbba67fe8b6d6fdce14bdd20
Instruction ID: 821eb09145b4450b436374a864a1426df13efd03739a73dde2e5fe1976569f08
Opcode Fuzzy Hash: 1724ddf0033c2042beed73282b47876c6fa26e28fbba67fe8b6d6fdce14bdd20
Instruction Fuzzy Hash: 7C11C475202215BBEA14FF58C848DA57B79FB86369B140019FA0587F01CB71BC12CBA0

Function 6C462070 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 68libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C48AB89: EnterCriticalSection.KERNEL32(6C4DE370,?,?,?,6C4534DE,6C4DF6CC,?,?,?,?,?,?,?,6C453284), ref: 6C48AB94
Part of subcall function 6C48AB89: LeaveCriticalSection.KERNEL32(6C4DE370,?,6C4534DE,6C4DF6CC,?,?,?,?,?,?,?,6C453284,?,?,6C4756F6), ref: 6C48ABD1

LoadLibraryW.KERNEL32(combase.dll,6C461C5F), ref: 6C4620AE
GetProcAddress.KERNEL32(00000000,CoInitializeSecurity), ref: 6C4620CD
__Init_thread_footer.LIBCMT ref: 6C4620E1
FreeLibrary.KERNEL32 ref: 6C462124

Strings

combase.dll, xrefs: 6C4620A9
CoInitializeSecurity, xrefs: 6C4620C7

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeSecurity$combase.dll
API String ID: 4190559335-2476802802
Opcode ID: 5c77125355e178be5610e6f0087db1de45bf35ca2d421ae8775e81bbc180e02d
Instruction ID: d78d947026e9df63dd1750b34e651b584769dec38f5cee6c4ad4b8f1fb0c0ff3
Opcode Fuzzy Hash: 5c77125355e178be5610e6f0087db1de45bf35ca2d421ae8775e81bbc180e02d
Instruction Fuzzy Hash: C9216D75202209BFEF21FF95DC58D9A3FB6FB0A365F008115FA0492A51DB31A861DF91

Function 6C4B76C0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 6C4B76F2
moz_xmalloc.MOZGLUE(00000001), ref: 6C4B7705

Part of subcall function 6C46CA10: malloc.MOZGLUE(?), ref: 6C46CA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C4B7717
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,6C4B778F,00000000,00000000,00000000,00000000), ref: 6C4B7731
free.MOZGLUE(00000000), ref: 6C4B7760

Strings

}>Il, xrefs: 6C4B76C4

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: ByteCharMultiWide$freemallocmemsetmoz_xmalloc
String ID: }>Il
API String ID: 2538299546-4082874104
Opcode ID: 2187ddda0387c4d0177649dfb88cbe25c0e5d54db797ed66b4eee277b8c162a8
Instruction ID: 3bbb45b269ed816773c740ee0a7f25277ad42af659b440df5b2664b8274a2ffb
Opcode Fuzzy Hash: 2187ddda0387c4d0177649dfb88cbe25c0e5d54db797ed66b4eee277b8c162a8
Instruction Fuzzy Hash: 731190B1D042156BE710EF6A9C44FABBEE8EF45354F04442DE848E7300E770984087F2

Function 6C461FA0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 60libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C48AB89: EnterCriticalSection.KERNEL32(6C4DE370,?,?,?,6C4534DE,6C4DF6CC,?,?,?,?,?,?,?,6C453284), ref: 6C48AB94
Part of subcall function 6C48AB89: LeaveCriticalSection.KERNEL32(6C4DE370,?,6C4534DE,6C4DF6CC,?,?,?,?,?,?,?,6C453284,?,?,6C4756F6), ref: 6C48ABD1

LoadLibraryW.KERNEL32(combase.dll,?), ref: 6C461FDE
GetProcAddress.KERNEL32(00000000,CoCreateInstance), ref: 6C461FFD
__Init_thread_footer.LIBCMT ref: 6C462011
FreeLibrary.KERNEL32 ref: 6C462059

Strings

combase.dll, xrefs: 6C461FD9
CoCreateInstance, xrefs: 6C461FF7

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoCreateInstance$combase.dll
API String ID: 4190559335-2197658831
Opcode ID: 2d90c7f724f8d7e982e233b4803a24e76d8e127674425a46788e89a8238298dd
Instruction ID: 8eab1d51d492c767350c48640c20197ab4a4f27aafbad90084a2343245de12c3
Opcode Fuzzy Hash: 2d90c7f724f8d7e982e233b4803a24e76d8e127674425a46788e89a8238298dd
Instruction Fuzzy Hash: EE114F75202255AFEF30FF55C86CE563B79EB46369F008019EA0592B41CB31B810DBA1

Function 6C460EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C48AB89: EnterCriticalSection.KERNEL32(6C4DE370,?,?,?,6C4534DE,6C4DF6CC,?,?,?,?,?,?,?,6C453284), ref: 6C48AB94
Part of subcall function 6C48AB89: LeaveCriticalSection.KERNEL32(6C4DE370,?,6C4534DE,6C4DF6CC,?,?,?,?,?,?,?,6C453284,?,?,6C4756F6), ref: 6C48ABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6C48D9F0,00000000), ref: 6C460F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6C460F3C
__Init_thread_footer.LIBCMT ref: 6C460F50
FreeLibrary.KERNEL32(?,6C48D9F0,00000000), ref: 6C460F86

Strings

combase.dll, xrefs: 6C460F18
CoInitializeEx, xrefs: 6C460F36

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: 472943014d2381835f2309f5de6d780f622cfc5799259f2160f825aeb0591631
Instruction ID: a13fa80e500eb17f22815fbb822decd6559af24ed7604bed005fb5afa5e9cebf
Opcode Fuzzy Hash: 472943014d2381835f2309f5de6d780f622cfc5799259f2160f825aeb0591631
Instruction Fuzzy Hash: AC11C2743132819BEF24FF99C928F4A37B4EB4B336F004629E90583B82D7B0B401CA59

Function 6C49F540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C499420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C464A68), ref: 6C49945E
Part of subcall function 6C499420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C499470
Part of subcall function 6C499420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C499482
Part of subcall function 6C499420: __Init_thread_footer.LIBCMT ref: 6C49949F

GetCurrentThreadId.KERNEL32 ref: 6C49F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C49F561

Part of subcall function 6C4994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C4994EE
Part of subcall function 6C4994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C499508

GetCurrentThreadId.KERNEL32 ref: 6C49F577
AcquireSRWLockExclusive.KERNEL32(6C4DF4B8), ref: 6C49F585
ReleaseSRWLockExclusive.KERNEL32(6C4DF4B8), ref: 6C49F5A3

Strings

[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C49F56A
[I %d/%d] profiler_pause_sampling, xrefs: 6C49F3A8
[I %d/%d] profiler_resume, xrefs: 6C49F239
[I %d/%d] profiler_resume_sampling, xrefs: 6C49F499

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: 7cfe58f1f6ea753c7680e713828388a80da10810357af7b45ad41307903a6b78
Instruction ID: 0619d0974291a148ae027db1124975eb5edb9599255f3cf63b2966351c0ae693
Opcode Fuzzy Hash: 7cfe58f1f6ea753c7680e713828388a80da10810357af7b45ad41307903a6b78
Instruction Fuzzy Hash: A6F0B475201214AFEA00FF659C48E5A7BBDEB9A26EF040019FA0583702CF31A80087A5

Function 6C460E40 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernel32.dll,6C460DF8), ref: 6C460E82
GetProcAddress.KERNEL32(00000000,GetProcessMitigationPolicy), ref: 6C460EA1
__Init_thread_footer.LIBCMT ref: 6C460EB5
FreeLibrary.KERNEL32 ref: 6C460EC5

Strings

GetProcessMitigationPolicy, xrefs: 6C460E9B
kernel32.dll, xrefs: 6C460E7D

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: Library$AddressFreeInit_thread_footerLoadProc
String ID: GetProcessMitigationPolicy$kernel32.dll
API String ID: 391052410-1680159014
Opcode ID: 33cddfae27aae0487854d267fee1f0a3cd1e36710fbf3f6aa54fd698bbdfcb7d
Instruction ID: fe0a8af7b2ab87ef0a852d6a6be50e41f069daf237a87b5fa49b65f6109903aa
Opcode Fuzzy Hash: 33cddfae27aae0487854d267fee1f0a3cd1e36710fbf3f6aa54fd698bbdfcb7d
Instruction Fuzzy Hash: 4D012474B022828BEE20FFA9CA58F8237B5E70671AF104529D90182F84DB74B4048A4A

Function 6C49F600 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C499420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C464A68), ref: 6C49945E
Part of subcall function 6C499420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C499470
Part of subcall function 6C499420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C499482
Part of subcall function 6C499420: __Init_thread_footer.LIBCMT ref: 6C49949F

GetCurrentThreadId.KERNEL32 ref: 6C49F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C49F598), ref: 6C49F621

Part of subcall function 6C4994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C4994EE
Part of subcall function 6C4994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C499508

GetCurrentThreadId.KERNEL32 ref: 6C49F637
AcquireSRWLockExclusive.KERNEL32(6C4DF4B8,?,?,00000000,?,6C49F598), ref: 6C49F645
ReleaseSRWLockExclusive.KERNEL32(6C4DF4B8,?,?,00000000,?,6C49F598), ref: 6C49F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C49F62A

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 2848912005-753366533
Opcode ID: 271e237e79070a18edc8a351a3ee16c431ad2d142f0406e35daae46fe2a2f30f
Instruction ID: 3d2b4a2fce74cd78a7abbfa465f407a6e1b46e7480bd5913e5f2a3f70bc71597
Opcode Fuzzy Hash: 271e237e79070a18edc8a351a3ee16c431ad2d142f0406e35daae46fe2a2f30f
Instruction Fuzzy Hash: C6F0BE75201214AFEE00FB648C48E5A7B7DEB9A2AEF040019FA0583701CB76AC0287A1

Function 6C4905F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6C48CFAE,?,?,?,6C4531A7), ref: 6C4905FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6C48CFAE,?,?,?,6C4531A7), ref: 6C490616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6C4531A7), ref: 6C49061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6C4531A7), ref: 6C490627

Strings

<jemalloc>, xrefs: 6C4905FA, 6C49060F
: (malloc) Error in VirtualFree(), xrefs: 6C49061B, 6C490625

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: 8ed4d9a9eb9bee8820bfade6afb2062a99eb5dcedd5a6625e60c9e3d4227eb00
Instruction ID: 7b2a03396663084e7a2b2d688322e836085341eed0c6799cddd799aaab830c0c
Opcode Fuzzy Hash: 8ed4d9a9eb9bee8820bfade6afb2062a99eb5dcedd5a6625e60c9e3d4227eb00
Instruction Fuzzy Hash: 09E08CE2A0101037F514B256BC86EBB761CDBC6134F08003DFE0D82351E94ABD1A51F7

Function 6C4605F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3a492f5e7608dea642bf14e1723a6d7bb5bc89bb0b9bd847fa4e7e8ef2f8eb5
Instruction ID: 5ec5c7b11d70cdbbae2af9e0c6e653a560ed44c1eea678dc42fc84cecd96d8ce
Opcode Fuzzy Hash: a3a492f5e7608dea642bf14e1723a6d7bb5bc89bb0b9bd847fa4e7e8ef2f8eb5
Instruction Fuzzy Hash: B6A146B0A016458FDB24DF2AC594E9AFBF1BF49304F44866ED44A97B00E770BA85CF94

Function 6C4B14A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C4B14C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C4B14E2
GetCurrentThreadId.KERNEL32 ref: 6C4B1546
InitializeConditionVariable.KERNEL32(?), ref: 6C4B15BA
free.MOZGLUE(?), ref: 6C4B16B4

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: 058ffa54c1eace82e95f1cb44d4f8435c8060f5253a49c7af3a9aa6c303b708c
Instruction ID: 15b3c07bfba072fa05534b8b61c2d01e19c93ed877bc3550711799970eeef717
Opcode Fuzzy Hash: 058ffa54c1eace82e95f1cb44d4f8435c8060f5253a49c7af3a9aa6c303b708c
Instruction Fuzzy Hash: 4F61BB72A017509BDB21DF64C880FDAB7B5BF89308F04851CE98A67711EB31E959CBA1

Function 6C4A9F40 Relevance: 9.2, APIs: 6, Instructions: 157timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C4A9FDB
free.MOZGLUE(?,?), ref: 6C4A9FF0
free.MOZGLUE(?,?), ref: 6C4AA006
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C4AA0BE
free.MOZGLUE(?,?), ref: 6C4AA0D5
free.MOZGLUE(?,?), ref: 6C4AA0EB

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 49e3b7e9bfc9d3090135017787c7a3e6f357f7d605344af5d66b7e37a1c81829
Instruction ID: 9fee62c1500382bd655795403c7c025cfea033727b633094d53e5d5a714db6a9
Opcode Fuzzy Hash: 49e3b7e9bfc9d3090135017787c7a3e6f357f7d605344af5d66b7e37a1c81829
Instruction Fuzzy Hash: 5E61BF754086019FC711CF58C480D9AB3F5FF98328F54866DE8999B702EB32E986CBD1

Function 6C4ADC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C4ADC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6C4AD38A,?), ref: 6C4ADC6F
free.MOZGLUE(?,?,?,?,?,6C4AD38A,?), ref: 6C4ADCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6C4AD38A,?), ref: 6C4ADCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6C4AD38A,?), ref: 6C4ADD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6C4AD38A,?), ref: 6C4ADD4A

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: 0f89ca9ba466ca0681a66c2ef23327cebf7114f38cda029965229e84e89072eb
Instruction ID: eabd48a49ed291e5de92a4aeeb67e570fc9c6908864a1c7e8a8335d0e0fc54e3
Opcode Fuzzy Hash: 0f89ca9ba466ca0681a66c2ef23327cebf7114f38cda029965229e84e89072eb
Instruction Fuzzy Hash: 6E4157B5A00605DFCB00CF99C880D9AB7B6FF98304B654469D906ABB14DB31FC01CB90

Function 6C4AC810 Relevance: 9.1, APIs: 6, Instructions: 75COMMON

Download Yara Rule

APIs

??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C4AC82D
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C4AC842

Part of subcall function 6C4ACAF0: ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(00000000,00000000,?,6C4CB5EB,00000000), ref: 6C4ACB12

?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,00000000), ref: 6C4AC863
std::_Facet_Register.LIBCPMT ref: 6C4AC875

Part of subcall function 6C48B13D: ??_U@YAPAXI@Z.MOZGLUE(00000008,?,?,6C4CB636,?), ref: 6C48B143

??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C4AC89A
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C4AC8BC

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_Bid@locale@std@@Facet_Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterV42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 2745304114-0
Opcode ID: 3c54caae2c03642f755307fe69b76ed08fe6fdb075063cd9624f56e5d898c71b
Instruction ID: 0bfaea33a3769ecf57db2c9f0fc1ca4e88bf0e5e12b92fdc1c9c8118bb48d634
Opcode Fuzzy Hash: 3c54caae2c03642f755307fe69b76ed08fe6fdb075063cd9624f56e5d898c71b
Instruction Fuzzy Hash: A2118675B002099FCB04FFA4C899DAE7B75FF99355B10012DE90697341DB31A905CBD1

Function 6C48F440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6C48F480

Part of subcall function 6C45F100: LoadLibraryW.KERNEL32(shell32,?,6C4CD020), ref: 6C45F122
Part of subcall function 6C45F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C45F132

CloseHandle.KERNEL32(00000000), ref: 6C48F555

Part of subcall function 6C4614B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C461248,6C461248,?), ref: 6C4614C9
Part of subcall function 6C4614B0: memcpy.VCRUNTIME140(?,6C461248,00000000,?,6C461248,?), ref: 6C4614EF

Part of subcall function 6C45EEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6C45EEE3

CreateFileW.KERNEL32 ref: 6C48F4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6C48F523

Strings

\oleacc.dll, xrefs: 6C48F4CB

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: ac1cf56ed3998a59c74436d92f03f90f220a4837c8191742dc36aa0097b20266
Instruction ID: dd682ecbe6ab34ea9951065edb79bd0d34161d374bf02a8bde44aefae28c3925
Opcode Fuzzy Hash: ac1cf56ed3998a59c74436d92f03f90f220a4837c8191742dc36aa0097b20266
Instruction Fuzzy Hash: 7E41BF3060A7509FE721EF29D884F9BB7F4AF44729F504A1CF59083691EB30E949CB92

Function 6C49E020 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 76threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C499420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C464A68), ref: 6C49945E
Part of subcall function 6C499420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C499470
Part of subcall function 6C499420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C499482
Part of subcall function 6C499420: __Init_thread_footer.LIBCMT ref: 6C49949F

GetCurrentThreadId.KERNEL32 ref: 6C49E047
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C49E04F

Part of subcall function 6C4994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C4994EE
Part of subcall function 6C4994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C499508

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C49E09C
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C49E0B0

Strings

[I %d/%d] profiler_get_profile, xrefs: 6C49E057

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: getenv$free$CurrentInit_thread_footerThread__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [I %d/%d] profiler_get_profile
API String ID: 1832963901-4276087706
Opcode ID: f9b2964cc2692502fe0b18f3887f58efa6b8933ffb06dc691e6fdb9fb9ba7819
Instruction ID: 18f52fb0965e1d2058ebb5ed3a19c59b97fcf1fc4bd7cca4ec066fea739fcc86
Opcode Fuzzy Hash: f9b2964cc2692502fe0b18f3887f58efa6b8933ffb06dc691e6fdb9fb9ba7819
Instruction Fuzzy Hash: AD21B074B001289FDF04EF64D898EAEBBB5BF85209F140418E90AA7740DB31E909C7E1

Function 6C4B74A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6C4B7526
__Init_thread_footer.LIBCMT ref: 6C4B7566
__Init_thread_footer.LIBCMT ref: 6C4B7597

Strings

kernel32.dll, xrefs: 6C4B7557
UnmapViewOfFile2, xrefs: 6C4B7552

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: 2af988b79658badc319f7bf3b08ea78feacb022acc361aa2bf9e495f0539b358
Instruction ID: 40d692f39ccc7f9c4226b2a9791bf83c5503c7888cf781f8bd8ae2672a080827
Opcode Fuzzy Hash: 2af988b79658badc319f7bf3b08ea78feacb022acc361aa2bf9e495f0539b358
Instruction Fuzzy Hash: 46216731B0640197EE24FFE8C864ED977B1EB4633AB01452CE80167F80CB30B90286B2

Function 6C4BA7A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C4DF770,-00000001,?,6C4CE330,?,6C47BDF7), ref: 6C4BA7AF
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,accelerator.dll,?,6C47BDF7), ref: 6C4BA7C2
moz_xmalloc.MOZGLUE(00000018,?,6C47BDF7), ref: 6C4BA7E4
LeaveCriticalSection.KERNEL32(6C4DF770), ref: 6C4BA80A

Strings

accelerator.dll, xrefs: 6C4BA7BF

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavemoz_xmallocstrcmp
String ID: accelerator.dll
API String ID: 2442272132-2426294810
Opcode ID: b3e9d15b95df3d4c2bf4e19ffa1aa12d6bf5e73fa992441557309557f58cfa56
Instruction ID: d77135e73ed7889474147236feaa854f965465ec728ec270eb9266a9e5a04a40
Opcode Fuzzy Hash: b3e9d15b95df3d4c2bf4e19ffa1aa12d6bf5e73fa992441557309557f58cfa56
Instruction Fuzzy Hash: A5018BB0A053049FEF04FF5AD884D91B7B8FF8A315705806AE8098B711DB70E800CBA1

Function 6C4B75B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C4B748B,?), ref: 6C4B75B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6C4B75D7
FreeLibrary.KERNEL32(?,6C4B748B,?), ref: 6C4B75EC

Strings

RtlNtStatusToDosError, xrefs: 6C4B75D1
ntdll.dll, xrefs: 6C4B75B3

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: 24e086019fb448adb28234ebc44fa2739c4fe1132fe6f6549464b6af64262b42
Instruction ID: 5600a2585e593235189d24b45a777fb1ce44f0c9b677ceeb2d7b94cb28d17028
Opcode Fuzzy Hash: 24e086019fb448adb28234ebc44fa2739c4fe1132fe6f6549464b6af64262b42
Instruction Fuzzy Hash: D4E0B671A06302ABFF10FFE2C948F857AF8EB06259F109435A915D6B40EBB1B042CF20

Function 6C4B7600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C4B7592), ref: 6C4B7608
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 6C4B7627
FreeLibrary.KERNEL32(?,6C4B7592), ref: 6C4B763C

Strings

ntdll.dll, xrefs: 6C4B7603
NtUnmapViewOfSection, xrefs: 6C4B7621

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 145871493-1050664331
Opcode ID: c66609feb308b254de131ae9b01beeb55b2e6c511e53f7474ec86934f99e775d
Instruction ID: aec160a436883308fe7e70ab3aadcb1d0f8f1c8f51b05be1c83f1da87494ebdb
Opcode Fuzzy Hash: c66609feb308b254de131ae9b01beeb55b2e6c511e53f7474ec86934f99e775d
Instruction Fuzzy Hash: B6E0BF70A45342ABEF10FFE5D808F417AB8E717359F004525E905D2740EB70B0008F24

Function 6C4BBE50 Relevance: 7.7, APIs: 5, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?,?,6C4BBE49), ref: 6C4BBEC4
RtlCaptureStackBackTrace.NTDLL ref: 6C4BBEDE
memset.VCRUNTIME140(00000000,00000000,-00000008,?,6C4BBE49), ref: 6C4BBF38
RtlReAllocateHeap.NTDLL ref: 6C4BBF83
RtlFreeHeap.NTDLL ref: 6C4BBFA6

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: Heapmemset$AllocateBackCaptureFreeStackTrace
String ID:
API String ID: 2764315370-0
Opcode ID: a21d2cc5263037a754234ff75ebc51f5b3d7e953d5910d5b39d9cd4bac3ae323
Instruction ID: 6f21f388e0cc863eb936fe2af150a536b642dce02b04ae461c79ac212e443b30
Opcode Fuzzy Hash: a21d2cc5263037a754234ff75ebc51f5b3d7e953d5910d5b39d9cd4bac3ae323
Instruction Fuzzy Hash: 2A517C71B006058FE714CF69CDC0FAAB3A2FF88314F294629D555A7B94DB30F9068BA0

Function 6C4A8E00 Relevance: 7.6, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,6C49B58D,?,?,?,?,?,?,?,6C4CD734,?,?,?,6C4CD734), ref: 6C4A8E6E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C49B58D,?,?,?,?,?,?,?,6C4CD734,?,?,?,6C4CD734), ref: 6C4A8EBF
free.MOZGLUE(?,?,?,?,6C49B58D,?,?,?,?,?,?,?,6C4CD734,?,?,?), ref: 6C4A8F24
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C49B58D,?,?,?,?,?,?,?,6C4CD734,?,?,?,6C4CD734), ref: 6C4A8F46
free.MOZGLUE(?,?,?,?,6C49B58D,?,?,?,?,?,?,?,6C4CD734,?,?,?), ref: 6C4A8F7A
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C49B58D,?,?,?,?,?,?,?,6C4CD734,?,?,?), ref: 6C4A8F8F

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: adbf146f55fd25846c3863076391aa8c3b68bbadd10e21e43f2ad0100664215a
Instruction ID: 3275bc65f0eaea5887e008937d62ff4bd52e3abe02d9682f017f1866a321688e
Opcode Fuzzy Hash: adbf146f55fd25846c3863076391aa8c3b68bbadd10e21e43f2ad0100664215a
Instruction Fuzzy Hash: CC51B1B1A012568FEB11DF94D880FAEB7B2FB58304F15052AE916AB744E731F906CB91

Function 6C4A27E0 Relevance: 7.6, APIs: 6, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C4A2620,?,?,?,6C4960AA,6C495FCB,6C4979A3), ref: 6C4A284D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C4A2620,?,?,?,6C4960AA,6C495FCB,6C4979A3), ref: 6C4A289A
free.MOZGLUE(?,?,?,6C4A2620,?,?,?,6C4960AA,6C495FCB,6C4979A3), ref: 6C4A28F1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C4A2620,?,?,?,6C4960AA,6C495FCB,6C4979A3), ref: 6C4A2910
free.MOZGLUE(00000001,?,?,6C4A2620,?,?,?,6C4960AA,6C495FCB,6C4979A3), ref: 6C4A293C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00200000,?,?,6C4A2620,?,?,?,6C4960AA,6C495FCB,6C4979A3), ref: 6C4A294E

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: a5924602074f513448726fe186818f4ae75d9a52a5528c5a7fdbe8d212cf472e
Instruction ID: 91b812e174f6e923f1826a3eb24a62a6f1be0da33acf26462fc4f7ad2e44d477
Opcode Fuzzy Hash: a5924602074f513448726fe186818f4ae75d9a52a5528c5a7fdbe8d212cf472e
Instruction Fuzzy Hash: 3441F3B1B002068FEB24CFA9D884F6A73F9AB55708F140539D95AEB744EB31E906CB51

Function 6C45CFE0 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 134memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C4DE784), ref: 6C45CFF6
LeaveCriticalSection.KERNEL32(6C4DE784), ref: 6C45D026
VirtualAlloc.KERNEL32(00000000,00100000,00001000,00000004), ref: 6C45D06C
VirtualFree.KERNEL32(00000000,00100000,00004000), ref: 6C45D139

Strings

MOZ_CRASH(), xrefs: 6C45D187

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: CriticalSectionVirtual$AllocEnterFreeLeave
String ID: MOZ_CRASH()
API String ID: 1090480015-2608361144
Opcode ID: f62ac3e5bfef96c8eee71046fb9873d3b7872e4d4172ddcb3a25ded4d50009e7
Instruction ID: 61eddc3777c30c3ab7ea9c1c519da54ec471709c32afeee321b3f5a054ed0b9f
Opcode Fuzzy Hash: f62ac3e5bfef96c8eee71046fb9873d3b7872e4d4172ddcb3a25ded4d50009e7
Instruction Fuzzy Hash: AB41AC72F012164FDB44EE6C8DD0FAAB6B0EF49714F550239EA18E7784D7A1AC018BC1

Function 6C454DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C454E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C454E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C454EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C454F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6C454F1E

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: 301f0f773b78759892fdea2da7edb6d4bbd471a9aa5ebb2876eacf7520dd5dbf
Instruction ID: 67c8b6024002540f2288bbf2c8a0c9eb9e018b52f9f6c7fdb6de0a056667cacd
Opcode Fuzzy Hash: 301f0f773b78759892fdea2da7edb6d4bbd471a9aa5ebb2876eacf7520dd5dbf
Instruction Fuzzy Hash: F641CC726087019FC705CF68C880E5BBBE4BF89394F509A2DF4659B750DB31E929CB81

Function 6C4BA820 Relevance: 7.6, APIs: 5, Instructions: 106stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C4DF770), ref: 6C4BA858
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C4BA87B

Part of subcall function 6C4BA9D0: memcpy.VCRUNTIME140(?,?,00000400,?,?,?,6C4BA88F,00000000), ref: 6C4BA9F1

_ltoa_s.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,00000020,0000000A), ref: 6C4BA8FF
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C4BA90C
LeaveCriticalSection.KERNEL32(6C4DF770), ref: 6C4BA97E

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: CriticalSectionstrlen$EnterLeave_ltoa_smemcpy
String ID:
API String ID: 1355178011-0
Opcode ID: c73187907201f3dc959fb1f8e00c13b9a72acfe43666dde8ebfae97d36c85991
Instruction ID: 39f961822a74bc6163ebcebf59e7db40e953416cdcf2ef9101fa5433bbd6f56c
Opcode Fuzzy Hash: c73187907201f3dc959fb1f8e00c13b9a72acfe43666dde8ebfae97d36c85991
Instruction Fuzzy Hash: 7841A4B4E002089FEB00EFA4D845FDDB771FF04324F148A19E826AB791D731A945DBA1

Function 6C461530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6C46152B,?,?,?,?,6C461248,?), ref: 6C46159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6C46152B,?,?,?,?,6C461248,?), ref: 6C4615BC
moz_xmalloc.MOZGLUE(-00000001,?,6C46152B,?,?,?,?,6C461248,?), ref: 6C4615E7
free.MOZGLUE(?,?,?,?,?,?,6C46152B,?,?,?,?,6C461248,?), ref: 6C461606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6C46152B,?,?,?,?,6C461248,?), ref: 6C461637

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: 469090d1d6bdf1cf2d3743d53db6f803c7aa434cedbf82b7b53a51bc3970c88d
Instruction ID: 1c360e7471c1c9c321ca78950a737ba2c0ba468342296d29321bad4def21cd1a
Opcode Fuzzy Hash: 469090d1d6bdf1cf2d3743d53db6f803c7aa434cedbf82b7b53a51bc3970c88d
Instruction Fuzzy Hash: C131D672A001148BCB18DE7DD851C6EB7A9AB813747240B2DE823DBFD8EB30D9158792

Function 6C4BAD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6C4CE330,?,6C47C059), ref: 6C4BAD9D

Part of subcall function 6C46CA10: malloc.MOZGLUE(?), ref: 6C46CA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6C4CE330,?,6C47C059), ref: 6C4BADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6C4CE330,?,6C47C059), ref: 6C4BAE01
GetLastError.KERNEL32(?,00000000,?,?,6C4CE330,?,6C47C059), ref: 6C4BAE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6C4CE330,?,6C47C059), ref: 6C4BAE3D

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: d0d8e04c407b8ffb3625955b67c73fd90f841f1511109c26e7dc02e1dfc7bc68
Instruction ID: 834dbc3c158b3a9082af4938777e7533970287fa36f377dc0237ee26c1ac0e84
Opcode Fuzzy Hash: d0d8e04c407b8ffb3625955b67c73fd90f841f1511109c26e7dc02e1dfc7bc68
Instruction Fuzzy Hash: 7E3141B1A002159FDB10EF798C44EABB7F8EF48614F15842DE84AE7710EB34E804CBA1

Function 6C4B5EF0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(00000001,00000000,6C4CDCA0,?,?,?,6C48E8B5,00000000), ref: 6C4B5F1F
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C48E8B5,00000000), ref: 6C4B5F4B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,6C48E8B5,00000000), ref: 6C4B5F7B
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(6E65475B,00000000,?,6C48E8B5,00000000), ref: 6C4B5F9F
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C48E8B5,00000000), ref: 6C4B5FD6

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?sbumpc@?$basic_streambuf@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1389714915-0
Opcode ID: 7e5a70b1cb66046abc0cde9e287f0f84d82dff5f25bff309786a0f15f406ccbe
Instruction ID: 5e36b21779c7d3b403155cb14c3e9f4eccc2a1ec8b229ba9d70df58d645b6327
Opcode Fuzzy Hash: 7e5a70b1cb66046abc0cde9e287f0f84d82dff5f25bff309786a0f15f406ccbe
Instruction Fuzzy Hash: 503109343006008FD711DF29C898E2AF7F6FF89319B644558E5569BB95CB31EC41CB90

Function 6C45B4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6C45B532
moz_xmalloc.MOZGLUE(?), ref: 6C45B55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C45B56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6C45B57E
free.MOZGLUE(00000000), ref: 6C45B58F

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: eb174709742f67f56e2169fddd36353139da0d45cc733fa7e07454a37eeddfe5
Instruction ID: 562c37e14b34f78ee72ddb9048267ed738330aa7501e4762bb033ccbd7445f75
Opcode Fuzzy Hash: eb174709742f67f56e2169fddd36353139da0d45cc733fa7e07454a37eeddfe5
Instruction Fuzzy Hash: E2210771A002099BDB00DF68CC40FAABBB9FF46318F68412DE918DB345E735D921C7A1

Function 6C45B7A0 Relevance: 7.6, APIs: 5, Instructions: 77COMMON

Download Yara Rule

APIs

?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C45B7CF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C45B808
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C45B82C
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C45B840
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C45B849

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: free$?vprint@PrintfTarget@mozilla@@mallocmemcpy
String ID:
API String ID: 1977084945-0
Opcode ID: 6f6677fc6a138daf791b9774e67d7529774a63cef4c08127a44cd6eeb0f37ff5
Instruction ID: 3da80c0ac93f385f9e2141983daa592af169afb4d419e22634c4d1579089cfae
Opcode Fuzzy Hash: 6f6677fc6a138daf791b9774e67d7529774a63cef4c08127a44cd6eeb0f37ff5
Instruction Fuzzy Hash: CA212BB4E002099FDF04DFA9C8859BEBBB4EF49214F148129E816A7341E731A954CBA1

Function 6C4B6E50 Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C4B6E78

Part of subcall function 6C4B6A10: InitializeCriticalSection.KERNEL32(6C4DF618), ref: 6C4B6A68
Part of subcall function 6C4B6A10: GetCurrentProcess.KERNEL32 ref: 6C4B6A7D
Part of subcall function 6C4B6A10: GetCurrentProcess.KERNEL32 ref: 6C4B6AA1
Part of subcall function 6C4B6A10: EnterCriticalSection.KERNEL32(6C4DF618), ref: 6C4B6AAE
Part of subcall function 6C4B6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C4B6AE1
Part of subcall function 6C4B6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C4B6B15
Part of subcall function 6C4B6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6C4B6B65
Part of subcall function 6C4B6A10: LeaveCriticalSection.KERNEL32(6C4DF618,?,?), ref: 6C4B6B83

MozFormatCodeAddress.MOZGLUE ref: 6C4B6EC1
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C4B6EE1
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C4B6EED
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000400), ref: 6C4B6EFF

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: CriticalSectionstrncpy$AddressCodeCurrentProcess$DescribeEnterFormatInitializeLeave_fileno_writefflush
String ID:
API String ID: 4058739482-0
Opcode ID: f58c9ed60052ece838ba1180ae08c7f9d27d37531d6598262cdc9c55abd37669
Instruction ID: 4449cce72b2ed3007ddfcc8ba1d9e1ab6cbabdf71496dc01ca54e59101c77371
Opcode Fuzzy Hash: f58c9ed60052ece838ba1180ae08c7f9d27d37531d6598262cdc9c55abd37669
Instruction Fuzzy Hash: FA219271A042199FDF04DF69D885ADA77F5EF88308F04403DE809A7341DB70AA58CFA2

Function 6C490D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6C453DEF), ref: 6C490D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6C453DEF), ref: 6C490D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6C453DEF), ref: 6C490DAF

Strings

<jemalloc>, xrefs: 6C490D92, 6C490DB9
: (malloc) Error in VirtualFree(), xrefs: 6C490D97, 6C490DBE

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: 094fe3fabfb8acd2cca36d8346928c1bec1543b9f6fde9d213837283b8b1ebf7
Instruction ID: f78e87f11c1233264a1ee1ff149ceb96005daa3230d930e932d4ffd5ad07eb5a
Opcode Fuzzy Hash: 094fe3fabfb8acd2cca36d8346928c1bec1543b9f6fde9d213837283b8b1ebf7
Instruction Fuzzy Hash: 97F0E9313C03A423E620F2660C1AF5A6F5EA7C6B75F314139F644DAAC0DA50F40146A5

Function 6C4B5850 Relevance: 7.5, APIs: 5, Instructions: 41synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(000000FF), ref: 6C4B586C
CloseHandle.KERNEL32 ref: 6C4B5878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C4B5898
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C4B58C9
free.MOZGLUE(00000000), ref: 6C4B58D3

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: free$CloseHandleObjectSingleWait
String ID:
API String ID: 1910681409-0
Opcode ID: 00c6cfb322b34080f7d377f2285cfe183330b3e6b9cced7956738dbf73b44be4
Instruction ID: db01ecd8538ae8926be60889fa7177ebad8db133c3a1ae9477a45b9f809b3725
Opcode Fuzzy Hash: 00c6cfb322b34080f7d377f2285cfe183330b3e6b9cced7956738dbf73b44be4
Instruction Fuzzy Hash: 27014F717262019BEF11FF16D818E06BBB9EB83339724423AE419D6611D731B924CF91

Function 6C4A7620 Relevance: 7.5, APIs: 5, Instructions: 35threadCOMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000002C,?,?,?,?,6C4A75C4,?), ref: 6C4A762B

Part of subcall function 6C46CA10: malloc.MOZGLUE(?), ref: 6C46CA26

InitializeConditionVariable.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6C4A74D7,6C4B15FC,?,?,?), ref: 6C4A7644
GetCurrentThreadId.KERNEL32 ref: 6C4A765A
AcquireSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C4A74D7,6C4B15FC,?,?,?), ref: 6C4A7663
ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C4A74D7,6C4B15FC,?,?,?), ref: 6C4A7677

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionCurrentInitializeReleaseThreadVariablemallocmoz_xmalloc
String ID:
API String ID: 418114769-0
Opcode ID: 067b7396d8848b3a0a3ffea361753fc637d2d09c40ee07bddfb64c7430aa0b2b
Instruction ID: 6c8d7780080aba536697c872676c53fa06c61b8cc303d047a992532c87f4c7cb
Opcode Fuzzy Hash: 067b7396d8848b3a0a3ffea361753fc637d2d09c40ee07bddfb64c7430aa0b2b
Instruction Fuzzy Hash: DAF0C271E10786ABD700EF22C888A76B778FFEA259F21431AF90443601E7B0B5D08BD0

Function 6C4B1700 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 190COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C4B1800

Part of subcall function 6C48CBE8: GetCurrentProcess.KERNEL32(?,6C4531A7), ref: 6C48CBF1
Part of subcall function 6C48CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C4531A7), ref: 6C48CBFA

Part of subcall function 6C454290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C493EBD,6C493EBD,00000000), ref: 6C4542A9

Strings

Details, xrefs: 6C4B1925
{marker.name} - {marker.data.name}, xrefs: 6C4B18C7
name, xrefs: 6C4B1939

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: Process$CurrentInit_thread_footerTerminatestrlen
String ID: Details$name${marker.name} - {marker.data.name}
API String ID: 46770647-1733325692
Opcode ID: bb010763cfabe9332081033d585a41adb7980724f4011bbc3fc1bd2ef1e8b150
Instruction ID: c706982def4122b78b45f4a9f9969b043c9f10bc5d23179ef1993a0ac1a0f42b
Opcode Fuzzy Hash: bb010763cfabe9332081033d585a41adb7980724f4011bbc3fc1bd2ef1e8b150
Instruction Fuzzy Hash: 8771E1B0A002469FDB04EF28D490E9ABBB1FF45354F44466DE8155BB41DB70F6A8CBE2

Function 6C47D468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6C48CBE8: GetCurrentProcess.KERNEL32(?,6C4531A7), ref: 6C48CBF1
Part of subcall function 6C48CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C4531A7), ref: 6C48CBFA

EnterCriticalSection.KERNEL32(6C4DE784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C48D1C5), ref: 6C47D4F2
LeaveCriticalSection.KERNEL32(6C4DE784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C48D1C5), ref: 6C47D50B

Part of subcall function 6C45CFE0: EnterCriticalSection.KERNEL32(6C4DE784), ref: 6C45CFF6
Part of subcall function 6C45CFE0: LeaveCriticalSection.KERNEL32(6C4DE784), ref: 6C45D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C48D1C5), ref: 6C47D52E
EnterCriticalSection.KERNEL32(6C4DE7DC), ref: 6C47D690
LeaveCriticalSection.KERNEL32(6C4DE784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C48D1C5), ref: 6C47D751

Strings

MOZ_CRASH(), xrefs: 6C47D4BB

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: e8ca89823e73015aef9142c46bdcceff010bb3afea99d815641e9f9e94879f7a
Instruction ID: b30f93ea333e0ad373e6f6c8fb769b695af9a4d8a5c4b6eb2937a52db7704c19
Opcode Fuzzy Hash: e8ca89823e73015aef9142c46bdcceff010bb3afea99d815641e9f9e94879f7a
Instruction Fuzzy Hash: 1F51D171A047018FD364EF28C194F5ABBE1EF89714F558A2EE599C7B84D770E840CBA2

Function 6C4A4630 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C4A4721

Strings

profiler-paused, xrefs: 6C4A46E4
., xrefs: 6C4A476A
-%llu, xrefs: 6C4A4733

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: __aulldiv
String ID: -%llu$.$profiler-paused
API String ID: 3732870572-2661126502
Opcode ID: c66ee0dd6b1e7ebace2e845183c2c1424c64402498f8d8563aee6b55d327fe2e
Instruction ID: e193e2d409fe0349487f421249f60cf2cda5a2b52d583308ec6371b2da0ab815
Opcode Fuzzy Hash: c66ee0dd6b1e7ebace2e845183c2c1424c64402498f8d8563aee6b55d327fe2e
Instruction Fuzzy Hash: 3D419875E046089BCB08EFB8E841D5EBBF5EF95384F10962EE8055BB55EB3098018782

Function 6C4A46E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C4A4721

Part of subcall function 6C454410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6C493EBD,00000017,?,00000000,?,6C493EBD,?,?,6C4542D2), ref: 6C454444

Strings

profiler-paused, xrefs: 6C4A46E4
., xrefs: 6C4A476A
-%llu, xrefs: 6C4A4733

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$profiler-paused
API String ID: 680628322-2661126502
Opcode ID: e4520610b5898f47467b6d415d5cddc598de8dc79b6e75f7b3dc234b67e75d2a
Instruction ID: 51a1a64d14690088447a96a743c9e0d3c127741d9646d8cc40160e0d34b86971
Opcode Fuzzy Hash: e4520610b5898f47467b6d415d5cddc598de8dc79b6e75f7b3dc234b67e75d2a
Instruction Fuzzy Hash: 4C317C75F012084BCB0CDFACD891E9DBBE6DB98314F55913EE8059BB45EB70D9058B90

Function 6C4AB410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C454290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C493EBD,6C493EBD,00000000), ref: 6C4542A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C4AB127), ref: 6C4AB463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C4AB4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6C4AB4E4

Strings

pid:, xrefs: 6C4AB4DE

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: 4382cb065dc20437e604f0fe764ae8ebc38bf4e270a288dc7df285527ce23e17
Instruction ID: bdd58137d6cb98c81c5798da916c5038d063e75d25a58d37961fbed72d8e0e80
Opcode Fuzzy Hash: 4382cb065dc20437e604f0fe764ae8ebc38bf4e270a288dc7df285527ce23e17
Instruction Fuzzy Hash: 0131F231A012189FDB10EFE9D880EEEB7B5BF19319F54052DE81167B85D732A846CBE1

Function 6C46BF00 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

??0ios_base@std@@IAE@XZ.MSVCP140(?,?,?,?,6C4B7A3F), ref: 6C46BF11
?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IAEXPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z.MSVCP140(?,00000000,?,6C4B7A3F), ref: 6C46BF5D
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ.MSVCP140(?,6C4B7A3F), ref: 6C46BF7E

Strings

Ll, xrefs: 6C46BF84

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$??0?$basic_streambuf@??0ios_base@std@@?init@?$basic_ios@D@std@@@2@_V?$basic_streambuf@
String ID: Ll
API String ID: 4279176481-2360732270
Opcode ID: 255683dbd739afc1e9436cea5b7a46c2233aadab9df126d4a15e2d94c410a8b1
Instruction ID: f5c0ec1b2232e85ce744089c65f5d5349db08a7b5d8e6d6351bd0900b6f9afeb
Opcode Fuzzy Hash: 255683dbd739afc1e9436cea5b7a46c2233aadab9df126d4a15e2d94c410a8b1
Instruction Fuzzy Hash: 9411BCB93006048FC729DF0CD599D26FBF8FB59304355885DEA8A8BB60C732B800CB91

Function 6C49E550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C49E577
AcquireSRWLockExclusive.KERNEL32(6C4DF4B8), ref: 6C49E584
ReleaseSRWLockExclusive.KERNEL32(6C4DF4B8), ref: 6C49E5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C49E8A6

Strings

MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C49E777
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C49E722, 6C49E750, 6C49E7A2
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C49E655
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C49E826, 6C49E850
MOZ_PROFILER_STARTUP, xrefs: 6C49E5A1, 6C49E5CC, 6C49E5FF, 6C49E62A

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: efe8b0a17fc23eaf31b04e65bee64e963db10ff95be9ba57130ef599a670c595
Instruction ID: 266cdeb963fb63800c8eb7c34fb15d598b9c25f5d30f47bbf12c32073c830004
Opcode Fuzzy Hash: efe8b0a17fc23eaf31b04e65bee64e963db10ff95be9ba57130ef599a670c595
Instruction Fuzzy Hash: 3211AD31A05298EFDB10FF54C888F6ABBB4FB8932AF060619E84547750C770B804CBD1

Function 6C4A0C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C4A0CD5

Part of subcall function 6C48F960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C48F9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C4A0D40
free.MOZGLUE ref: 6C4A0DCB

Part of subcall function 6C475E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C475EDB
Part of subcall function 6C475E90: memset.VCRUNTIME140(ewKl,000000E5,?), ref: 6C475F27
Part of subcall function 6C475E90: LeaveCriticalSection.KERNEL32(?), ref: 6C475FB2

free.MOZGLUE ref: 6C4A0DDD
free.MOZGLUE ref: 6C4A0DF2

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: 3c330f9bd593ec5418e5cf55a443d1f3c7d63962d0a53851939ab44d8e0bc790
Instruction ID: dc02945fbfe2342f6d4b9e7bd26bb9d338d7de0c38ab8d878d1932cb9d337354
Opcode Fuzzy Hash: 3c330f9bd593ec5418e5cf55a443d1f3c7d63962d0a53851939ab44d8e0bc790
Instruction Fuzzy Hash: 42415875A097808BD320DF29C080F9AFBE1BFD8714F518A2EE8D987750D770A446CB82

Function 6C490800 Relevance: 6.3, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C4DE7DC), ref: 6C490838
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C49084C
EnterCriticalSection.KERNEL32(?), ref: 6C4908AF
LeaveCriticalSection.KERNEL32(?), ref: 6C4908BD
LeaveCriticalSection.KERNEL32(6C4DE7DC), ref: 6C4908D5

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset
String ID:
API String ID: 837921583-0
Opcode ID: 149da546184d062583119881ee99dd1ed371f3797938d38763eb7a3d9ddf8797
Instruction ID: 9e5c604216d3fb777193ceb64fa51d6a5841a94571eb07646b94165efd63719f
Opcode Fuzzy Hash: 149da546184d062583119881ee99dd1ed371f3797938d38763eb7a3d9ddf8797
Instruction Fuzzy Hash: C021BE31B0125A9BEF04EF65D884FAEBBB9AF49709F50052CD909A7B40DB31A804CBD0

Function 6C4ACCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6C49DA31,00100000,?,?,00000000,?), ref: 6C4ACDA4

Part of subcall function 6C46CA10: malloc.MOZGLUE(?), ref: 6C46CA26

Part of subcall function 6C4AD130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6C4ACDBA,00100000,?,00000000,?,6C49DA31,00100000,?,?,00000000,?), ref: 6C4AD158
Part of subcall function 6C4AD130: InitializeConditionVariable.KERNEL32(00000098,?,6C4ACDBA,00100000,?,00000000,?,6C49DA31,00100000,?,?,00000000,?), ref: 6C4AD177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6C49DA31,00100000,?,?,00000000,?), ref: 6C4ACDC4

Part of subcall function 6C4A7480: ReleaseSRWLockExclusive.KERNEL32(?,6C4B15FC,?,?,?,?,6C4B15FC,?), ref: 6C4A74EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6C49DA31,00100000,?,?,00000000,?), ref: 6C4ACECC

Part of subcall function 6C46CA10: mozalloc_abort.MOZGLUE(?), ref: 6C46CAA2

Part of subcall function 6C49CB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6C4ACEEA,?,?,?,?,00000000,?,6C49DA31,00100000,?,?,00000000), ref: 6C49CB57
Part of subcall function 6C49CB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6C49CBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6C4ACEEA,?,?), ref: 6C49CBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6C49DA31,00100000,?,?,00000000,?), ref: 6C4AD058

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: 4bdd6d7b14d30dc6692e34adb518c3739ca41ffab75be9fc6848d9f1a95f3ba1
Instruction ID: 87d5df99230e5f3205cd9f2278f0218e74aac92fd32dad43c7676962dd3de0ae
Opcode Fuzzy Hash: 4bdd6d7b14d30dc6692e34adb518c3739ca41ffab75be9fc6848d9f1a95f3ba1
Instruction Fuzzy Hash: 0CD17F71A04B069FD748CF28C480F99B7F1BF99308F01862DE8598B755EB31A966CBC1

Function 6C461720 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6C4617B2
memset.VCRUNTIME140(?,00000000,?,?), ref: 6C4618EE
free.MOZGLUE(?), ref: 6C461911
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C46194C

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturnfreememcpymemset
String ID:
API String ID: 3725304770-0
Opcode ID: 4c8659751846e558c0f212dd5dc1d69d3bbb3e289dec8b0bf1033260d3115c5d
Instruction ID: 06446ebef420962e4058a95f46e896c4415fb83210e6ccc3a2c9ea552b06f01a
Opcode Fuzzy Hash: 4c8659751846e558c0f212dd5dc1d69d3bbb3e289dec8b0bf1033260d3115c5d
Instruction Fuzzy Hash: 90819174A112059FCB08CF69D894DAEBBB1FF89314F04452DE811ABB58D730E959CBA1

Function 6C475C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6C475D40
EnterCriticalSection.KERNEL32(6C4DF688), ref: 6C475D67
__aulldiv.LIBCMT ref: 6C475DB4
LeaveCriticalSection.KERNEL32(6C4DF688), ref: 6C475DED

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: b97fe0bc26e3cd9ef1ca21463c5e7e181cd2b7c0b10fa7c624afee9284a9ea46
Instruction ID: 025523aa49d4169a4487f8c746216b58c92c1063d9a259a22adc46c3f7a46bc6
Opcode Fuzzy Hash: b97fe0bc26e3cd9ef1ca21463c5e7e181cd2b7c0b10fa7c624afee9284a9ea46
Instruction Fuzzy Hash: D2517E71E011198FDF18EFA8C994EAEBBB2FB89304F19861DD811A7B50C7707946CB90

Function 6C45CDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6C45CEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6C45CEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6C45CF4E

Strings

0, xrefs: 6C45CF30

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: a05ae5d5f1e0df9c078a0c89a13a388a5a1e086a86fb9c85884b59ae45799525
Instruction ID: eb07300902fd99a17ec3461273daf886cc17e74e5691d0d7c16478ad6df334a2
Opcode Fuzzy Hash: a05ae5d5f1e0df9c078a0c89a13a388a5a1e086a86fb9c85884b59ae45799525
Instruction Fuzzy Hash: 3151F176A002568FCB00CF18C890EAABBB5EF99304F19859DD8595F792D731ED16CBE0

Function 6C4B77D0 Relevance: 6.1, APIs: 4, Instructions: 113stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C4B77FA
?StringToDouble@StringToDoubleConverter@double_conversion@@QBENPBDHPAH@Z.MOZGLUE(00000001,00000000,?), ref: 6C4B7829

Part of subcall function 6C48CC38: GetCurrentProcess.KERNEL32(?,?,?,?,6C4531A7), ref: 6C48CC45
Part of subcall function 6C48CC38: TerminateProcess.KERNEL32(00000000,00000003,?,?,?,?,6C4531A7), ref: 6C48CC4E

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C4B789F
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C4B78CF

Part of subcall function 6C454DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C454E5A
Part of subcall function 6C454DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C454E97

Part of subcall function 6C454290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C493EBD,6C493EBD,00000000), ref: 6C4542A9

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$DtoaProcessstrlen$Ascii@Builder@2@Builder@2@@Converter@CreateCurrentDecimalDouble@EcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestTerminateV12@
String ID:
API String ID: 2525797420-0
Opcode ID: a84c4d2fc90b151f50eceabfa1623d228fbb8c85011549c0a2351faa1e156532
Instruction ID: f959617c178915bad48a63983ceb84ec58ccedb85fca055e428ba40bccc15373
Opcode Fuzzy Hash: a84c4d2fc90b151f50eceabfa1623d228fbb8c85011549c0a2351faa1e156532
Instruction Fuzzy Hash: 1141A1719047469FD300EF29C48096AFBF4FF8A254F604A1DE4A987790DB30E559CBE2

Function 6C496470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6C4982BC,?,?), ref: 6C49649B

Part of subcall function 6C46CA10: malloc.MOZGLUE(?), ref: 6C46CA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C4964A9

Part of subcall function 6C48FA80: GetCurrentThreadId.KERNEL32 ref: 6C48FA8D
Part of subcall function 6C48FA80: AcquireSRWLockExclusive.KERNEL32(6C4DF448), ref: 6C48FA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C49653F
free.MOZGLUE(?), ref: 6C49655A

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: fff009b5af64a9a6987b843dc581aa0763ba4798af4d6c0a437aebb4d925bce9
Instruction ID: 91e6159f3d890ece98cfb7a08e8a5acf0f5a78aaf792e75bb4d1509ac969b880
Opcode Fuzzy Hash: fff009b5af64a9a6987b843dc581aa0763ba4798af4d6c0a437aebb4d925bce9
Instruction Fuzzy Hash: 73315DB5A04315AFD740DF14D884E9ABBE4BF89324F00482EE85A97751DB30E919CBD2

Function 6C48FF60 Relevance: 6.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,80000001,80000000,?,6C4AD019,?,?,?,?,?,00000000,?,6C49DA31,00100000,?), ref: 6C48FFD3
memcpy.VCRUNTIME140(00000000,?,?,?,6C4AD019,?,?,?,?,?,00000000,?,6C49DA31,00100000,?,?), ref: 6C48FFF5
free.MOZGLUE(?,?,?,?,?,6C4AD019,?,?,?,?,?,00000000,?,6C49DA31,00100000,?), ref: 6C49001B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,6C4AD019,?,?,?,?,?,00000000,?,6C49DA31,00100000,?,?), ref: 6C49002A

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: memcpy$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 826125452-0
Opcode ID: 413b32860f43e56562a768983c0d53eed9a6ca2081fac73386bb8c727f835bcd
Instruction ID: c0840b4fe25aa7f6d75a371d33ca2871ac242d893d31859212d644544cfe5b24
Opcode Fuzzy Hash: 413b32860f43e56562a768983c0d53eed9a6ca2081fac73386bb8c727f835bcd
Instruction Fuzzy Hash: 3521C4B2E012155BD718DF68A894CAEB7BAFB853247250339E525D7780EA70AD0186D1

Function 6C46B4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C46B4F5
AcquireSRWLockExclusive.KERNEL32(6C4DF4B8), ref: 6C46B502
ReleaseSRWLockExclusive.KERNEL32(6C4DF4B8), ref: 6C46B542
free.MOZGLUE(?), ref: 6C46B578

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: cdc9783f5defe7ef3ad99a7b6013e14dca123db72fd5ba255b7dd82b8400daff
Instruction ID: a4a5b04c3728fb570e45102437b471139c4050f250a7fb056d29ba9cf485cede
Opcode Fuzzy Hash: cdc9783f5defe7ef3ad99a7b6013e14dca123db72fd5ba255b7dd82b8400daff
Instruction Fuzzy Hash: C511CD30A14B41C7D321EF2AC800FA1B3B1FFA632AF14970AE84953E01EBB0B1C58790

Function 6C493DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6C45F20E,?), ref: 6C493DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6C45F20E,00000000,?), ref: 6C493DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C493E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6C493E0E

Part of subcall function 6C48CC00: GetCurrentProcess.KERNEL32(?,?,6C4531A7), ref: 6C48CC0D
Part of subcall function 6C48CC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6C4531A7), ref: 6C48CC16

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: 336069571e64e27b15bbd87e93b2732cec9837c8fe804ee513d8ca024b99f039
Instruction ID: 2b04b96f117af22bd4d5d13a33452885360521731cdf26ae2db497c1fb312251
Opcode Fuzzy Hash: 336069571e64e27b15bbd87e93b2732cec9837c8fe804ee513d8ca024b99f039
Instruction Fuzzy Hash: 9EF0F8B1A002186BEA01FB94EC81EAB376DEB46628F040025FE0857741D635BE6996E7

Function 6C4A2050 Relevance: 6.0, APIs: 4, Instructions: 33threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C4A205B
AcquireSRWLockExclusive.KERNEL32(?,?,?,00000000,?,6C4A201B,?,?,?,?,?,?,?,6C4A1F8F,?,?), ref: 6C4A2064
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C4A208E
free.MOZGLUE(?,?,?,00000000,?,6C4A201B,?,?,?,?,?,?,?,6C4A1F8F,?,?), ref: 6C4A20A3

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 9af6f8aef585361a6f806c0057eb168a0169194f3cfd045430efefc962362eed
Instruction ID: 7db31a4c3a0efb7670190c0875199e3cea24d7eeae76a27c177cf505aaa35423
Opcode Fuzzy Hash: 9af6f8aef585361a6f806c0057eb168a0169194f3cfd045430efefc962362eed
Instruction Fuzzy Hash: 28F090B1104A109BC721EF17D888F5BB7F9EF9A324F10011AE64A87710CB71A806CB96

Function 6C4A85B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6C4A85D3

Part of subcall function 6C46CA10: malloc.MOZGLUE(?), ref: 6C46CA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6C4A8725

Strings

map/set<T> too long, xrefs: 6C4A8720

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: 69df456508bbbc068a46e26da13800a396af917d17157f3f67913fd1436c965d
Instruction ID: 1cadeb0cf67fd3fcd4c3b805191161463af71a37c83577e5eb8be53a961f733b
Opcode Fuzzy Hash: 69df456508bbbc068a46e26da13800a396af917d17157f3f67913fd1436c965d
Instruction Fuzzy Hash: 565155B4A006818FE701CF58C584E95BBF1FF69318F18C19AD8595BB66C335E846CF92

Function 6C45BD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6C45BDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C45BE8F

Strings

0, xrefs: 6C45BE5B

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: c596fe5640b32ee1883b00c01f9cc2a217ba1687b4020a073cd204dcd1d6d126
Instruction ID: 8eada5f97fc14c8ede7e7b2581ced2675f67fb497478f8e6fbec2011a033e809
Opcode Fuzzy Hash: c596fe5640b32ee1883b00c01f9cc2a217ba1687b4020a073cd204dcd1d6d126
Instruction Fuzzy Hash: 5C418F71A09745DFC701CF28C481E9BB7F4AF8A348F448A1DF985A7611D731E969CB82

Function 6C493CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C493D19
mozalloc_abort.MOZGLUE(?), ref: 6C493D6C

Strings

d, xrefs: 6C493D58

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: eaee8d42dbc388f96d44e6bf678ef28130484501005453dddbac804f1e8aa01d
Instruction ID: 96e3f018819c5a90c3dccfcdd1a8c35044b2c3948c48d5f947ea991ecfd7e142
Opcode Fuzzy Hash: eaee8d42dbc388f96d44e6bf678ef28130484501005453dddbac804f1e8aa01d
Instruction Fuzzy Hash: 8A11C435E046989BDB01EB69CC24DEDBB75EF87218F45931CDC4997722EB30AA84C390

Function 6C464730 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C4644B2,6C4DE21C,6C4DF7F8), ref: 6C46473E
GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C46474A

Strings

GetNtLoaderAPI, xrefs: 6C464744

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetNtLoaderAPI
API String ID: 1646373207-1628273567
Opcode ID: b017bd9789ccd1cf3fd9469b970b269a627fcc83bddcbaabcf85aa909bee4c82
Instruction ID: a8f6ba7340e90178265011e16b11f50477b930a1fad20dea16b55fa2dfdfdabb
Opcode Fuzzy Hash: b017bd9789ccd1cf3fd9469b970b269a627fcc83bddcbaabcf85aa909bee4c82
Instruction Fuzzy Hash: EF015E75B012549FDF00FFA6D894E19BBB9EB8B366B054869EA05C7700DB74E8018F92

Function 6C4B6DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6C4B6E22
__Init_thread_footer.LIBCMT ref: 6C4B6E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6C4B6E1D

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: 44cd2a83ffdbd90b5da30f14c14cd94887d786b94af8b157cf91bccf93273789
Instruction ID: cffcc5476699766a6a46ef9271e8c50d43fcf02b51c9ce9c13c95d1c37766a48
Opcode Fuzzy Hash: 44cd2a83ffdbd90b5da30f14c14cd94887d786b94af8b157cf91bccf93273789
Instruction Fuzzy Hash: C0F02E302062808BEE20FB78C8A1ED177B29703218F080169F80496FA1C731B607CBA3

Function 6C469E70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C469EEF

Strings

Infinity, xrefs: 6C469EB7
NaN, xrefs: 6C469EC1

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: Infinity$NaN
API String ID: 1385522511-4285296124
Opcode ID: bdf3b917cb8639939c39427f3fd6be4fde211961d8a503ab2e8e9482e253a7cb
Instruction ID: 92023849f5b20b8aca48dec22de913bec95c12f50c039a49f0242cf1041fcf90
Opcode Fuzzy Hash: bdf3b917cb8639939c39427f3fd6be4fde211961d8a503ab2e8e9482e253a7cb
Instruction Fuzzy Hash: 15F0CD70603281CBFF20FF58D855F9077F1B713319F240A18CA020AB80D7BAB646CA82

Function 6C466C30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0KIl,?,6C494B30,80000000,?,6C494AB7,?,6C4543CF,?,6C4542D2), ref: 6C466C42

Part of subcall function 6C46CA10: malloc.MOZGLUE(?), ref: 6C46CA26

moz_xmalloc.MOZGLUE(0KIl,?,6C494B30,80000000,?,6C494AB7,?,6C4543CF,?,6C4542D2), ref: 6C466C58

Strings

0KIl, xrefs: 6C466C33, 6C466C41, 6C466C57

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: moz_xmalloc$malloc
String ID: 0KIl
API String ID: 1967447596-3357514915
Opcode ID: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction ID: 2e83a8bc406aecc7a9d3be842c683885b353ba4db28f6f04e996d843481f0704
Opcode Fuzzy Hash: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction Fuzzy Hash: 47E086F1A10A454B9F08D97AAC09EAA71C88B542ED7044A39EC22C6FCCFA74E5508191

Function 6C463850 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C4DF860), ref: 6C46385C
ReleaseSRWLockExclusive.KERNEL32(6C4DF860,?), ref: 6C463871

Strings

,Ml, xrefs: 6C46387A

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease
String ID: ,Ml
API String ID: 17069307-3798735700
Opcode ID: 5a627d689af877cc9db08f992e32bfd8caced45859015a82af52363cfe5b2e6e
Instruction ID: eef284fd399111a75f53cfc89c0340e18d90422c8553af62c842f72e58f1c4be
Opcode Fuzzy Hash: 5a627d689af877cc9db08f992e32bfd8caced45859015a82af52363cfe5b2e6e
Instruction Fuzzy Hash: 74E0DF31A42A9897C621FF978411ECABBB8EF0769030A880AF40A17F00C730F18086C6

Function 6C46BED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15librarythreadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 6C46BEE3
LoadLibraryExW.KERNEL32(cryptbase.dll,00000000,00000800), ref: 6C46BEF5

Strings

cryptbase.dll, xrefs: 6C46BEF0

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: Library$CallsDisableLoadThread
String ID: cryptbase.dll
API String ID: 4137859361-1262567842
Opcode ID: 39364c9692c87357f7a710cb3e94136a91e03ae46a35a7a3bf01d647d537a328
Instruction ID: a3436258d457b058ffe909a1b1a6a1ca8649d3b935dd4bde26bae8edd2360496
Opcode Fuzzy Hash: 39364c9692c87357f7a710cb3e94136a91e03ae46a35a7a3bf01d647d537a328
Instruction Fuzzy Hash: E6D0C932284209EADA40FBA1CD1AF293BB8A712766F10C021F75595D52CBB1B451DB94

Function 6C4AB5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6C4AB2C9,?,?,?,6C4AB127,?,?,?,?,?,?,?,?,?,6C4AAE52), ref: 6C4AB628

Part of subcall function 6C4A90E0: free.MOZGLUE(?,00000000,?,?,6C4ADEDB), ref: 6C4A90FF
Part of subcall function 6C4A90E0: free.MOZGLUE(?,00000000,?,?,6C4ADEDB), ref: 6C4A9108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C4AB2C9,?,?,?,6C4AB127,?,?,?,?,?,?,?,?,?,6C4AAE52), ref: 6C4AB67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C4AB2C9,?,?,?,6C4AB127,?,?,?,?,?,?,?,?,?,6C4AAE52), ref: 6C4AB708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6C4AB127,?,?,?,?,?,?,?,?), ref: 6C4AB74D

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: dea6f0c6d71459d15050d7a8404f86ce02a37eee80bb8dd6fcc1b131ec04556b
Instruction ID: 729cd988271f4d9c35063d22782d390b7c612303c5398611ce4d7be6ad795647
Opcode Fuzzy Hash: dea6f0c6d71459d15050d7a8404f86ce02a37eee80bb8dd6fcc1b131ec04556b
Instruction Fuzzy Hash: A6510E75A0121A8FDB14DF98C980F6EBBB1FF54305F05812DC81AAB718D731A806CBA1

Function 6C4ADF90 Relevance: 5.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C49FF2A), ref: 6C4ADFFD

Part of subcall function 6C4A90E0: free.MOZGLUE(?,00000000,?,?,6C4ADEDB), ref: 6C4A90FF
Part of subcall function 6C4A90E0: free.MOZGLUE(?,00000000,?,?,6C4ADEDB), ref: 6C4A9108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C49FF2A), ref: 6C4AE04A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C49FF2A), ref: 6C4AE0C0
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,6C49FF2A), ref: 6C4AE0FE

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: c7d182d552913400c6a2af69555b6109eecbc7a6c4d27f564899b892d932f121
Instruction ID: 1b4f0d414f6c57877167ef0666cf1bfe566a117f3593e41e7887adf4ea42853a
Opcode Fuzzy Hash: c7d182d552913400c6a2af69555b6109eecbc7a6c4d27f564899b892d932f121
Instruction Fuzzy Hash: BA41C2B16082268FEB14CFA9C8D0F5A73B2AB55308F14452DD526DB744E732E926CBD2

Function 6C4A6E50 Relevance: 5.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000018), ref: 6C4A6EAB
memcpy.VCRUNTIME140(00000000,00000018,-000000A0), ref: 6C4A6EFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C4A6F1E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C4A6F5C

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: e581b5eff487ef2a724b842a122e37d3f36317179edda885558363285da42aa0
Instruction ID: 09e00215a058df1636eb768dee000de02e2768f490f43b6adf84e1936b44d6eb
Opcode Fuzzy Hash: e581b5eff487ef2a724b842a122e37d3f36317179edda885558363285da42aa0
Instruction Fuzzy Hash: 2231E571A1060A8FEB04DF6CC980FAA73F9EBA4345F50423DD41AC7665EB31E65AC790

Function 6C4BB580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6C460A4D,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C4BB5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6C460A4D,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C4BB623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6C460A4D,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C4BB66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,6C460A4D,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C4BB67F

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: 48809a92f99f8d96b5603705619ffc8d32cb0b190fc89a6f57d3d34537415620
Instruction ID: 312058e32abb9105c0a0e66855b6ddf73dda0097a438e55ea9fdb34a348d275c
Opcode Fuzzy Hash: 48809a92f99f8d96b5603705619ffc8d32cb0b190fc89a6f57d3d34537415620
Instruction Fuzzy Hash: A831D471A012168FDB11DF58C884E5ABBF5FF85305F168669C846EB301DB31ED15CBA2

Function 6C48F5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6C48F611
memcpy.VCRUNTIME140(?,?,?), ref: 6C48F623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6C48F652
memcpy.VCRUNTIME140(?,?,?), ref: 6C48F668

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: 4eb6c13f480cdfda4cca9d36f4672446d12d0ff217cf0d57b4621f8a96ef4f4c
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: BE315C71B01214AFD714CF6DDCC0E9A7BF9EB84354B18853CEA4A8BB19E631E9458B90

Function 6C4A26B0 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C4A26C1
free.MOZGLUE(?), ref: 6C4A26E4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C4A26FF
free.MOZGLUE ref: 6C4A270D

Memory Dump Source

Source File: 00000000.00000002.2116017894.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.2116001466.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116096879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116136860.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2116158095.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: b896c325e311613d09b48abf53fbb11903e02f739536099b307a111f500c6df6
Instruction ID: 0da15c4433a0514903f6904a2aab79500714ce460996f173172c78769ccca17a
Opcode Fuzzy Hash: b896c325e311613d09b48abf53fbb11903e02f739536099b307a111f500c6df6
Instruction Fuzzy Hash: 50F0F9B2B022005BE720DF99D884D4B73A9EF61259B100035EA1ED7B11EB31F91AD6A2

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: LummaC

Threatname: Amadey

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Phishing

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\CBKJEGCBKKJECBGCGDBAKJEBAA

C:\ProgramData\EBGCGHIDHCBFHIDGHCBK

C:\ProgramData\HDAFBGIJ

C:\ProgramData\JDBGHIIDAECBFIDHIIDG

C:\ProgramData\JECGIIIDAKJDHJKFHIEB

C:\ProgramData\JJKFBAKFBGDHIEBGDAKFCAFHCB

Windows Analysis Report
file.exe

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre